Overview

overview

7

Static

static

3

2026-07-12...uk.exe

windows10-2004-x64

7

2026-07-12...uk.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 17:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_49a9c5133a427b5b863b506e6eb9bfe6_cryptbot_icedid_mespinoza_njrat_ryuk.exe
  • Size 3.0MB
  • Sample260712-vs1keaf16x
  • SHA256 f1b9679fc73edbabf939024f4051a1bfbcda1d858721e99e4a065c47a190c918
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 11 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_49a9c5133a427b5b863b506e6eb9bfe6_cryptbot_icedid_mespinoza_njrat_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_49a9c5133a427b5b863b506e6eb9bfe6_cryptbot_icedid_mespinoza_njrat_ryuk.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5724
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2332
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1700
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:3236
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:5616
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:5648
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2024
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:2388
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:5660
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:4396
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1348
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:616
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:6072
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 948 3052 3048 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:3448
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 948 3016 3020 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:5132
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:1696
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 948 3052 3048 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:1984
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 948 3016 3020 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:4936

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 fdf7290c7f96faf22517dc10579c38de1b9218e032053973ef0cfa3834a30ba7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.5MB
              • SHA256 c40136f245cf603b3e67f5d0830a1c85b4328e4f51c856e244bcbe7e7a9d5628
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.8MB
              • SHA256 c270783fb8c50cbf034893b8c5d390314cd45537694bc764d3579db979517cca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 bae7f56612d94050f3b6bacb659b7a975a143fd7778f5fd1fcc0db4883346eca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 033b74a7cbcba2e439a9cd46ac96aaa1e6781d95826c7516b894c37fc5611a5d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.2MB
              • SHA256 58af71ae815256514dc3e7b65485bdf1f0d99ad75114a50a61de2fb303b829ba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.5MB
              • SHA256 092a61eba89d87cbda4f907fa3c08f860bdbde922aacc851b372eca03983a5a4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 e1b032fe8d4b0c873f34c682357ec97ba9adc7c83139f365dd436c0805e6943e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.6MB
              • SHA256 40b1318ea83f8012d901b40ef04dd27cf4bd8681e361da95c5784b2ac370f1d6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 331ffecabf4483ea6d568f000097378f93774f2626ed25913142897b211ee660
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 b690a2cfb42f26096929e58c53a42e22fc991d37a9fe7f5ee70adf7e88ce3be1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 4e534267d3f12007ecc5453833e221713349cccf5b54ec53ee0cace82aaebe29
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.5MB
              • SHA256 24239645729929096e60e50b6ca4fc938d52a9481a8b895f5a430d42f68a00f5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.3MB
              • SHA256 9e4ea6a34fd6d5c29c409e10dcd0060371d0346c84eb309d0495174219fbe5aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 6fc2f7fd916cc06a0f488342d158ff67cd9567c4afd2fdf5c066c58e6f347b4f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 6.6MB
              • SHA256 5176f72e00b51074de01333cd0152ca57c7468a4af7af491ddb8c99a0ed5e18a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 ced76420d885ca071a07fa3dd3df5d58ee835e12286bae47b778f659d3b37e46
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 a92c685249ec0484c44c84e99340fa76d1bcafb8b93090d7b2b3c2f48d446054
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 2d3966f8cd399b5c0a13a9b9127a77d111c78aee9f0f8e7a194810e0d2b3236a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 2.2MB
              • SHA256 792b03a89cb5637d33c2bd2ae43218ff22909dd4929183b69f6b60adc25a9a15
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 2.4MB
              • SHA256 af864f3303142624bea67f0a1373e938d8a08dd8090f7cf0cec7fa7a3fa7f0dd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 2.0MB
              • SHA256 55df1144f2e9eff92cf05788ff76ca71c62a0d15c7495814ba5355afc11d1709
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.2MB
              • SHA256 360d1e8cd57dec432e48d575eaf455174265350c7df8d3af14144eef9d62c873
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.2MB
              • SHA256 2ec37008ea6763543332841ed33644498557ba035485eca388efe94a1084cb50
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.2MB
              • SHA256 42b11d30c0efb9308fdfbb6e8f4373681561f6b8c4019a61fccb40a0a054bf4b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.3MB
              • SHA256 fd97dde7aba4931e14702f8c3142e0288cb703b8b27ea506b141dc75e0af356a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.2MB
              • SHA256 38f0f0818fe8a90c7df63877f794c1838ff7157dfadc0c1526601ae7fdbf2a63
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 1.2MB
              • SHA256 7643fe76b3ed8ca8b9916c57ba74abc2be05097f1f8e81dc2b9a24a572df158e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 1.2MB
