Overview

overview

7

Static

static

3

2026-11-13...om.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/11/2026, 21:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-13_d94815ec575302fcb1f9a4fb3b7f2628_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  • Size 9.1MB
  • Sample261113-1lp3zsf14j
  • SHA256 9b406ab670f57e6695ec64b2530634a7f3b9c9251040670494adb723e9bfb536
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryransomwarespywarestealerupx

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 43 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-13_d94815ec575302fcb1f9a4fb3b7f2628_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-13_d94815ec575302fcb1f9a4fb3b7f2628_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Users\Admin\AppData\Local\Temp\2026-11-13_d94815ec575302fcb1f9a4fb3b7f2628_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-11-13_d94815ec575302fcb1f9a4fb3b7f2628_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=157.0.8103.38 "--attachment=C:\Program Files\chrome_installer.log" --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x3bc,0x47c,0x49c,0x478,0x498,0x14073d768,0x14073d778,0x14073d788
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      PID:876
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffba7fc728,0x7fffba7fc734,0x7fffba7fc740
        3⤵
          PID:3640
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,12828962324297610229,4422120024268850810,262144 --field-trial-handle=2024,i,18094511547946148414,9443556188605093753,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2016 /prefetch:2
          3⤵
            PID:5084
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,8022668073038710489,13439816218168309915,524288 --field-trial-handle=2024,i,18094511547946148414,9443556188605093753,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2136 /prefetch:3
            3⤵
            • System Time Discovery
            PID:536
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,5325019682668594648,15861174849376555178,524288 --field-trial-handle=2024,i,18094511547946148414,9443556188605093753,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2364 /prefetch:8
            3⤵
              PID:1680
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,14726409204260307862,3562053337626192487,2097152 --field-trial-handle=2024,i,18094511547946148414,9443556188605093753,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
              3⤵
                PID:5256
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,15228237606351108013,3281652761757675851,2097152 --field-trial-handle=2024,i,18094511547946148414,9443556188605093753,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:1
                3⤵
                  PID:5264
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,5998701379154767377,11485692910881784992,2097152 --field-trial-handle=2024,i,18094511547946148414,9443556188605093753,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4352 /prefetch:2
                  3⤵
                    PID:5340
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,9909224601603258192,14650896236009925576,2097152 --field-trial-handle=2024,i,18094511547946148414,9443556188605093753,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4680 /prefetch:1
                    3⤵
                      PID:5508
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,12835781560071160334,12187330864868849008,524288 --field-trial-handle=2024,i,18094511547946148414,9443556188605093753,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5468 /prefetch:8
                      3⤵
                        PID:4512
                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2636
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c8,0x2a0,0x2cc,0x298,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
                          4⤵
                          • Executes dropped EXE
                          PID:3840
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
                          4⤵
                          • Executes dropped EXE
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:2840
                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c8,0x2c4,0x2cc,0x298,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
                            5⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            PID:1904
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,15972263378934557015,10870961177510272451,524288 --field-trial-handle=2024,i,18094511547946148414,9443556188605093753,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5688 /prefetch:8
                        3⤵
                          PID:5564
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,12972843652109962113,5313779549395451048,524288 --field-trial-handle=2024,i,18094511547946148414,9443556188605093753,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5828 /prefetch:8
                          3⤵
                            PID:5548
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,3102983225678921740,9599691863444743852,524288 --field-trial-handle=2024,i,18094511547946148414,9443556188605093753,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5856 /prefetch:8
                            3⤵
                              PID:5900
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5816,i,9576874106834494479,15625699924833022659,262144 --field-trial-handle=2024,i,18094511547946148414,9443556188605093753,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4344 /prefetch:8
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5104
                        • C:\Windows\System32\alg.exe
                          C:\Windows\System32\alg.exe
                          1⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Reads the TCP/IP host and domain name from the registry
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2400
                        • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                          C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                          1⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Suspicious behavior: EnumeratesProcesses
                          PID:464
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                          1⤵
                            PID:2320
                          • C:\Windows\system32\fxssvc.exe
                            C:\Windows\system32\fxssvc.exe
                            1⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3988
                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:3200
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:3568
                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                            1⤵
                            • Executes dropped EXE
                            PID:4928
                          • C:\Windows\System32\msdtc.exe
                            C:\Windows\System32\msdtc.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            PID:3432
                          • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                            "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                            1⤵
                            • Executes dropped EXE
                            PID:4704
                          • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                            C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                            1⤵
                            • Executes dropped EXE
                            PID:3504
                          • C:\Windows\SysWow64\perfhost.exe
                            C:\Windows\SysWow64\perfhost.exe
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3344
                          • C:\Windows\system32\locator.exe
                            C:\Windows\system32\locator.exe
                            1⤵
                            • Executes dropped EXE
                            PID:3388
                          • C:\Windows\System32\SensorDataService.exe
                            C:\Windows\System32\SensorDataService.exe
                            1⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            PID:2492
                          • C:\Windows\System32\snmptrap.exe
                            C:\Windows\System32\snmptrap.exe
                            1⤵
                            • Executes dropped EXE
                            • Reads the TCP/IP host and domain name from the registry
                            PID:2060
                          • C:\Windows\system32\spectrum.exe
                            C:\Windows\system32\spectrum.exe
                            1⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            PID:1936
                          • C:\Windows\System32\OpenSSH\ssh-agent.exe
                            C:\Windows\System32\OpenSSH\ssh-agent.exe
                            1⤵
                            • Executes dropped EXE
                            PID:2076
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                            1⤵
                              PID:5012
                            • C:\Windows\system32\TieringEngineService.exe
                              C:\Windows\system32\TieringEngineService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks processor information in registry
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3308
                            • C:\Windows\system32\AgentService.exe
                              C:\Windows\system32\AgentService.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:712
                            • C:\Windows\System32\vds.exe
                              C:\Windows\System32\vds.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1616
                            • C:\Windows\system32\vssvc.exe
                              C:\Windows\system32\vssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3820
                            • C:\Windows\system32\wbengine.exe
                              "C:\Windows\system32\wbengine.exe"
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1908
                            • C:\Windows\system32\wbem\WmiApSrv.exe
                              C:\Windows\system32\wbem\WmiApSrv.exe
                              1⤵
                              • Executes dropped EXE
                              • Reads the TCP/IP host and domain name from the registry
                              PID:5092
                            • C:\Windows\system32\SearchIndexer.exe
                              C:\Windows\system32\SearchIndexer.exe /Embedding
                              1⤵
                              • Executes dropped EXE
                              • Direct Volume Access: Opens a physical disk for reading
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:4376
                              • C:\Windows\system32\SearchProtocolHost.exe
                                "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:116
                              • C:\Windows\system32\SearchFilterHost.exe
                                "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:5588
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                              1⤵
                                PID:4476

