Overview

overview

7

Static

static

3

2026-07-09...os.exe

windows10-2004-x64

7

2026-07-09...os.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 06:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_b96dc4bf396d7322bdf1bf0837674b81_cryptbot_elex_luca-stealer_mespinoza_njrat_remcos.exe
  • Size 2.0MB
  • Sample260709-g44jjset8w
  • SHA256 e98f1e203a410b776685ae2f08592a2f0a91df39dbd3674581bd382b24417890
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 11 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_b96dc4bf396d7322bdf1bf0837674b81_cryptbot_elex_luca-stealer_mespinoza_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_b96dc4bf396d7322bdf1bf0837674b81_cryptbot_elex_luca-stealer_mespinoza_njrat_remcos.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5752
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5180
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:5684
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:5024
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:5760
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:1488
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4492
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1776
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:1120
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:5464
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5332
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:252
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:1584
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1590476978-4004838454-3790292847-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1590476978-4004838454-3790292847-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:5280
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2736 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:5992
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
          • Modifies data under HKEY_USERS
          PID:1864
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:4412
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:5864
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 2736 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
            2⤵
              PID:2996

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                • Size 2.7MB
                • SHA256 bdf05b71eafc8133c53b8e48b9ae622ba53ba6cc47d91c81fdaf4fb0039f2ec0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 1.4MB
                • SHA256 a7080600082279f36eecaa258be30d22f0a3ee794fc9e4e23c3fd98aceda99cc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 1.7MB
                • SHA256 8cc559c69670882dc07675bf58ac57a869288367bbf7182b7b940de586b97dc8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zFM.exe
                • Path C:\Program Files\7-Zip\7zFM.exe
                • Size 1.5MB
                • SHA256 47eeb9cbe4f1a8e45d63a2341be9509839d02b46e1fb4d54d089ade63e8c009e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zG.exe
                • Path C:\Program Files\7-Zip\7zG.exe
                • Size 1.2MB
                • SHA256 4008a812da2dc8d8343244604c50ab978427ed660321ee83430b715474362579
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall.exe
                • Path C:\Program Files\7-Zip\Uninstall.exe
                • Size 1.2MB
                • SHA256 c93960071a6fb20d15dce0904ad2c9f81c3962ef2056dca543a196886bf7fcaf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 1.4MB
                • SHA256 f957dc413c30f0272e26fec7df9b942e8672fb9b9d916dd62120a408651af43f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 4.6MB
                • SHA256 0a466660d94c5a6d1d7ce86761a7585c91e5856a89e5d6a7ea646213d32e567b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 1.5MB
                • SHA256 fc26c64c8a07bcfe784f3408f95c6167a7d2bc27e7237d6da68f624d2e19cbe0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 24.0MB
                • SHA256 54fb327b246112ef21e04a430b57ea650bc68a64a36a9aec1a502a7b4acb0aec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 2.7MB
                • SHA256 dfc03d35e1e6ef4b3b5d8f8468c90d5a1cd578b56eff1cf4c78a4e6ba2f74fdc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICLUA.EXE
                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                • Size 1.1MB
                • SHA256 dad8bf8b445fe586c125b8d320617b543a948cf8a14c81d744c032bea64b2bc7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 1.4MB
                • SHA256 7df66ba8844bc6203d295a4e0c73a312cacd5280433c63e54caea558c442973d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 1.3MB
                • SHA256 7ede1fd90fda75cfec90dd4a2c503dd2a93d50c447b8c8c240b60745b6d5e17a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 6.6MB
