Overview

overview

7

Static

static

3

2026-07-07...ar.exe

windows10-2004-x64

7

2026-07-07...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    10s
  • max time network
    158s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 16:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-07_5f194cc0f2e71e82b4b15b88c70440de_cobalt-strike_icedid_njrat_remcos_satacom_stealc_vidar.exe
  • Size 14.3MB
  • Sample260707-tnddmsht7z
  • SHA256 3421433dfd52203513d598982f2b121bd16d515bd649113f9ab3dcde058ae26e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_5f194cc0f2e71e82b4b15b88c70440de_cobalt-strike_icedid_njrat_remcos_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-07_5f194cc0f2e71e82b4b15b88c70440de_cobalt-strike_icedid_njrat_remcos_satacom_stealc_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1328
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:3880
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4536
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:5988
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:4304
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:3936
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    PID:3064
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3868
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:6032
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:6012
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:976
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5868
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:4640
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-200172840-2662118501-695741713-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-200172840-2662118501-695741713-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:2812
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2896 1548 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:2508
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 1768 1780 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
          PID:2576
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
            PID:2364
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 2896 1548 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
            2⤵
              PID:4360
            • C:\Windows\System32\SearchFilterHost.exe
              "C:\Windows\System32\SearchFilterHost.exe" 944 1768 1780 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
              2⤵
                PID:3528
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
                PID:3436
                • C:\Windows\explorer.exe
                  explorer.exe /LOADSAVEDWINDOWS
                  2⤵
                    PID:628
                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                  1⤵
                    PID:4276
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:3204