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    elevation_service.exe
                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                    • Size 2.7MB
                                    • SHA256 db7df6b6e4d3cb69dfd68603980481aca4f47e98c2ec7ec1ea2747b7c76ba02e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Uninstall.exe
                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
                                    • Size 820KB
                                    • SHA256 1af523d8f1458607c60e0b8c491e3f7d2588697e55aa2aecebf786f554a09991
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    maintenanceservice.exe
                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                    • Size 2.1MB
                                    • SHA256 46b49bfbc08eee0693d97e48cf6fca1b665eb29f0ddf2b6dd70d809d05e857d2
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    maintenanceservice.exe
                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                    • Size 2.1MB
                                    • SHA256 30a85402578bd5d0d718ef4203328d0db6372e7bdc715b534bb8fb3ab4423a34
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    AppVShNotify.exe
                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                    • Size 840KB
                                    • SHA256 dadc59b282c62790658751d314883d4fe50f0be1d6c7ffbaf717f9c67a7d97b4
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    IntegratedOffice.exe
                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                    • Size 5.4MB
                                    • SHA256 f2c34d9c1ab9dc6bba5449de3d631c85c00ac4edb4e45af701f3b0bb7994412a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    MavInject32.exe
                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                    • Size 910KB
                                    • SHA256 9d32f463583443a477bfcc783026f635121839031b78be52603d744af532d0c0
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    OfficeC2RClient.exe
                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                    • Size 24.7MB
                                    • SHA256 d6c9200316cd9fb112ad5b197c1967381afb7abe44d2777179d60d45dde91273
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    LICLUA.EXE
                                    • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                    • Size 1.1MB
                                    • SHA256 50c51d997259465ac9e424a6a09c95a3292e902e54f9f06075d03cacc8e3b241
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    OSE.EXE
                                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                    • Size 805KB
                                    • SHA256 7c31f012ef6fb028012aa00433ece54647862b782da92e279101e08578b4d48b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    VSTOInstaller.exe
                                    • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                    • Size 656KB
                                    • SHA256 b6de9f2cf9d0e92d2e90eea1ca1591d8e8dd0c0a864f684dbf2ad1a5a03feae0
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    chrmstp.exe
                                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                                    • Size 6.6MB
                                    • SHA256 1e47d2c333f223fb21a183e09d4a3147c67b4c80dbf0ae9d51d960706b974568
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    setup.exe
                                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                                    • Size 6.6MB
                                    • SHA256 635478361b7ae3cdd1f3377f097325d3759756af7c0fbc6947ffa9b461cacae6
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    chrome_pwa_launcher.exe
                                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                                    • Size 2.3MB
                                    • SHA256 8ed013520ef2a633ddc8280db841dd8b1018f8be03fe041f9629db7ee9690e1b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    elevated_tracing_service.exe
                                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                                    • Size 4.0MB
                                    • SHA256 b68fdeea0aa082adf6bbec369fdcb20e60a75a47f95e8bed255ac1bae4620d41
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    elevation_service.exe
                                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                    • Size 3.5MB
                                    • SHA256 d4788fd613bfe3e344f00a6848b515f2c05a97a17fbaace716dbfd534c3740e7
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    notification_helper.exe
                                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                                    • Size 2.2MB
                                    • SHA256 32bb549ce0a5fd7946463d1571f5d9d7a986554ee24f48325ca04abda3a8f20e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    os_update_handler.exe
                                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                                    • Size 2.4MB
                                    • SHA256 88cd61708f80e6a58b8dc9d5c44a7d5f185c90732d80d8443b0a41e825f32912
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    chrome_proxy.exe
                                    • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                                    • Size 2.0MB
                                    • SHA256 fb04e0340433144df3b819079f74ada84efc94d5403ca7e822868754d5cbff70
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    appletviewer.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                                    • Size 581KB
                                    • SHA256 72e1dc94d09f8211f53a5a67b3b1c4072e2d746c531ccfbbecaf579b2013458c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    extcheck.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                                    • Size 581KB
                                    • SHA256 45fce5c2953a48e1e5470762f0919b6d71c4f6811d0f44936b5c50ab6f61bb67