                • SHA256 c68bb7351424d978b2ee84f6427285d16803c651d0fdf86319680195222f7647
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                • Size 6.6MB
                • SHA256 2f5fc29f98bb1890bcee511c7b58c7555b759ceff3fe756889a187ac9ce7f354
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 2.3MB
                • SHA256 4e977ebd3aee0d9458e500291e65e5d33e7c9743ce95be3ca961795740480452
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 4.0MB
                • SHA256 827d79c182471828f3324dd4ac9469f45fd12db5c4ef18fba21057fbee668632
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 2.8MB
                • SHA256 be16380dd1aa0aefa2e1dde924966297fb885c89b54119dce756adb62f578155
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 2.2MB
                • SHA256 b32936e42eabd071dd85baabfb8d271e6fa459562c03477e8589c5c30abf140a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                os_update_handler.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                • Size 2.4MB
                • SHA256 c8adf2ae0e1a906d182bf22058b46c9e797399de311d9a5ebd74fab6e91a2d8e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_proxy.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                • Size 2.0MB
                • SHA256 5063483493769bc689becb98a99bd51cb31ea32a1d81cc261ca6626a9a0c78ad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 1.2MB
                • SHA256 7afa28b7564a7c8266738914aab8ef437bf13ffb2c0d52eecbbd61f22e6a70ec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 1.2MB
                • SHA256 5d6e41fd5e11d753d706645a51180e36fba361142b326e4466512390f051bbfa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 1.2MB
                • SHA256 a28f38a432cf38b33412e0067ae561cf09c814f2cedb4469f43e2d29be201634
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jabswitch.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                • Size 1.2MB
                • SHA256 b24792a992908cd5790fca304db3f6bce2f39b9259746af983fd006180186e69
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 1.2MB
                • SHA256 4f4953195526a320f7e4d727d3fff278dbc084469fe73f2cf41cbab1c2174a43
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jarsigner.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                • Size 1.2MB
                • SHA256 43056d6c1027001d26cf1910638379579a9bc9b80c46b4147cc7fb17666a541a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java-rmi.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                • Size 1.2MB
                • SHA256 03f8bb8ff449e8fc342bdc0cad7176e5413abe56395be8b84a9b260a3ed1dd79
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                • Size 1.4MB
                • SHA256 97a0d44a458bef84a76ce4c83c4ea6028e1c1f0e62fbbcde545ad457d7161f16
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javac.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                • Size 1.2MB
                • SHA256 c73df773a533c35f31ed86daf04a4ed2943698d28d91973824d1139baeb98bb6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javadoc.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                • Size 1.2MB
                • SHA256 d94deae430775896bad0091dc0945839feab680cd84b924441a77ba55dac5221
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javafxpackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                • Size 1.3MB
                • SHA256 d29d79946ce1e2a8c721be4e65ac779af9a7fbefb3f5e65e0e13e376b55cff6c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javah.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                • Size 1.2MB
                • SHA256 b7d4b5b61d869de8a585a300d6599d8b967b3466cbdedca9457d26b0fd37f7fe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                • Size 1.2MB
                • SHA256 0766bc0ac68df37edd47c1ded19ef3e0b8e288c4b75bf13408e0202a551f6e29
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javapackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                • Size 1.3MB
                • SHA256 48b99ea926d134a2da4a4201ae0a3212090c97e044e8711264f89251a04204f6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaw.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                • Size 1.4MB
                • SHA256 ea5b6ad0c0b35ac72f2baee7396eeaabf2c9637c9b1d5b7e9534caff9f3796f1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaws.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                • Size 1.6MB
                • SHA256 34bdf8a5823768ee5885cb268b444fb951d1b9f6e0392e88176d441dc137317b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jcmd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                • Size 1.2MB