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          elevation_service.exe
                          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                          • Size 2.7MB
                          • SHA256 5ca0e8df861db19a9ecc156fe99eebf2c2da635a5901ad3a506cc5c7f4271cfe
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          maintenanceservice.exe
                          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                          • Size 1.7MB
                          • SHA256 a742663cd3ec61c266e899c26248c8a85c129530505f7a877be607abe163e402
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          7z.exe
                          • Path C:\Program Files\7-Zip\7z.exe
                          • Size 2.0MB
                          • SHA256 eff844c9c3d7e6124b89b202ebdf276ddac96ee01e33cd460f629e91c8eb9a28
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          7zFM.exe
                          • Path C:\Program Files\7-Zip\7zFM.exe
                          • Size 1.5MB
                          • SHA256 ab553503488ba2cf5f89b0223eadfc1e688a32b848b8f378fa4a5a931b4d4c52
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          7zG.exe
                          • Path C:\Program Files\7-Zip\7zG.exe
                          • Size 1.2MB
                          • SHA256 55a784064aa6385251153b4b74ebd303fedafb9dd982b79a85b28151e9dd8ef5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Uninstall.exe
                          • Path C:\Program Files\7-Zip\Uninstall.exe
                          • Size 1.4MB
                          • SHA256 d64ac968aab7d8e4c4ca152ba27908cfca04b9cf80102555cebef185c012fa6f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AppVShNotify.exe
                          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                          • Size 1.7MB
                          • SHA256 941ec5415fdf6707c84c8780c93f42ca69b9e145b62daaf98c66068acc12de84
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          IntegratedOffice.exe
                          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                          • Size 4.6MB
                          • SHA256 1e79aa20704b8d0038884bde48d2a53836ad7db9cd9fb13c17da42102591f7e7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MavInject32.exe
                          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                          • Size 1.8MB
                          • SHA256 afacb0506b7f35a2f6d22741263d0332d51cfbb76beed4933b7f41e281088329
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          OfficeC2RClient.exe
                          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                          • Size 24.0MB
                          • SHA256 d222aa3ff1a92f06690bb4cdc2b2820202a63ffdaeb542182b100a52fed2d09f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          appvcleaner.exe
                          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                          • Size 2.7MB
                          • SHA256 39bd5fb973d507f9801e34319ff633ad58c55f2533fe05bf6156d50c893e8a3c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          LICLUA.EXE
                          • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                          • Size 1.1MB
                          • SHA256 f2929f3603e6524053b9f73d74b77b95278296979fda3e7d3970abd517eff63d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          OSE.EXE
                          • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                          • Size 1.7MB
                          • SHA256 43ccdfd8faf343e6ca57523839619cdd1d784a51e294ce6e6357519c0f9ab4be
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VSTOInstaller.exe
                          • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                          • Size 1.5MB
                          • SHA256 27563a46ea495c861487bd79c14d1ae41f77de362d599ebb3651e6def133d5a2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          chrmstp.exe
                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                          • Size 6.6MB
                          • SHA256 cc205afa20f5ed1d65581d4e2de8d45db0a9d0793a04570c66fbd2ab8cf75e00
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          setup.exe
                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                          • Size 6.6MB
                          • SHA256 bfc64e7a0f4e5feada4d4761b88e39e3efccac806805dedcb7b6b57986a4af7b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          chrome_pwa_launcher.exe
                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                          • Size 2.3MB
                          • SHA256 480f330e11b1fc251c3a86c571f18c78df0ba26c9030181f3182b9cc0a23a9b9
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          elevated_tracing_service.exe
                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                          • Size 4.0MB
                          • SHA256 a4a73c5da0c264ac341574e7ac07dab07208e8f4f1882faa6f6cd23b502308b4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          elevation_service.exe
                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                          • Size 2.8MB
                          • SHA256 e7432bd2e324aa5a5e4029ada8716e4abe492b7555a9707a1de9d3160e90ffbc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          notification_helper.exe
                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                          • Size 2.2MB
                          • SHA256 f44492b37add15dd6686f8f49c9d97ba6de8fa29a1135686bad82089bc111646
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          os_update_handler.exe
                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                          • Size 2.4MB
                          • SHA256 5a8419c66bd5e9c283ee5ced5556eba801c0a4f14c9189d4af6ce2646411541a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          chrome_proxy.exe
                          • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                          • Size 2.0MB
                          • SHA256 caa7d4b78482628497f7cfc4a5c892f4bce3380a26cede18c4f70004d37ff53b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          appletviewer.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                          • Size 1.4MB
                          • SHA256 54d1ba6c570bba8ee6bfd19dd8c375cf89c77bc338f58822380ed1ba5b8c7d20
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          extcheck.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                          • Size 1.4MB
                          • SHA256 4bc736d77eec1e2a886d26aa14f2cdf1233bee05db93e88109d0ec87501143ba
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          idlj.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                          • Size 1.4MB
                          • SHA256 ffb20a45a20a0ea56be14250bba17152f5d79df581474c36d85b46a9362970e6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          jabswitch.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                          • Size 1.5MB
                          • SHA256 9421cbca21e34edfa85afe97bf4ee260bb6f5ebac17f2ae6cf324f6bfd4e435d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          jar.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                          • Size 1.4MB
                          • SHA256 800b4f080a5b9f92950e7feb0e21c9d1b7a4bf0f1954617a6d9d0a0b522c2c77
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          jarsigner.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                          • Size 1.4MB
                          • SHA256 6364e235808d8526b6489884a35d3e5a9efd3b716979b512d3c33df5870c2397
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          java-rmi.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                          • Size 1.4MB
                          • SHA256 4748697f77f6a5789d0446cfe9bba34dfb63fca14b7402caf0ee82c604dceac1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          java.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                          • Size 1.7MB
                          • SHA256 28659614c129e4e7016258286adc24c2b2b9d3fc2bde1326e170d0c803337cc0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          javac.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                          • Size 1.4MB
