Overview

overview

10

Static

static

10

2026-06-26...lc.exe

windows10-2004-x64

9

2026-06-26...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/06/2026, 14:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
  • Size 1.2MB
  • Sample260629-rertkafs41
  • SHA256 6f6dd86ffeeceb9546400706d3348129277858dbe3517dcbe22b78055b6de705
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 3 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 20 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Looks for VMWare services registry key.
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c ping -n 2 127.0.0.1 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-06-26_8e4c13c232e54d343a3a951a5018fc38_icedid_luca-stealer_njrat_stealc.exe"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\system32\PING.EXE
        ping -n 2 127.0.0.1
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3088
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:1456
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2636
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1584
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4408
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4888
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4028
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2424
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4280
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3692
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3528
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2864
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4376
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3984
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:752
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4564
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:1396
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2144
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4316
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4992
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:3680
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1064
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4900
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:924
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1180
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2344
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:660

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 9b44b6b1199e2e9017917dde030a5ca6ea49d07630c7956c899a1cfffb78ec40
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.6MB
            • SHA256 d34b98a4868a73f760cc508abbd6791a5d9241bce82369d57073b2258cb09d6f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.9MB
            • SHA256 4b132c9cb71670f41f6728d215a8aa912e2a20f8fc30f05f1db92bcadad2ed41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 f52a0892ac7b01aa8c4deb3b2ba7c38a205c841289bdaf8470b68bd2330ba874
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 a824c397d001706a06f80c798294fafaee97adb7b1b8cbd37e17813bd6ff6357
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.4MB
            • SHA256 0ea3d2a351a958955defad7cbb356645743897eb16d3c7d42cddf5dc18d1aec0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.6MB
            • SHA256 3eaf22424189e72197db31f3a8c19dc3cd3b9c1ed04bf913ea073ed815097dd5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 b6a6b04311559b1f8d8ead516f77463750805951cb2c42ac650de76316dcd583
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.7MB
            • SHA256 267ac859981b8edb6f0b3a5adb4b0f3bff443ff9649cbdf3f73a89443a544e8a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 432f07e0f45b2ee0913782030706e976e23d3c8d3077546effe81c4017a1ee46
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 5d37de534d7c9671feba746aaeabc12a513e360454a7c54368cf509412bccf2d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 a5dcb843e97085489ccaebc86eb1e0d64b277ff7738911d5671d13c919eec3d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.6MB
            • SHA256 4ea4280d50ab3e9b392948d14eecd82f6e508b69ff85a535552ecdd1864a719a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.5MB
            • SHA256 3f3bf22e848ce40b2e28fffa3a5d2fd2a430ebdb0fd4336f4702e3cfdeb7444b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
            • Size 6.6MB
            • SHA256 883f21ae906773b9d07d30827c221a8c177c6243c9c42b6117d94c06001a5380
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
            • Size 6.6MB
            • SHA256 cae14dfb631c563af6ab430d8cda34fd659cd0887dc2745c5d929fa0b8016252
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 5b5758daaa98010ee1aa1c3371d3da21b5486e3a15df7b113190c30fc7ff5c62
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
            • Size 4.0MB
            • SHA256 ab3039995ac2558b8dd631efa72545693a1e41a037583c1dc91a40aa22e0c93e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 bfa6ff239be431fe69e2d247f39fa641acfb2dfcc0ca3d23c455722c3adb60af
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
            • Size 2.2MB
            • SHA256 c98cd854605da485291752f33af973c7aaad298883ed7be26f80b47bd3c6406e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            os_update_handler.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
            • Size 2.4MB
            • SHA256 1d90c03ebde6747fc565e5bfefd579028962833f44c4e0bab91a20d1a1e8885f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 2.0MB
            • SHA256 cf3f466baa6347cfa9587e96c7f4a8043289f2ff6e195a0a60bad1a6aa68bf26
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.4MB
            • SHA256 b35aea92eca47af57af0cdfe4d2fd0f4feece74ded85483c59893fdd91e12d3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.4MB
            • SHA256 655e74a420bf58764b2de04d7717e07708372acee0ff49fd92d7f5282af67500