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    idlj.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                                    • Size 581KB
                                    • SHA256 a44ab2f8f66e05eb286fe2afb553150f26f18539a0fc2d01d0a73a0d0c277e13
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    jabswitch.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                                    • Size 601KB
                                    • SHA256 0b47932f4bfc4aaa0673ca1b963215fbc9e26fd6fe4eaddea6c8c215b0fc6a19
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    jar.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                                    • Size 581KB
                                    • SHA256 bfcabddfa1cc5470a498987e3cf1c984d3e38c6b6946f7954dfedd4a26ded271
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    jarsigner.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                                    • Size 581KB
                                    • SHA256 d58ea93d68bc705217ead8f1e7830a3e3c3bfe3ddf34a2027149e4b98d3bf1a1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    java-rmi.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                                    • Size 581KB
                                    • SHA256 ad09db78ab32bec2137b0040e7e56cd1927699eb03e4fae96810716fe162d485
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    java.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                                    • Size 841KB
                                    • SHA256 e98d61671ce269a8aa50519132de64aeaf51463ce22e4a200f6a2fbb3ea37cc5
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    javac.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                                    • Size 581KB
                                    • SHA256 5082d9eec4cfb71e3cf2088fffa7775892f3943a8a6d4281c4b0591da53cc808
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    javadoc.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                                    • Size 581KB
                                    • SHA256 4a0c6a5668bcc1b4e4994c3915fcee15578e1c47a3b8ff41965a5612560d6f66
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    javafxpackager.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                                    • Size 717KB
                                    • SHA256 25aa0b50af3d67f805637ec86f8517a98f1147108a5259c348dd92abdd6f4b7b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    javah.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                                    • Size 581KB
                                    • SHA256 972c2d3ad1f765d65cd879cbadebb2d75115130ffd6f99fe1d430ea613e99d2a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    javap.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                                    • Size 581KB
                                    • SHA256 3f4464bb47b7e721e97cfd707d592a1417761dbbe3c99a8e5f480ae4347a8839
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    javapackager.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                                    • Size 717KB
                                    • SHA256 6817754ff4736b9e1756cea959fe7e00f91abaf94414f4ef825b5eacffaab2c7
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    javaw.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                                    • Size 841KB
                                    • SHA256 7c8da831e7fd431334781ff00bc61f9a1dfa5c74c1acbad9b7050bc371ea9050
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    javaws.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                                    • Size 1020KB
                                    • SHA256 6fd6258a530d55fd9a16116e97d6caa708af87183ffba59a154a1c3475f50e16
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    jcmd.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                                    • Size 581KB
                                    • SHA256 7dea43059b45c4189f56b0d301e19872033366fcb9e57e3a5b75b4a16996cfc6
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    jconsole.exe
                                    • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
                                    • Size 581KB
                                    • SHA256 44f6f25b7332a2693e7740be93d878c78052a0530f9a911d1219a8c9c9a20e11
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    wmpnetwk.exe
                                    • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                    • Size 2.2MB
                                    • SHA256 58196f41e86d9415cb7b43b961a6fb259ccf0a6a17c66297d3ff091ec7d91850
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    wmpnetwk.exe
                                    • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                    • Size 2.2MB
                                    • SHA256 4db1232c3e9687aa9657c940c0f11105d475bf1ca15095a2967441297969445e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    dotnet.exe
                                    • Path C:\Program Files\dotnet\dotnet.exe
                                    • Size 700KB
                                    • SHA256 5be23db52966bce3cbf422c955df48d81e8e7b69012171ff6402b633c696995b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    0b132e98-9664-4f86-8898-c59d3f63619f.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0b132e98-9664-4f86-8898-c59d3f63619f.tmp
                                    • Size 130KB
                                    • SHA256 436fab6697edd75587c8aaed38e46253cfa619213637f3182d65fbcb18da0c3b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    27474fbd-e282-4b49-85b7-53545c588a69.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\27474fbd-e282-4b49-85b7-53545c588a69.tmp
                                    • Size 277KB
                                    • SHA256 28332c136510cde5ca53a68fbb97a413ff3171854b05e4f67d319c2143fea7fd
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    settings.dat
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 84e6fd027ea8e630687c4c70bb82f9993501345987298d008342ed16c054e189
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    0d83fcc0-f856-4d60-b7f8-cc662111d3dd.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0d83fcc0-f856-4d60-b7f8-cc662111d3dd.tmp