              • SHA256 156785a3228bfff36bfc95b5a39c3d13433346a15222b8b7b7ede5f8501dc06f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 1.5MB
              • SHA256 3d081a7e36497975ac4a8fea396f947826924a11ba4eba523c93cc5ef0d6a7a4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 1.2MB
              • SHA256 92b500157c3d0fbc5a724d1cc6013bf5efeba7389bb387d6541840b465c35946
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 1.2MB
              • SHA256 67fd25220d27cf50c516959ddead5065e8695d990c468f216aa9e05e3df6aa81
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 1.4MB
              • SHA256 899f2bdae87ad13fa01d05f6e8ffb873379485034a8dea35ca9a7107b9b8a45b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 1.2MB
              • SHA256 7a958712e91985d21d6d7690391bd81a31455e29aedb76973eea41ae91177d49
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 1.2MB
              • SHA256 4017c3ee3968c809c855308d323e829cb21eca50e0f0d99c6769a4b430ac88e9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 1.4MB
              • SHA256 ee043ab425077f5621732636d1f52c4f79f37cc18a3d7749738e399fc8992c84
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 1.5MB
              • SHA256 ddbc1dae7c2c9cca4108c4f736b6b774120eb1edb2e4d72bbfb6ce4d9cf65e76
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
              • Size 1.7MB
              • SHA256 543cad16aa9f29c68adf1602a75f5a2278118d57f9794bfac99683666192e001
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jcmd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
              • Size 1.2MB
              • SHA256 45304095f3b7c71877b039d21d158965a1fd479b7bcc84e9a5490f2996886bfb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jconsole.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
              • Size 1.2MB
              • SHA256 2c2f5bab3ab993aade6e772313824d15ae1905a5319a1583e5b96d0ee4fde379
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdb.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
              • Size 1.2MB
              • SHA256 8fc7a0556dece42b1a0d23c966b15cd234a91c1099dec62d3f0a8dc31ab4f0fa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdeps.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
              • Size 1.2MB
              • SHA256 c72583f1f586ee1d88860ce19d076a4df0450ca972e0e2a32360039827415e7e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jhat.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
              • Size 1.2MB
              • SHA256 9a5ad200cb6e2ef6827eea84b9eb44ef742464f1549ef477f4386439f7a207ed
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jinfo.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
              • Size 1.2MB
              • SHA256 7d0d6d7842bcc604ecfec1288018f390fa4e01b032aef29ebabb92aeef1d10b8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MsSense.exe
              • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
              • Size 1.7MB
              • SHA256 fa0caf1a193322166150c238d375476fd733455c8acbbdf1ab5ad6d4399c646e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NisSrv.exe
              • Path C:\Program Files\Windows Defender\NisSrv.exe
              • Size 3.5MB
              • SHA256 62abf2d5c9a331c6cc60e8f6595d4620a3248583265bfa821f179430fe83bdf4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.4MB
              • SHA256 0cec2175348cd456cb6566bbb62ca191894c90c0475bcabb1898fe2903522a55
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.4MB
              • SHA256 c4b76bf9d7fd8c0c935047fae68158c8b89b5478c6ec6e650803e818b3352f5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Windows.db
              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
              • Size 1.0MB
              • SHA256 2ace719013072e955785f49c61a102eb136ba7109eae9b007384695ea9ed6780
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Windows.db-wal
              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
              • Size 1.3MB
              • SHA256 ef40f46b614e1327b88784e55f993c035ff42f989d60a59e3e42265c7abb2260
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WinRAR.lnk
              • Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
              • Size 1KB
              • SHA256 af5eb7fed9081130223afe434fdc2ac3b20a13e741f5cb3bfc3b2bed12f6c09e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.2MB
              • SHA256 21e09ed7e448a419b8b37d762db5070d2053cbc319aa4e34a88bb8b3055be4d4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.4MB
              • SHA256 84d4813dc4c481e281bf5b3b5268aeaf5512b4ce72978a3494058069af5a4e38
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 1.8MB
              • SHA256 d96a24d14492b5e37656fe9bb36abda2c01101042cc98ac5bacf8d377dccc118
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ReFsDedupSvc.exe
              • Path C:\Windows\System32\ReFsDedupSvc.exe
              • Size 2.6MB
              • SHA256 43e5ba702fe17d77360b5398fd662b12c89c38be6f323b65f6a307a1089ea625
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 eeef2ad76c8e765ddbccbc5c68f4e96211387c37cbda9852858dfe54d4a32b45
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.7MB
              • SHA256 b8a461e965cfecb08b7f4835dd6de935a1a254b1b342c28ff2b76e47cb164696
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 f6f468fe07a5c8b92d165130d7b53283e20945025d753ee78922aa685747717d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.5MB
              • SHA256 0fde86e4d5573899ac7a7c8df5f6514919096edbba5312e8d866a8f3c2d1cf77
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
              • Size 1.6MB
              • SHA256 39a255d3f4847d628bf48bb1f9a753fea4e2a2a30ad4580727232370c491212c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1348-133-0x00000000008D0000-0x0000000000930000-memory.dmp
              Download

