Overview

overview

7

Static

static

3

2026-11-13...om.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/11/2026, 19:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-13_f3d40dc51a136c86e645fc1bbde13fad_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  • Size 10.0MB
  • Sample261113-ykawkae15l
  • SHA256 e9a70e798af4f807cd1bbd80cccbe07c67f4daf3efd7eb224deab1392a714a7c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-13_f3d40dc51a136c86e645fc1bbde13fad_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-13_f3d40dc51a136c86e645fc1bbde13fad_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Users\Admin\AppData\Local\Temp\2026-11-13_f3d40dc51a136c86e645fc1bbde13fad_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-11-13_f3d40dc51a136c86e645fc1bbde13fad_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --crash-handler --database=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\157.0.8089.0\Crashpad --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=157.0.8089.0 --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0x140802d18,0x140802d28,0x140802d38
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4972
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of AdjustPrivilegeToken
    PID:5056
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:1780
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1680
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1788
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2376
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1108
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:5000
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4404
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1476
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3784
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4712
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:3912
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1452
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:1164
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3556
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:1072
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:5072
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4480
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4012
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1012
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1900
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2032
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:4884
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Direct Volume Access: Opens a physical disk for reading
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:768
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:4488

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 dce854487254a056534bb8e4aa48c6b1969102c47793eb1f2051758efe173b1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.8MB
            • SHA256 8b0d66c7254c940fc142458e8a05ee5b8151110db7ffd9514ab16b9d821e1f57
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 2.0MB
            • SHA256 aa42ab53eb6a26d0870da564466d20edab2b361b41cac079b52fe773deb53bbd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 56522a32b441bbd8bf7f96a6aabdbfd8660eee0c1aa153347a670ffc259d3e78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 72171875e8de7f39e1581407346d974085fe93a826d6647cb8f918f5edafefa2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.5MB
            • SHA256 8b2ad32d94c3884560e70af8054b4db18e2379014cf206d50ebf3448a8f67663
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.8MB
            • SHA256 869518bdf4d8a144e4176fb1d7fb6261a4c7b117243be7f6873cd1c2a6fae27f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 cb8208cca722144176259aeb43681e385fd97128e274a0af2583ea467d9b5f81
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.8MB
            • SHA256 ea8a0d8b9914ca9c2822e1810f0ec64745d3f82511d2777d8ccad7d1bc255cff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 61f2e148d52c168ecab8eaf8aa0b1582703a62de517590ffe86023da0c2c50ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 98374a70a66582f74062dde5938b5add57779f520c5710c91f2a1ae9048c50b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 d5ff1c336804a4442d5d463fe3ecc71e142803de135ac893414fead8245ba42c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.7MB
            • SHA256 d1e39e346081a843186f21c448da0ac606fc3e568af3ae537dbebef0fcbc84d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.6MB
            • SHA256 a0f8e9b2e2095260076d37acbed04d6e976344b859b8e4057e9fac814803a5de
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
            • Size 6.6MB
            • SHA256 f2f300fd7cbe6a40f0c05aa8f987220f55259b0417605d9b90136882f415b6a9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
            • Size 6.6MB
            • SHA256 5dc5fe6706b2702647ba880d0c77f937fcc87126ea5165af1c450a6572b6e56a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 c9c4b637ab945673a1c95201c6368615335a6f86d0fb33e080b50c825651b7c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
            • Size 4.0MB
            • SHA256 a2ce6e0ac34b8cc70766e7b1ea85a2d678351f46bdaa416a59d2822240c2f21c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 6d41913d53b2c8789772ae8991ed0311b216e8cce96524ded610febd9418e512
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
            • Size 2.2MB
            • SHA256 c00c08f4b4dcb9c8b5093edb6f7fd357cb03f6e5100c4c82f8d6f7eaa7336ed8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            os_update_handler.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
            • Size 2.4MB
            • SHA256 65b48482cb5e060fd12b44402e886e1c1f1a9f7a444b34e071aee06549632429
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 2.0MB
            • SHA256 dbf6eea2b1b81627c89b8c59573f7090fb5969c404bfb5f68156bb857657cdd9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.5MB
            • SHA256 62c67870dd2441f5db56bcfbe87a9aa046c05e648aad72f82675b28729562496
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.5MB
            • SHA256 bd9fe4dd5fe5e4ae46bbac205971a34016b9267721fcb2898c472226cce53443
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.5MB
            • SHA256 5a0d76eadbd28b144938c68230b6ce54e4eaf93781af0da5a6ceee00f14ad9c0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.5MB