                                    • Size 6B
                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    3fe09f26-b28d-4d8f-8914-bf965b5a62b4.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3fe09f26-b28d-4d8f-8914-bf965b5a62b4.tmp
                                    • Size 11KB
                                    • SHA256 61b66887c62f2b4369f6d8b91b7a980200f195342dbfadbfd15087a74b86b10f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    5fc1cf4f-c699-46b6-958e-e09687a4b312.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5fc1cf4f-c699-46b6-958e-e09687a4b312.tmp
                                    • Size 414B
                                    • SHA256 80157c59eebc7b84caf7d56ac9c5e20b730be619f997d1638316f3035f8e07a7
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    617886c5-6cee-4f24-8e70-380396bff8f4.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\617886c5-6cee-4f24-8e70-380396bff8f4.tmp
                                    • Size 192KB
                                    • SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    68c54501-2127-4f76-94c0-a453283b0884.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\68c54501-2127-4f76-94c0-a453283b0884.tmp
                                    • Size 2B
                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    9b5715d9-9eba-42d9-aa41-3ef5a1718fb2.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9b5715d9-9eba-42d9-aa41-3ef5a1718fb2.tmp
                                    • Size 2KB
                                    • SHA256 be81802e14073d87c5e3ae3735f787858d2c44489b955053a2add05039a6c271
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 3KB
                                    • SHA256 795612af0f0cbe41cc8a3ae796fd330a8220bf76a0d84fdf6f83e129b89286ae
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    temp-index
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
                                    • Size 120B
                                    • SHA256 feefc1555fdf00202435884d86a9f6153852964c453439eda5852cea04d65217
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    the-real-index
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                    • Size 96B
                                    • SHA256 0d218c1487cdf1d3da784449311985999167545611669ced292e0b0798c41b8c
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    b6046792-1554-421b-bbfa-ce3f4583dd13.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b6046792-1554-421b-bbfa-ce3f4583dd13.tmp
                                    • Size 17KB
                                    • SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    dfc30675-16e5-43b1-9da4-e98c47db489a.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dfc30675-16e5-43b1-9da4-e98c47db489a.tmp
                                    • Size 12KB
                                    • SHA256 4e5d4214c29d8d79977e3483ab891a4dfc218b4ce8be1087fb90c393f6c7488e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    fcb85c79-3feb-44f7-a5e6-7850b1a0fb98.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fcb85c79-3feb-44f7-a5e6-7850b1a0fb98.tmp
                                    • Size 12KB
                                    • SHA256 f1f80b451cff150752981a029f04ffa08fecdaee88163aa8e8a657a97005386c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    b14dcf8c-b55e-4e98-8db1-68992e139b7f.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b14dcf8c-b55e-4e98-8db1-68992e139b7f.tmp
                                    • Size 276KB
                                    • SHA256 3bd6248c54afcc6279b42e471e886be8edc887cf2b7dbb87c1c87f4dcd2ff050
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    eda09e6a-d405-4132-910a-1deda1758c30.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eda09e6a-d405-4132-910a-1deda1758c30.tmp
                                    • Size 276KB
                                    • SHA256 0a331fd6d22b0e0cf6d9985aa6b73aaf82ae7daabfbe7175cadf940e107660f6
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    3bffad715ef7726b.bin
                                    • Path C:\Users\Admin\AppData\Roaming\3bffad715ef7726b.bin
                                    • Size 12KB
                                    • SHA256 3b2a9ff19ea9be452166d97bdaf68b4c9e953737c9a0636b94fe52d96c7767ec
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Google Chrome (2).lnk
                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
                                    • Size 2KB
                                    • SHA256 6c0dbddd80c8eab6a3f480fc7c5953ac77f2a45b84267452da22ebdae6468643
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    perfhost.exe
                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                    • Size 588KB
                                    • SHA256 7baef0af57d7f23a6b5f7d1e212d72b6f742e23a000d453a0bcd6aea1c7f9eb0
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    AgentService.exe
                                    • Path C:\Windows\System32\AgentService.exe
                                    • Size 2.5MB
                                    • SHA256 3e11765c91081f1de531b5cb3a09db465f97c288f0dec51a1f1f80d7ce842634
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    AppVClient.exe
                                    • Path C:\Windows\System32\AppVClient.exe
                                    • Size 2.0MB
                                    • SHA256 9c7c127367e47587dd2241dc4c71ae8311d370bf3e8addf05861717bb7ca5530
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    DiagnosticsHub.StandardCollector.Service.exe
                                    • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                    • Size 659KB
                                    • SHA256 2f28de417a5c969f048cd11363fced433557a3cd336730128eee20e4b3ad3708
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    FXSSVC.exe
                                    • Path C:\Windows\System32\FXSSVC.exe
                                    • Size 1.9MB
                                    • SHA256 8767e7b914b0228cc39aaf8849dadf6cee112080bf3846e6d3ae40a14e9fa1eb
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Locator.exe
                                    • Path C:\Windows\System32\Locator.exe
                                    • Size 578KB