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.4MB
            • SHA256 86af5a9fde9b023d0c0b60d752a6b9969a15b1cc55be2e2f2720655ddbdec202
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.4MB
            • SHA256 b4142046fb3d168f4d2864c9b91b23062afac25875c245b7ddb70ed56aac2040
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.4MB
            • SHA256 944c4c3d51e1a3168d640f24a9862e800e79241a84abb636a74cf5e53bd102bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.4MB
            • SHA256 7487a47b7ff50cfb52fe2f3482da9a921c07f936d904c247d69c45b134e22812
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.4MB
            • SHA256 a5530398637bdcfedb60cb16689b3c34cf8bb452c1539a21672c8fdc154392b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.6MB
            • SHA256 f9100dd9183d38f093f3136840b89a3f203399e016b91ebdc86b37ba3ef2c893
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.4MB
            • SHA256 f374967b7890431fe60c30a6017891f497cfc9893cb89201f0a19524c7d90697
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.4MB
            • SHA256 a48aa789d88a241e0a33e6930a374bd27509ce020482cac073ad67e2c9b7aafe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.5MB
            • SHA256 6ac8cb91400d19445d86b9d1b72de4d828f10cbb35f037ae85b0b991cdfe7cc1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.4MB
            • SHA256 59771b2e2aeaba8a8f2354a676cabb65be0b9d25acd20949c5df6ed755168cce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.4MB
            • SHA256 98e8c7f42a9a26cc88ca3a06f86e73902e4a8753f082b94c9e632c9cf4ac2f37
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 1.5MB
            • SHA256 476edc11c1642314c094520e7f4964302f952608264a48fab0219993e971ade0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 b6d45893f353171396bd83919c0d65e34a21184ffdc623c165216718ffedebbd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.5MB
            • SHA256 977b503e56f6834c3833c110fe3428857fa079e3d6dea85a1a4aea2e5c9cbbe1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.4MB
            • SHA256 3b24369952d9a5207cedef4a91f7256f4a9bda8a9b230ea68566c1621ef43f21
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 fc2f8b9e33d2a64e1ad484c1ed416491184226272689dbac3f538ff8b577658e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.5MB
            • SHA256 fda8ba40d4fae670cc91f64110a9278cc0d84b5119c401449cd0b8a6256fd5eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 a63971cdcbe2216c0a24e3879f788a4c63fefc8cc656553046f83680d956e09b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.4MB
            • SHA256 0ee5bf6131f7a6ff3e3f87aea9aa7a2d78a994156295fe6f6b944d9f41fe885b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.7MB
            • SHA256 98dcb193385d058fd03d6a4c2044c9f47b2765354c605432a55da02e46a535ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.5MB
            • SHA256 e2cb1d075dd0b67d52a822031103693f9d2e9d6674da2bcc602cbbb172a9d05d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 91df8c888e056f13240c6086c8b1db04447b55038993f8e77ab1e051e2201ae3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 77931b136e2694cfe2d73f550c6d2704c6df1ba6370c94fc4c9e06f367302994
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 1c09d22d75bf9766798734cbd7a533a2c8c7a34d22bdaa27a1d0861dd2c63964
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.7MB
            • SHA256 01e542f02a70ba98fb5c603a85e7ac3259c3bdf854a1c270994a778b1148573d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 697d8aeeda84513fd2a7740fb51ebecd1d589de251a2d0ddb59a655f0e09a096
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.5MB
            • SHA256 38919bca0a129b7be2d602d3ca9c7aa361425111a93b4de09b1f7f7ec6b2b9d0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.5MB
            • SHA256 b60a9e0c3078b519057f25b610fdc03dd9df1eb8b9109335fd8efbb0c70e2d44
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.4MB
            • SHA256 8e763ea2f5274c50ef435066a391652ae882c4a7dcd9c9cfcf30be784351656a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 f017f9242439bee081221756803ebe4477a9a8c0803a77d1253b2520da16c986
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.6MB
            • SHA256 d3eabe36759aaa765197a59c1aa390891ac0a6f4baa05876435828ad8b112613
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 a2ee0e8dcec44d17fca92899809ba745859e75682294950742b4aac0b706c9fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 67738ba92927517496dabcff5dfba7e3d2a65908656ce3b81c6ffa29f322e7aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.7MB
            • SHA256 0ac3615dd04cd851753808e553e8b3c5cdc494be9e500333f04b578bb2568d7b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.4MB
            • SHA256 39978fefde81b2e22953f028df9801d9fbe24e3881c1cb489734c3f3ca8534b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/752-260-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/752-120-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/924-370-0x0000000140000000-0x0000000140199000-memory.dmp
            Download

            memory/924-169-0x0000000140000000-0x0000000140199000-memory.dmp
            Download

            memory/1064-367-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/1064-161-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/1180-373-0x000000000F190000-0x000000000F198000-memory.dmp
            Download

            memory/1180-377-0x000000000CE40000-0x000000000CE41000-memory.dmp
            Download

            memory/1180-363-0x000000000CD90000-0x000000000CD98000-memory.dmp
            Download

            memory/1180-372-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1180-376-0x000000000F1E0000-0x000000000F1E8000-memory.dmp
            Download

            memory/1180-371-0x000000000CEB0000-0x000000000D5CD000-memory.dmp
            Download