            • SHA256 8f2d352d0edab4455fcafff89b4193f50c5eee71d1259acac46cf5121eaa7619
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.5MB
            • SHA256 d266fadba0a4dd229bd008868d47477f0e69195459115be39570b015dc44c9fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.5MB
            • SHA256 6aeffa2233e379d68463bc370bd594c56fa3019d7fa47c46b476fc15990c7f3c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.5MB
            • SHA256 e66902ac50d651a67c17ec6bcb78449e875444d79609ee83d61df40da44e8fff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.8MB
            • SHA256 4d64a89bd96661831ca89c2d7deb62ceb10b8ff86a550fce8bfa9e85a17b2657
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.5MB
            • SHA256 64cc0701ed51c8743481410857dbcadcf0f74806e06afa5569903689b2fdc774
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.5MB
            • SHA256 94210a8e9ae3764620d1ce85bcacc46d366c0f69409d99200aceb31af2826fa7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.6MB
            • SHA256 b0b4989f812d7a73c4b5fdd884e9ffd95c14627d5d6d19da4b1ba0348abe9e1b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 be8c3e1a47b946a44acea2d0024a482cff8b4a7a2f987bd4399f782690ab8222
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.6MB
            • SHA256 f84ec9bce22bd582943c11d6795eeb326418da210e98cfc1122f593a41ea95d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log
            • Size 3KB
            • SHA256 934bac733ac530ef51a5a52f9dcf30db2b94672f0aafb7543c7be0efc5861375
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl
            • Size 1KB
            • SHA256 4fd0c11b50e9a1497832ad0352e744f4d027391daec184d23d3a4938142248d0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            6434564a250d612b.bin
            • Path C:\Users\Admin\AppData\Roaming\6434564a250d612b.bin
            • Size 12KB
            • SHA256 ad967b2cd0088d2ab5bb203ca4f98ccd760a2c55659dedab4d465a0800d6638a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.5MB
            • SHA256 ce605e123fc4cd779e440d74037d0bdcbd3e12c30e787e72744bdb2c7d261a0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 005a8252389df835d3f43e6085f3637ff523677cc4690471a0df19f8aea13ef9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.6MB
            • SHA256 f18edf84c6df8a95f909ac6fc3bcb56615514bc64b76fc3b60e538473c3d76b5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 746ec9fa1ce38c1b78072c6475c6d922b0a48abedbf8cd0103b63870bd3120ba
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.5MB
            • SHA256 289b8420f62e890d5b4b0bd7c4525847ec9a81682366b924f610e6544a1a73fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.9MB
            • SHA256 b9b7aac9ff947220fde3be07046a39566eadacdea65d688d796dd360e9d9aa6f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.6MB
            • SHA256 aedf843aa86cb030ba8dc9672e500f1b3463269ff1fa259702e2967c6b8c5b9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 4368c7b07a9a8266c63a6d6220b44a94692565c38975d1e486b37f00876427d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 784b9d8c3ab4e45c14e409b2447e080af9177841f1fef1cd4ca9babca5913a9c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 92748405f151384330d9e917b53c2e21570521fd0c163b3e65384fe8dd1e290a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.8MB
            • SHA256 fabbb12d475617521f5569287a9a37c581a194dd5deacaf2e1aadaee576ffd8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 1fb6757764d7baa32b1a54ab9c17f7ec11af7178c5432c3dca2aa195f8d77594
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.6MB
            • SHA256 47e12c0f764c43752d4c4816bff64a133709b99cd0068d9623b7dd2a262260c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.6MB
            • SHA256 8fccdb396104bd7c24cc1fc91e7c3044ccbf87d17e0fbf81169ae02686f4fd8d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.5MB
            • SHA256 4cbf59ee7818f6c2531d7af0a9057ea5962197ab92e81027cf574adb76fdddd8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 b36cb9982bbcd1031ca2ce9f8882c27deacf3b1f36582f359827862b80844387
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.7MB
            • SHA256 dbc4e50b3483d230d3792f0870fa0f1dae7a82529c83b06f688b72d43c31b652
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 bd4169031f8a54f2224616148114f722d4228a7de393da8ee01b1c06de8dae91
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 c7ec7532bbe1e32f1099222d7aa55f58288f2e68fe2ed1f0dc72b4e4a8e9c294
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.8MB
            • SHA256 f2b1431b631806d69c99c51a010817f938e40e8b1ce7e46c6a6885310a6683bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.6MB
            • SHA256 d863adea987a9dbe43377e88809f7bbefcc308c29e1700e8ce77b9eab4a9ec78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1012-216-0x0000000000C70000-0x0000000000CD0000-memory.dmp
            Download

            memory/1012-421-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/1072-177-0x0000000000D70000-0x0000000000DD0000-memory.dmp
            Download

            memory/1072-183-0x0000000000D70000-0x0000000000DD0000-memory.dmp
            Download

            memory/1072-410-0x0000000140000000-0x00000001401F5000-memory.dmp
            Download

            memory/1108-78-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/1108-72-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/1108-402-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/1164-408-0x0000000140000000-0x0000000140188000-memory.dmp
            Download

            memory/1164-162-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/1452-145-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/1452-464-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1452-407-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1452-151-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/1452-462-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/1476-460-0x0000000140000000-0x00000001401C2000-memory.dmp
            Download

            memory/1476-110-0x0000000000800000-0x0000000000860000-memory.dmp
            Download

            memory/1476-116-0x0000000000800000-0x0000000000860000-memory.dmp
            Download

            memory/1780-400-0x0000000140000000-0x000000014019B000-memory.dmp
            Download