                                    • SHA256 ae70c94fcf65f1c58d77a537dc4fc363f8c16f48f6310c8b4ad7e8b1b25fb824
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ssh-agent.exe
                                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                    • Size 940KB
                                    • SHA256 91f45232af29daa0be8c7b21aeb006fe215e62895d751caf528d38d67a061f93
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    PerceptionSimulationService.exe
                                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                    • Size 671KB
                                    • SHA256 a4550927ef27d38b9a0ac036eeef90026f79113d2403b7d6a23d39c83a60b520
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    SearchIndexer.exe
                                    • Path C:\Windows\System32\SearchIndexer.exe
                                    • Size 1.4MB
                                    • SHA256 416e2f3c701a905e6783177ffebd1cf01e72629cf325b19e55be7e2f2917fc86
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    SensorDataService.exe
                                    • Path C:\Windows\System32\SensorDataService.exe
                                    • Size 1.8MB
                                    • SHA256 7e7a6334049650ba39a318f9b04907dbe6819931bed6242e5a80c3ba5fbd142b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    SgrmBroker.exe
                                    • Path C:\Windows\System32\SgrmBroker.exe
                                    • Size 1.6MB
                                    • SHA256 54b8b6a1359fe9b851056406eeadcf0ec947cf2843552086b1758eb6ad2f086f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Spectrum.exe
                                    • Path C:\Windows\System32\Spectrum.exe
                                    • Size 1.4MB
                                    • SHA256 5daebe02112d9059b94ee2d251b546df4bbf22776beee6278c8f6a90adc8eb9a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    TieringEngineService.exe
                                    • Path C:\Windows\System32\TieringEngineService.exe
                                    • Size 885KB
                                    • SHA256 bd4fb435845ab5a1900f91f0ea43a3678a153bf19b0e9acd80606224fb5e9a69
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    VSSVC.exe
                                    • Path C:\Windows\System32\VSSVC.exe
                                    • Size 2.0MB
                                    • SHA256 77cf641f9fd401e6c2d3962aff475a582911909753b17c4edd15c6a203fcb195
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    alg.exe
                                    • Path C:\Windows\System32\alg.exe
                                    • Size 661KB
                                    • SHA256 76ca02a5a497af17b7ed54d31b9d5e8f70ea99b564d10c409c92c76a4f88b04b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    msdtc.exe
                                    • Path C:\Windows\System32\msdtc.exe
                                    • Size 712KB
                                    • SHA256 23d56edc51ad76570def8a73d8414f4d449bcc266272e1ca6a68d8ef71cf6ea1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    msiexec.exe
                                    • Path C:\Windows\System32\msiexec.exe
                                    • Size 1.4MB
                                    • SHA256 3b91807977d7ee21c2929d43ef6fd46a41f94efd2c1b4372d9b2e624a1eb7c2d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    snmptrap.exe
                                    • Path C:\Windows\System32\snmptrap.exe
                                    • Size 584KB
                                    • SHA256 5ca5509f295998425e9d3858e52e34e6da62cb9818d6ae1dbde62130f399b6fc
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    vds.exe
                                    • Path C:\Windows\System32\vds.exe
                                    • Size 1.3MB
                                    • SHA256 9d8d3504a59bee73f4529ab62bd92a46944c6357b15e4ea1fd8e28460009778d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WmiApSrv.exe
                                    • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                    • Size 772KB
                                    • SHA256 27b787646cb28fadefaee91993046fbbfd2d8f172f3100496b13a12fa4f57b1c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    wbengine.exe
                                    • Path C:\Windows\System32\wbengine.exe
                                    • Size 2.1MB
                                    • SHA256 b99584b3c3083b57443edf01f4fec239e7cefd7affd861d1a4fd1cd9e009f059
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    AgentService.exe
                                    • Path C:\Windows\system32\AgentService.exe
                                    • Size 2.5MB
                                    • SHA256 e31fad2db030b81e2dadb902adaeb3bbe57cde9db56af7f4d77bc76d70073674
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    AppVClient.exe
                                    • Path C:\Windows\system32\AppVClient.exe
                                    • Size 2.0MB
                                    • SHA256 6d90133de1d23e1c3fbdc7f0ed23de5767798ecf26b9d91703e9e5e5870ba341
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    SgrmBroker.exe
                                    • Path C:\Windows\system32\SgrmBroker.exe
                                    • Size 1.6MB
                                    • SHA256 d4874f1bba58475badc32e6da225d6885e956137795012834bbe5441761462f0
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    fxssvc.exe
                                    • Path C:\Windows\system32\fxssvc.exe
                                    • Size 1.9MB
                                    • SHA256 8d9e5caabb02df54f006bd7665985aacade66313eb1aa1c8e9b7cdb9f57c91e6
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    msiexec.exe
                                    • Path C:\Windows\system32\msiexec.exe
                                    • Size 1.4MB
                                    • SHA256 954454dc0f7627a2a28cc0636ddabfea0eb55af06b58e1f1ac8f7aca985ee92d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    memory/464-44-0x0000000140000000-0x00000001400A9000-memory.dmp
                                    Download