                • SHA256 d42491add2936f93ab6c33f92b3658cc87dc398740548a228fa7a623838757be
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jconsole.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
                • Size 1.2MB
                • SHA256 ad7c18e1f4c83b964ddfa94be356697604c3a9567c0ff4d29f2018e5fef5135d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdb.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
                • Size 1.2MB
                • SHA256 0942ae396dc81fc6207e3b8f7dad72d20b560a6ff561558a166e234dd1923601
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdeps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
                • Size 1.2MB
                • SHA256 6974a832a85d25a9b0500c7260d861ad90ec2cba1af3f3284ac042c598048b7b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jhat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
                • Size 1.2MB
                • SHA256 661e0903930cf7115bf4cb501fc688e65e6fc7d28b66093cd89a086c12840445
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jinfo.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
                • Size 1.2MB
                • SHA256 c117f9888bf41ec0529c9770b0b7248104ff94d8db35490eacd7fa1a5ba01e6b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MsSense.exe
                • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                • Size 1.6MB
                • SHA256 a982cdc2e6323b2a95c147a40621ea218dbb09d73aa914db6e596132f18ba99e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                NisSrv.exe
                • Path C:\Program Files\Windows Defender\NisSrv.exe
                • Size 3.5MB
                • SHA256 35150d2b0f49d3ca6884a80113fe9a4464e1f6aaa8ca8d5db24aadd2ffe0b3e8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wmpnetwk.exe
                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                • Size 1.4MB
                • SHA256 2275b76f2e472d72380583a12cab0a266a10848bd2a6530c0b0f619ccbf6858b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 1.3MB
                • SHA256 8e07c5ff056b9c23772b66882f71963e21fb65d5a7ade2aef4f04f6fb3cf500c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                • Size 1.1MB
                • SHA256 de7a20c0ee8c548ad0e5426b206ec5dafc0dc2a008fd4d12aa6082a1b3978b93
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db-wal
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                • Size 579KB
                • SHA256 65f453f8c196de73eb46d3c03561d433268714d1c3e2c0489fb3d36d7cd54cc6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WinRAR.lnk
                • Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
                • Size 1020B
                • SHA256 528feaa9eb61d4f1e052bed5c3da49f8cf12312e04f7781f09da22833da87301
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 1.2MB
                • SHA256 b46a7764444d70edfbda2551eff93b8caf6ee6fb99f1c492c0a67001a4698a8e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\System32\AgentService.exe
                • Size 1.4MB
                • SHA256 73efe3fa081e5f183c38f0f0da3ea8424df3ebb3e3de72ac0b92d46396f01740
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 1.7MB
                • SHA256 59480552e25bfa44978ebb5f632a1d96ec2c9b9bbf4689f776842b997c2a2a85
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ReFsDedupSvc.exe
                • Path C:\Windows\System32\ReFsDedupSvc.exe
                • Size 2.6MB
                • SHA256 ba36689fa0919ccc8092e546cf4b4b1297bd3cc5137ca67a50e9e5c2ccb9eabe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.4MB
                • SHA256 cdfc83eda7602cc11ba4538ef6fcb28a634ea7d804edf085f4c3f195ea0c6421
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.7MB
                • SHA256 03bc481f1fd28ff3d6dc67b0cb243b5d7a3c901254c708ed0b0dfc3823f2410b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVClient.exe
                • Path C:\Windows\system32\AppVClient.exe
                • Size 1.3MB
                • SHA256 658f3f1241d48faba128b5c4f5da7a850e1e7f846e6130f8c22e84600a3cc9aa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 1.4MB
                • SHA256 8923a417cb81132ed6f57f4740d955976663a3a3be9566fa769876e1b311b812
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SgrmBroker.exe
                • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                • Size 1.6MB
                • SHA256 b9119ac8ded166e914565433a6a1847433aa7aa21765510566bad1977f7acb64
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/252-150-0x00000000006A0000-0x0000000000700000-memory.dmp
                Download