                          • SHA256 5aaf0ba3aac3c2392453afc39c6efda980133e77af7a48c1523ad91cb8c8f393
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          javadoc.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                          • Size 1.4MB
                          • SHA256 c0a638f279a8ef60211fd1e9be8d8fd0b3a2fc9732cab6183c16668b49a284f8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          javafxpackager.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                          • Size 1.6MB
                          • SHA256 e0c4df81c091bcea5f5314587357bb2dc908eee065c4ea2cdcd7097a132db482
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          javah.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                          • Size 1.4MB
                          • SHA256 988a9c4c80647feaec3ff4a457e46e110e7508519d475989f2e27360e2a4e651
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          javap.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                          • Size 1.4MB
                          • SHA256 5f9590776e5a52b97013072fadf9c89d700ff3531f0e547361a6b87ad5308d10
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          javapackager.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                          • Size 1.6MB
                          • SHA256 b6ea944daffbe733e0985d2381e4f255bf4b45f2b10618b8615f65b1eb42878b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          javaw.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                          • Size 1.7MB
                          • SHA256 81aa389b8045979d4052117e36f7fa0efb18f44fc0368b3d64e2a06d4d82389b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          javaws.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                          • Size 1.9MB
                          • SHA256 97fa06e5218a32803d4f1c0648357e981414d237c07bba484225efe2288bfe96
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          jcmd.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                          • Size 1.4MB
                          • SHA256 1d1c4fbe08dce1104ac32ff40ca8bf758bead2a3894943af35d659b7e9a23121
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          jconsole.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
                          • Size 1.4MB
                          • SHA256 22bd92245f546732185d6de77638ab32110e31651d5f1a9cafb1e060f431af13
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          jdb.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
                          • Size 1.4MB
                          • SHA256 24d21be472289db1deadba8ee456a9af2923a77706b77bcc95656e3e84535be8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          jdeps.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
                          • Size 1.4MB
                          • SHA256 ca340dfdee2495b0b49db4415972f7f7186f01c3bdbaed2feaa2f9f86e5fa601
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          jhat.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
                          • Size 1.4MB
                          • SHA256 5b6f12dab337eb78c84e1bdd0ad4998c8be0fd947ca2f8385492cd386fef26b6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          jinfo.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
                          • Size 1.4MB
                          • SHA256 30400785692dbea110d6841d3f1eb019e398bf4bd1215cde529e2d0060f549dc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          jjs.exe
                          • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
                          • Size 1.4MB
                          • SHA256 85597c07591283ff87c30cd83b356aa9322c45883afba44f938bb20c6f3273f8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MsSense.exe
                          • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                          • Size 1.9MB
                          • SHA256 a8297b59bbfe92120d2a8e732be18c3fbc9a44ddb7a93ce554ac9c780357f147
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          NisSrv.exe
                          • Path C:\Program Files\Windows Defender\NisSrv.exe
                          • Size 3.5MB
                          • SHA256 ae62a3b3333d328c4e671684f6ebed6386b0a90bdca01f532d754d4ef197d1a4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          wmpnetwk.exe
                          • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                          • Size 1.4MB
                          • SHA256 0177902734857581c2432779838fe87f6584fb4d3531f2ba81683529406fb7c9
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dotnet.exe
                          • Path C:\Program Files\dotnet\dotnet.exe
                          • Size 1.6MB
                          • SHA256 1097b0dd4ecfb1d75990efdb73c3696de56ae50c57c4814f9d612a51f8360c92
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Windows.db
                          • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                          • Size 1.2MB
                          • SHA256 b0263638bd1444c16c0e9e71500a57a594ca98eaa87652dcf5cd4872a139fe0e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Windows.db-wal
                          • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                          • Size 1.3MB
                          • SHA256 701122591b8626b1e2c038fcd5e105d17009a5fe8743ddb8690a140aba780732
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          prep_Activatable Class_Hermes_perf.cache
                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                          • Size 599B
                          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          perfhost.exe
                          • Path C:\Windows\SysWOW64\perfhost.exe
                          • Size 1.4MB
                          • SHA256 cf023f9cb85a4251258ac095384c01bedf4ee1e9b94fc81145075639577c472b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AgentService.exe
                          • Path C:\Windows\System32\AgentService.exe
                          • Size 1.4MB
                          • SHA256 8746fce921180be39f3a694d495fe90f36c55240929471815ab0a63108b6ac2b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ssh-agent.exe
                          • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                          • Size 2.0MB
                          • SHA256 1894ae4d3ad11655ae5e185b0e92c53cd93d772c74671757ed804c74ce36953f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          PerceptionSimulationService.exe
                          • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                          • Size 1.7MB
                          • SHA256 ca53d2309ac571d30c559927717206a937062427e51b9cfdc5b75124e3dfe9e6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ReFsDedupSvc.exe
                          • Path C:\Windows\System32\ReFsDedupSvc.exe
                          • Size 2.6MB
                          • SHA256 41f83110b81f5d728865a2ba3e67f75d5b57cbba78db9f7a7c9c774d8ca5dd05
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          SearchIndexer.exe
                          • Path C:\Windows\System32\SearchIndexer.exe
                          • Size 1.4MB
                          • SHA256 d9b2bf776a4f0345f95734f8c594c880c0e56ed1074c33081c1d6282f2b1091a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          SensorDataService.exe
                          • Path C:\Windows\System32\SensorDataService.exe
                          • Size 1.7MB
                          • SHA256 c4fd1d1f38e00e90b6ae773c42f22b90ae35e42e55e2eba4430eefb1ff7ef953
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AppVClient.exe
                          • Path C:\Windows\system32\AppVClient.exe
                          • Size 1.3MB
                          • SHA256 083fea83c48726448acb3eae59312639e8fddf6b1ed3b16f449d6af7cbaac339
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          SgrmBroker.exe
                          • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                          • Size 1.8MB
                          • SHA256 25ecc6ac270594d9232c92f43c81c6b3ced56e4216200f8f53c978638eb8a413
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          memory/976-116-0x0000000140000000-0x0000000140168000-memory.dmp
                          Download