                                    memory/464-36-0x0000000000690000-0x00000000006F0000-memory.dmp
                                    Download

                                    memory/464-45-0x0000000000690000-0x00000000006F0000-memory.dmp
                                    Download

                                    memory/712-231-0x0000000000BB0000-0x0000000000C10000-memory.dmp
                                    Download

                                    memory/712-228-0x0000000000BB0000-0x0000000000C10000-memory.dmp
                                    Download

                                    memory/712-222-0x0000000000BB0000-0x0000000000C10000-memory.dmp
                                    Download

                                    memory/712-233-0x0000000140000000-0x00000001401C0000-memory.dmp
                                    Download

                                    memory/712-221-0x0000000140000000-0x00000001401C0000-memory.dmp
                                    Download

                                    memory/876-691-0x0000000140000000-0x0000000140953000-memory.dmp
                                    Download

                                    memory/876-350-0x0000000001FD0000-0x0000000002030000-memory.dmp
                                    Download

                                    memory/876-367-0x0000000140000000-0x0000000140953000-memory.dmp
                                    Download

                                    memory/876-358-0x0000000002930000-0x00000000029B3000-memory.dmp
                                    Download

                                    memory/876-355-0x0000000001FD0000-0x0000000002030000-memory.dmp
                                    Download

                                    memory/876-364-0x0000000002930000-0x00000000029B3000-memory.dmp
                                    Download

                                    memory/1616-613-0x0000000140000000-0x0000000140147000-memory.dmp
                                    Download

                                    memory/1616-237-0x0000000000BE0000-0x0000000000C40000-memory.dmp
                                    Download

                                    memory/1616-236-0x0000000140000000-0x0000000140147000-memory.dmp
                                    Download

                                    memory/1616-243-0x0000000000BE0000-0x0000000000C40000-memory.dmp
                                    Download

                                    memory/1904-684-0x0000000000440000-0x00000000004A0000-memory.dmp
                                    Download

                                    memory/1904-872-0x0000000140000000-0x00000001406BA000-memory.dmp
                                    Download

                                    memory/1904-697-0x0000000140000000-0x00000001406BA000-memory.dmp
                                    Download

                                    memory/1908-275-0x0000000140000000-0x0000000140216000-memory.dmp
                                    Download

                                    memory/1908-272-0x0000000000BE0000-0x0000000000C40000-memory.dmp
                                    Download

                                    memory/1908-642-0x0000000140000000-0x0000000140216000-memory.dmp
                                    Download

                                    memory/1936-191-0x00000000004D0000-0x0000000000530000-memory.dmp
                                    Download

                                    memory/1936-417-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/1936-184-0x00000000004D0000-0x0000000000530000-memory.dmp
                                    Download

                                    memory/1936-193-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/2060-181-0x0000000140000000-0x0000000140096000-memory.dmp
                                    Download