            memory/1780-42-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/1780-48-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/1788-52-0x0000000000E70000-0x0000000000ED0000-memory.dmp
            Download

            memory/1788-106-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/1788-58-0x0000000000E70000-0x0000000000ED0000-memory.dmp
            Download

            memory/1788-95-0x0000000000E70000-0x0000000000ED0000-memory.dmp
            Download

            memory/1900-226-0x0000000000600000-0x0000000000660000-memory.dmp
            Download

            memory/1900-425-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/1900-220-0x0000000000600000-0x0000000000660000-memory.dmp
            Download

            memory/2032-230-0x0000000000BD0000-0x0000000000C30000-memory.dmp
            Download

            memory/2032-427-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/2032-236-0x0000000000BD0000-0x0000000000C30000-memory.dmp
            Download

            memory/2124-281-0x0000000001DB0000-0x0000000001DC0000-memory.dmp
            Download

            memory/2124-299-0x000000000A1F0000-0x000000000A1F8000-memory.dmp
            Download

            memory/2124-467-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2124-265-0x0000000001B00000-0x0000000001B10000-memory.dmp
            Download

            memory/2124-251-0x00000000007F0000-0x0000000000850000-memory.dmp
            Download

            memory/2124-257-0x00000000007F0000-0x0000000000850000-memory.dmp
            Download

            memory/2124-459-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2376-62-0x0000000000C70000-0x0000000000CD0000-memory.dmp
            Download

            memory/2376-401-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/2376-68-0x0000000000C70000-0x0000000000CD0000-memory.dmp
            Download

            memory/3264-0-0x0000000000770000-0x00000000007D0000-memory.dmp
            Download

            memory/3264-37-0x0000000140000000-0x0000000140A52000-memory.dmp
            Download

            memory/3264-6-0x0000000000770000-0x00000000007D0000-memory.dmp
            Download

            memory/3264-9-0x0000000140000000-0x0000000140A52000-memory.dmp
            Download

            memory/3556-172-0x0000000000650000-0x00000000006B0000-memory.dmp
            Download

            memory/3556-166-0x0000000000650000-0x00000000006B0000-memory.dmp
            Download

            memory/3556-409-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3784-404-0x0000000140000000-0x000000014019D000-memory.dmp
            Download

            memory/3784-128-0x0000000000B50000-0x0000000000BB0000-memory.dmp
            Download

            memory/3784-120-0x0000000000B50000-0x0000000000BB0000-memory.dmp
            Download

            memory/3912-406-0x0000000140000000-0x0000000140187000-memory.dmp
            Download

            memory/3912-141-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/3912-135-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/4012-205-0x00000000005F0000-0x0000000000650000-memory.dmp
            Download

            memory/4012-203-0x00000000005F0000-0x0000000000650000-memory.dmp
            Download

            memory/4012-208-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4012-197-0x00000000005F0000-0x0000000000650000-memory.dmp
            Download

            memory/4404-104-0x0000000000C90000-0x0000000000CF0000-memory.dmp
            Download

            memory/4404-98-0x0000000000C90000-0x0000000000CF0000-memory.dmp
            Download

            memory/4404-403-0x0000000140000000-0x00000001401AB000-memory.dmp
            Download

            memory/4480-420-0x0000000140000000-0x00000001401D4000-memory.dmp
            Download

            memory/4480-193-0x0000000000530000-0x0000000000590000-memory.dmp
            Download

            memory/4480-187-0x0000000000530000-0x0000000000590000-memory.dmp
            Download

            memory/4488-482-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-474-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-472-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-470-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-471-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-476-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-479-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-478-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-483-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-473-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-477-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-481-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-475-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4488-480-0x00000231ADCC0000-0x00000231ADCD0000-memory.dmp
            Download

            memory/4712-405-0x0000000000400000-0x0000000000589000-memory.dmp
            Download

            memory/4884-428-0x0000000140000000-0x00000001401B8000-memory.dmp
            Download

            memory/4884-240-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/4884-246-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/4972-17-0x0000000000810000-0x0000000000870000-memory.dmp
            Download

            memory/4972-11-0x0000000000810000-0x0000000000870000-memory.dmp
            Download

            memory/4972-465-0x0000000140000000-0x0000000140A52000-memory.dmp
            Download

            memory/4972-33-0x0000000140000000-0x0000000140A52000-memory.dmp
            Download

            memory/5000-94-0x0000000140000000-0x00000001401C8000-memory.dmp
            Download

            memory/5000-92-0x0000000001A70000-0x0000000001AD0000-memory.dmp
            Download

            memory/5000-82-0x0000000001A70000-0x0000000001AD0000-memory.dmp
            Download

            memory/5000-88-0x0000000001A70000-0x0000000001AD0000-memory.dmp
            Download

            memory/5056-34-0x0000000140000000-0x000000014019C000-memory.dmp
            Download

            memory/5056-24-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/5056-466-0x0000000140000000-0x000000014019C000-memory.dmp
            Download

            memory/5056-35-0x0000000000720000-0x0000000000780000-memory.dmp
            Download