                          memory/976-117-0x0000000000780000-0x00000000007E0000-memory.dmp
                          Download

                          memory/976-130-0x0000000140000000-0x0000000140168000-memory.dmp
                          Download

                          memory/976-126-0x0000000000780000-0x00000000007E0000-memory.dmp
                          Download

                          memory/976-124-0x0000000000780000-0x00000000007E0000-memory.dmp
                          Download

                          memory/1328-6-0x00000000020A0000-0x0000000002100000-memory.dmp
                          Download

                          memory/1328-21-0x0000000140000000-0x0000000141E9C000-memory.dmp
                          Download

                          memory/1328-23-0x00007FFEAAE20000-0x00007FFEAAE21000-memory.dmp
                          Download

                          memory/1328-0-0x00000000020A0000-0x0000000002100000-memory.dmp
                          Download

                          memory/1328-112-0x0000000140000000-0x0000000141E9C000-memory.dmp
                          Download

                          memory/2576-319-0x00000150CEE10000-0x00000150CEE31000-memory.dmp
                          Download

                          memory/2576-318-0x00000150CF200000-0x00000150CF48B000-memory.dmp
                          Download

                          memory/3064-301-0x0000000000400000-0x0000000000577000-memory.dmp
                          Download

                          memory/3064-75-0x0000000000400000-0x0000000000577000-memory.dmp
                          Download

                          memory/3868-79-0x00000000007F0000-0x0000000000850000-memory.dmp
                          Download

                          memory/3868-85-0x00000000007F0000-0x0000000000850000-memory.dmp
                          Download

                          memory/3868-324-0x0000000140000000-0x00000001402C9000-memory.dmp
                          Download

                          memory/3868-78-0x0000000140000000-0x00000001402C9000-memory.dmp
                          Download

                          memory/3868-323-0x00000000007F0000-0x0000000000850000-memory.dmp
                          Download

                          memory/3868-302-0x0000000140000000-0x00000001402C9000-memory.dmp
                          Download

                          memory/3880-13-0x0000000000D50000-0x0000000000DB0000-memory.dmp
                          Download