                                    memory/2060-179-0x00000000006D0000-0x0000000000730000-memory.dmp
                                    Download

                                    memory/2060-173-0x00000000006D0000-0x0000000000730000-memory.dmp
                                    Download

                                    memory/2060-365-0x0000000140000000-0x0000000140096000-memory.dmp
                                    Download

                                    memory/2076-503-0x0000000140000000-0x0000000140102000-memory.dmp
                                    Download

                                    memory/2076-199-0x0000000000DC0000-0x0000000000E20000-memory.dmp
                                    Download

                                    memory/2076-198-0x0000000140000000-0x0000000140102000-memory.dmp
                                    Download

                                    memory/2076-205-0x0000000000DC0000-0x0000000000E20000-memory.dmp
                                    Download

                                    memory/2344-6-0x0000000001FE0000-0x0000000002040000-memory.dmp
                                    Download

                                    memory/2344-8-0x0000000002710000-0x00000000028CA000-memory.dmp
                                    Download

                                    memory/2344-18-0x0000000140000000-0x0000000140953000-memory.dmp
                                    Download

                                    memory/2344-9-0x0000000002A40000-0x0000000002AC3000-memory.dmp
                                    Download

                                    memory/2344-19-0x0000000002A40000-0x0000000002AC3000-memory.dmp
                                    Download

                                    memory/2344-87-0x0000000140000000-0x0000000140953000-memory.dmp
                                    Download

                                    memory/2344-0-0x0000000001FE0000-0x0000000002040000-memory.dmp
                                    Download

                                    memory/2344-542-0x0000000140000000-0x0000000140953000-memory.dmp
                                    Download

                                    memory/2400-114-0x0000000140000000-0x00000001400AA000-memory.dmp
                                    Download

                                    memory/2400-28-0x0000000140000000-0x00000001400AA000-memory.dmp
                                    Download

                                    memory/2400-30-0x0000000000710000-0x0000000000770000-memory.dmp
                                    Download

                                    memory/2400-22-0x0000000000710000-0x0000000000770000-memory.dmp
                                    Download

                                    memory/2400-29-0x0000000000710000-0x0000000000770000-memory.dmp
                                    Download

                                    memory/2492-690-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/2492-162-0x00000000006B0000-0x0000000000710000-memory.dmp
                                    Download

                                    memory/2492-299-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/2492-161-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/2492-688-0x00000000006B0000-0x0000000000710000-memory.dmp
                                    Download

                                    memory/2492-168-0x00000000006B0000-0x0000000000710000-memory.dmp
                                    Download

                                    memory/2636-658-0x0000000140000000-0x00000001406BA000-memory.dmp
                                    Download

                                    memory/2636-656-0x0000000000440000-0x00000000004A0000-memory.dmp
                                    Download

                                    memory/2636-710-0x0000000140000000-0x00000001406BA000-memory.dmp
                                    Download

                                    memory/2636-650-0x0000000000440000-0x00000000004A0000-memory.dmp
                                    Download

                                    memory/2840-676-0x0000000001FB0000-0x0000000002010000-memory.dmp
                                    Download

                                    memory/2840-703-0x0000000140000000-0x00000001406BA000-memory.dmp
                                    Download

                                    memory/2840-692-0x0000000140000000-0x00000001406BA000-memory.dmp
                                    Download

                                    memory/2840-670-0x0000000001FB0000-0x0000000002010000-memory.dmp
                                    Download

                                    memory/3200-68-0x0000000140000000-0x00000001402E9000-memory.dmp
                                    Download

                                    memory/3200-609-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                                    Download

                                    memory/3200-611-0x0000000140000000-0x00000001402E9000-memory.dmp
                                    Download

                                    memory/3200-60-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                                    Download

                                    memory/3200-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                                    Download

                                    memory/3200-190-0x0000000140000000-0x00000001402E9000-memory.dmp
                                    Download

                                    memory/3308-216-0x0000000000600000-0x0000000000660000-memory.dmp
                                    Download

                                    memory/3308-215-0x0000000140000000-0x00000001400E2000-memory.dmp
                                    Download

                                    memory/3308-209-0x0000000000600000-0x0000000000660000-memory.dmp
                                    Download

                                    memory/3308-546-0x0000000140000000-0x00000001400E2000-memory.dmp
                                    Download

                                    memory/3344-146-0x0000000000600000-0x0000000000667000-memory.dmp
                                    Download

                                    memory/3344-141-0x0000000000600000-0x0000000000667000-memory.dmp
                                    Download

                                    memory/3344-274-0x0000000000400000-0x0000000000497000-memory.dmp
                                    Download

                                    memory/3344-140-0x0000000000400000-0x0000000000497000-memory.dmp
                                    Download