            memory/1180-215-0x0000000009E60000-0x0000000009E68000-memory.dmp
            Download

            memory/1180-179-0x0000000001770000-0x0000000001780000-memory.dmp
            Download

            memory/1180-195-0x0000000001A20000-0x0000000001A30000-memory.dmp
            Download

            memory/1180-174-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1396-137-0x0000000140000000-0x00000001401D5000-memory.dmp
            Download

            memory/1396-144-0x0000000000D60000-0x0000000000DC0000-memory.dmp
            Download

            memory/1396-138-0x0000000000D60000-0x0000000000DC0000-memory.dmp
            Download

            memory/1396-361-0x0000000140000000-0x00000001401D5000-memory.dmp
            Download

            memory/1456-13-0x0000000140000000-0x000000014017D000-memory.dmp
            Download

            memory/1456-101-0x0000000140000000-0x000000014017D000-memory.dmp
            Download

            memory/2424-64-0x0000000140000000-0x00000001401A8000-memory.dmp
            Download

            memory/2424-69-0x0000000140000000-0x00000001401A8000-memory.dmp
            Download

            memory/2424-67-0x0000000001510000-0x0000000001570000-memory.dmp
            Download

            memory/2424-56-0x0000000001510000-0x0000000001570000-memory.dmp
            Download

            memory/2424-62-0x0000000001510000-0x0000000001570000-memory.dmp
            Download

            memory/2636-17-0x0000000000580000-0x00000000005E0000-memory.dmp
            Download

            memory/2636-24-0x0000000140000000-0x000000014017C000-memory.dmp
            Download

            memory/2636-26-0x0000000000580000-0x00000000005E0000-memory.dmp
            Download

            memory/2636-102-0x0000000140000000-0x000000014017C000-memory.dmp
            Download

            memory/2864-109-0x00000000005F0000-0x0000000000657000-memory.dmp
            Download

            memory/2864-104-0x00000000005F0000-0x0000000000657000-memory.dmp
            Download

            memory/2864-103-0x0000000000400000-0x000000000056A000-memory.dmp
            Download

            memory/2864-164-0x0000000000400000-0x000000000056A000-memory.dmp
            Download

            memory/3528-90-0x0000000140000000-0x000000014017E000-memory.dmp
            Download

            memory/3528-91-0x0000000000BB0000-0x0000000000C10000-memory.dmp
            Download

            memory/3528-97-0x0000000000BB0000-0x0000000000C10000-memory.dmp
            Download

            memory/3528-160-0x0000000140000000-0x000000014017E000-memory.dmp
            Download

            memory/3680-366-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/3680-156-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/3692-155-0x0000000140000000-0x00000001401A2000-memory.dmp
            Download

            memory/3692-79-0x0000000000700000-0x0000000000760000-memory.dmp
            Download

            memory/3692-87-0x0000000140000000-0x00000001401A2000-memory.dmp
            Download

            memory/3692-85-0x0000000000700000-0x0000000000760000-memory.dmp
            Download

            memory/3984-116-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3984-368-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3984-173-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4028-51-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/4028-45-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/4028-136-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/4028-54-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/4280-151-0x0000000140000000-0x000000014018C000-memory.dmp
            Download

            memory/4280-72-0x0000000140000000-0x000000014018C000-memory.dmp
            Download

            memory/4316-148-0x0000000140000000-0x00000001401B5000-memory.dmp
            Download

            memory/4316-365-0x0000000140000000-0x00000001401B5000-memory.dmp
            Download

            memory/4376-168-0x0000000140000000-0x0000000140168000-memory.dmp
            Download

            memory/4376-113-0x0000000140000000-0x0000000140168000-memory.dmp
            Download

            memory/4408-42-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/4408-30-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/4564-129-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/4564-333-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4564-132-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4564-123-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/4888-33-0x0000000000C60000-0x0000000000CC0000-memory.dmp
            Download

            memory/4888-131-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/4888-39-0x0000000000C60000-0x0000000000CC0000-memory.dmp
            Download

            memory/4888-41-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/4900-165-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4900-369-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4992-157-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4992-152-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/5032-71-0x0000000140000000-0x0000000140145000-memory.dmp
            Download

            memory/5032-9-0x00000000004D0000-0x0000000000530000-memory.dmp
            Download

            memory/5032-0-0x00000000004D0000-0x0000000000530000-memory.dmp
            Download

            memory/5032-8-0x0000000140000000-0x0000000140145000-memory.dmp
            Download

            memory/5032-452-0x00000000004D0000-0x0000000000530000-memory.dmp
            Download

            memory/5032-453-0x0000000140000000-0x0000000140145000-memory.dmp
            Download