                memory/252-143-0x0000000140000000-0x0000000140172000-memory.dmp
                Download

                memory/252-144-0x00000000006A0000-0x0000000000700000-memory.dmp
                Download

                memory/252-318-0x0000000140000000-0x0000000140172000-memory.dmp
                Download

                memory/1120-316-0x0000000000780000-0x00000000007E0000-memory.dmp
                Download

                memory/1120-313-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/1120-317-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/1120-107-0x0000000000780000-0x00000000007E0000-memory.dmp
                Download

                memory/1120-101-0x0000000000780000-0x00000000007E0000-memory.dmp
                Download

                memory/1120-100-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/1488-73-0x0000000000BE0000-0x0000000000C40000-memory.dmp
                Download

                memory/1488-67-0x0000000000BE0000-0x0000000000C40000-memory.dmp
                Download

                memory/1488-279-0x0000000140000000-0x000000014020A000-memory.dmp
                Download

                memory/1488-65-0x0000000140000000-0x000000014020A000-memory.dmp
                Download

                memory/1776-96-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/1776-94-0x0000000000740000-0x00000000007A0000-memory.dmp
                Download

                memory/1776-358-0x0000000000740000-0x00000000007A0000-memory.dmp
                Download

                memory/1776-360-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/1776-298-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/1776-88-0x0000000000740000-0x00000000007A0000-memory.dmp
                Download

                memory/1864-349-0x000001E71D7A0000-0x000001E71D96A000-memory.dmp
                Download

                memory/4492-291-0x0000000000400000-0x00000000005D6000-memory.dmp
                Download

                memory/4492-83-0x00000000009F0000-0x0000000000A57000-memory.dmp
                Download

                memory/4492-79-0x00000000009F0000-0x0000000000A57000-memory.dmp
                Download

                memory/4492-77-0x0000000000400000-0x00000000005D6000-memory.dmp
                Download

                memory/5024-41-0x0000000001B90000-0x0000000001BF0000-memory.dmp
                Download

                memory/5024-46-0x0000000001B90000-0x0000000001BF0000-memory.dmp
                Download

                memory/5024-39-0x0000000140000000-0x0000000140214000-memory.dmp
                Download

                memory/5024-52-0x0000000140000000-0x0000000140214000-memory.dmp
                Download

                memory/5024-50-0x0000000001B90000-0x0000000001BF0000-memory.dmp
                Download

                memory/5180-14-0x0000000140000000-0x00000001402E9000-memory.dmp
                Download

                memory/5180-23-0x0000000000D30000-0x0000000000D90000-memory.dmp
                Download

                memory/5180-15-0x0000000000D30000-0x0000000000D90000-memory.dmp
                Download

                memory/5180-113-0x0000000140000000-0x00000001402E9000-memory.dmp
                Download

                memory/5332-136-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                Download

                memory/5332-127-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                Download

                memory/5332-126-0x0000000140000000-0x0000000140168000-memory.dmp
                Download

                memory/5332-139-0x0000000140000000-0x0000000140168000-memory.dmp
                Download

                memory/5332-133-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                Download

                memory/5464-114-0x0000000000810000-0x0000000000870000-memory.dmp
                Download

                memory/5464-121-0x0000000000810000-0x0000000000870000-memory.dmp
                Download

                memory/5464-120-0x0000000140000000-0x000000014027D000-memory.dmp
                Download

                memory/5464-314-0x0000000140000000-0x000000014027D000-memory.dmp
                Download

                memory/5684-33-0x0000000140000000-0x00000001402D4000-memory.dmp
                Download

                memory/5684-35-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/5684-27-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/5684-34-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/5684-125-0x0000000140000000-0x00000001402D4000-memory.dmp
                Download

                memory/5752-0-0x0000000000400000-0x00000000006A1000-memory.dmp
                Download

                memory/5752-87-0x0000000000400000-0x00000000006A1000-memory.dmp
                Download

                memory/5752-7-0x00000000026C0000-0x0000000002727000-memory.dmp
                Download

                memory/5752-6-0x00000000026C0000-0x0000000002727000-memory.dmp
                Download

                memory/5752-1-0x00000000026C0000-0x0000000002727000-memory.dmp
                Download

                memory/5760-54-0x0000000140000000-0x000000014020E000-memory.dmp
                Download

                memory/5760-61-0x0000000000870000-0x00000000008D0000-memory.dmp
                Download

                memory/5760-55-0x0000000000870000-0x00000000008D0000-memory.dmp
                Download

                memory/5760-245-0x0000000140000000-0x000000014020E000-memory.dmp
                Download