                          memory/3880-24-0x0000000140000000-0x00000001402E9000-memory.dmp
                          Download

                          memory/3880-115-0x0000000140000000-0x00000001402E9000-memory.dmp
                          Download

                          memory/3880-18-0x0000000000D50000-0x0000000000DB0000-memory.dmp
                          Download

                          memory/3936-71-0x0000000000BD0000-0x0000000000C30000-memory.dmp
                          Download

                          memory/3936-65-0x0000000000BD0000-0x0000000000C30000-memory.dmp
                          Download

                          memory/3936-64-0x0000000140000000-0x00000001401AB000-memory.dmp
                          Download

                          memory/3936-286-0x0000000140000000-0x00000001401AB000-memory.dmp
                          Download

                          memory/4276-339-0x0000020D81EB0000-0x0000020D81FB0000-memory.dmp
                          Download

                          memory/4276-330-0x0000020D801E0000-0x0000020D802E0000-memory.dmp
                          Download

                          memory/4276-376-0x0000020D94310000-0x0000020D94330000-memory.dmp
                          Download

                          memory/4276-358-0x0000020D81E50000-0x0000020D81E70000-memory.dmp
                          Download

                          memory/4276-338-0x0000020D81A60000-0x0000020D81A80000-memory.dmp
                          Download

                          memory/4304-270-0x0000000140000000-0x00000001401AF000-memory.dmp
                          Download

                          memory/4304-59-0x0000000000880000-0x00000000008E0000-memory.dmp
                          Download

                          memory/4304-52-0x0000000000880000-0x00000000008E0000-memory.dmp
                          Download

                          memory/4304-58-0x0000000140000000-0x00000001401AF000-memory.dmp
                          Download

                          memory/4536-165-0x0000000140000000-0x00000001402D4000-memory.dmp
                          Download

                          memory/4536-26-0x00000000006E0000-0x0000000000740000-memory.dmp
                          Download

                          memory/4536-32-0x00000000006E0000-0x0000000000740000-memory.dmp
                          Download

                          memory/4536-34-0x0000000140000000-0x00000001402D4000-memory.dmp
                          Download

                          memory/5868-133-0x0000000140000000-0x0000000140172000-memory.dmp
                          Download

                          memory/5868-140-0x0000000000620000-0x0000000000680000-memory.dmp
                          Download

                          memory/5868-134-0x0000000000620000-0x0000000000680000-memory.dmp
                          Download

                          memory/5868-307-0x0000000140000000-0x0000000140172000-memory.dmp
                          Download

                          memory/5988-38-0x00000000017C0000-0x0000000001820000-memory.dmp
                          Download

                          memory/5988-48-0x00000000017C0000-0x0000000001820000-memory.dmp
                          Download

                          memory/5988-50-0x0000000140000000-0x00000001401B5000-memory.dmp
                          Download

                          memory/5988-44-0x00000000017C0000-0x0000000001820000-memory.dmp
                          Download

                          memory/5988-37-0x0000000140000000-0x00000001401B5000-memory.dmp
                          Download

                          memory/6012-113-0x0000000140000000-0x000000014021E000-memory.dmp
                          Download

                          memory/6012-109-0x0000000000E30000-0x0000000000E90000-memory.dmp
                          Download

                          memory/6012-103-0x0000000000E30000-0x0000000000E90000-memory.dmp
                          Download

                          memory/6032-306-0x0000000140000000-0x00000001401BA000-memory.dmp
                          Download

                          memory/6032-303-0x0000000140000000-0x00000001401BA000-memory.dmp
                          Download

                          memory/6032-90-0x00000000007B0000-0x0000000000810000-memory.dmp
                          Download

                          memory/6032-95-0x0000000140000000-0x00000001401BA000-memory.dmp
                          Download

                          memory/6032-304-0x00000000007B0000-0x0000000000810000-memory.dmp
                          Download

                          memory/6032-97-0x00000000007B0000-0x0000000000810000-memory.dmp
                          Download