                                    memory/3388-156-0x00000000006E0000-0x0000000000740000-memory.dmp
                                    Download

                                    memory/3388-286-0x0000000140000000-0x0000000140095000-memory.dmp
                                    Download

                                    memory/3388-150-0x00000000006E0000-0x0000000000740000-memory.dmp
                                    Download

                                    memory/3388-158-0x0000000140000000-0x0000000140095000-memory.dmp
                                    Download

                                    memory/3432-109-0x0000000000810000-0x0000000000870000-memory.dmp
                                    Download

                                    memory/3432-102-0x0000000140000000-0x00000001400B9000-memory.dmp
                                    Download

                                    memory/3432-104-0x0000000000810000-0x0000000000870000-memory.dmp
                                    Download

                                    memory/3432-220-0x0000000140000000-0x00000001400B9000-memory.dmp
                                    Download

                                    memory/3504-129-0x0000000140000000-0x00000001400AB000-memory.dmp
                                    Download

                                    memory/3504-136-0x0000000000570000-0x00000000005D0000-memory.dmp
                                    Download

                                    memory/3504-247-0x0000000140000000-0x00000001400AB000-memory.dmp
                                    Download

                                    memory/3504-130-0x0000000000570000-0x00000000005D0000-memory.dmp
                                    Download

                                    memory/3568-71-0x0000000000890000-0x00000000008F0000-memory.dmp
                                    Download

                                    memory/3568-77-0x0000000000890000-0x00000000008F0000-memory.dmp
                                    Download

                                    memory/3568-197-0x0000000140000000-0x00000001402D4000-memory.dmp
                                    Download

                                    memory/3568-88-0x0000000140000000-0x00000001402D4000-memory.dmp
                                    Download

                                    memory/3820-253-0x00000000006C0000-0x0000000000720000-memory.dmp
                                    Download

                                    memory/3820-248-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/3820-258-0x00000000006C0000-0x0000000000720000-memory.dmp
                                    Download

                                    memory/3820-620-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/3840-666-0x0000000001F90000-0x0000000001FF0000-memory.dmp
                                    Download

                                    memory/3840-660-0x0000000001F90000-0x0000000001FF0000-memory.dmp
                                    Download

                                    memory/3840-669-0x0000000140000000-0x00000001406BA000-memory.dmp
                                    Download

                                    memory/3840-869-0x0000000140000000-0x00000001406BA000-memory.dmp
                                    Download

                                    memory/3988-49-0x0000000000520000-0x0000000000580000-memory.dmp
                                    Download

                                    memory/3988-99-0x0000000000520000-0x0000000000580000-memory.dmp
                                    Download

                                    memory/3988-98-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/3988-57-0x0000000000520000-0x0000000000580000-memory.dmp
                                    Download

                                    memory/3988-48-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/4376-297-0x0000000000830000-0x0000000000890000-memory.dmp
                                    Download

                                    memory/4376-640-0x000000000D230000-0x000000000D238000-memory.dmp
                                    Download

                                    memory/4376-300-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/4376-347-0x000000000A1F0000-0x000000000A1F8000-memory.dmp
                                    Download

                                    memory/4376-659-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/4376-291-0x0000000000830000-0x0000000000890000-memory.dmp
                                    Download

                                    memory/4376-312-0x0000000001B00000-0x0000000001B10000-memory.dmp
                                    Download

                                    memory/4376-328-0x0000000001C80000-0x0000000001C90000-memory.dmp
                                    Download

                                    memory/4704-115-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download

                                    memory/4704-235-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download

                                    memory/4704-122-0x0000000000820000-0x0000000000880000-memory.dmp
                                    Download

                                    memory/4704-116-0x0000000000820000-0x0000000000880000-memory.dmp
                                    Download

                                    memory/4928-93-0x00000000015E0000-0x0000000001640000-memory.dmp
                                    Download

                                    memory/4928-91-0x0000000140000000-0x00000001400D5000-memory.dmp
                                    Download

                                    memory/4928-95-0x0000000140000000-0x00000001400D5000-memory.dmp
                                    Download

                                    memory/4928-81-0x00000000015E0000-0x0000000001640000-memory.dmp
                                    Download

                                    memory/4928-89-0x00000000015E0000-0x0000000001640000-memory.dmp
                                    Download

                                    memory/5092-287-0x0000000140000000-0x00000001400C6000-memory.dmp
                                    Download

                                    memory/5092-284-0x00000000005C0000-0x0000000000620000-memory.dmp
                                    Download

                                    memory/5092-278-0x00000000005C0000-0x0000000000620000-memory.dmp
                                    Download

                                    memory/5092-649-0x0000000140000000-0x00000001400C6000-memory.dmp
                                    Download