              memory/1348-126-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/1348-127-0x00000000008D0000-0x0000000000930000-memory.dmp
              Download

              memory/1348-138-0x00000000008D0000-0x0000000000930000-memory.dmp
              Download

              memory/1348-140-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/1700-28-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/1700-142-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/1700-34-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/1700-35-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/1700-27-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/2024-78-0x0000000000930000-0x0000000000996000-memory.dmp
              Download

              memory/2024-309-0x0000000000400000-0x0000000000542000-memory.dmp
              Download

              memory/2024-77-0x0000000000400000-0x0000000000542000-memory.dmp
              Download

              memory/2024-83-0x0000000000930000-0x0000000000996000-memory.dmp
              Download

              memory/2080-317-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/2080-150-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/2080-144-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/2080-143-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/2332-113-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/2332-22-0x00000000007B0000-0x0000000000810000-memory.dmp
              Download

              memory/2332-21-0x00000000007B0000-0x0000000000810000-memory.dmp
              Download

              memory/2332-15-0x00000000007B0000-0x0000000000810000-memory.dmp
              Download

              memory/2332-14-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/2388-95-0x00000000007D0000-0x0000000000830000-memory.dmp
              Download

              memory/2388-341-0x00000000007D0000-0x0000000000830000-memory.dmp
              Download

              memory/2388-89-0x00000000007D0000-0x0000000000830000-memory.dmp
              Download

              memory/2388-88-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/2388-343-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/2388-310-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/3236-50-0x0000000001AE0000-0x0000000001B40000-memory.dmp
              Download

              memory/3236-40-0x0000000001AE0000-0x0000000001B40000-memory.dmp
              Download

              memory/3236-46-0x0000000001AE0000-0x0000000001B40000-memory.dmp
              Download

              memory/3236-52-0x0000000140000000-0x0000000140180000-memory.dmp
              Download

              memory/3236-39-0x0000000140000000-0x0000000140180000-memory.dmp
              Download

              memory/4396-313-0x0000000140000000-0x00000001401E9000-memory.dmp
              Download

              memory/4396-114-0x0000000140000000-0x00000001401E9000-memory.dmp
              Download

              memory/4396-121-0x0000000000D10000-0x0000000000D70000-memory.dmp
              Download

              memory/4396-115-0x0000000000D10000-0x0000000000D70000-memory.dmp
              Download

              memory/5616-268-0x0000000140000000-0x000000014017A000-memory.dmp
              Download

              memory/5616-61-0x0000000000870000-0x00000000008D0000-memory.dmp
              Download

              memory/5616-54-0x0000000140000000-0x000000014017A000-memory.dmp
              Download

              memory/5616-55-0x0000000000870000-0x00000000008D0000-memory.dmp
              Download

              memory/5648-67-0x0000000000CC0000-0x0000000000D20000-memory.dmp
              Download

              memory/5648-73-0x0000000000CC0000-0x0000000000D20000-memory.dmp
              Download

              memory/5648-294-0x0000000140000000-0x0000000140176000-memory.dmp
              Download

              memory/5648-65-0x0000000140000000-0x0000000140176000-memory.dmp
              Download

              memory/5660-100-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/5660-107-0x00000000006B0000-0x0000000000710000-memory.dmp
              Download

              memory/5660-101-0x00000000006B0000-0x0000000000710000-memory.dmp
              Download

              memory/5660-312-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/5660-316-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/5660-314-0x00000000006B0000-0x0000000000710000-memory.dmp
              Download

              memory/5724-0-0x0000000140000000-0x000000014039B000-memory.dmp
              Download

              memory/5724-87-0x0000000140000000-0x000000014039B000-memory.dmp
              Download

              memory/5724-1-0x00000000021A0000-0x0000000002200000-memory.dmp
              Download

              memory/5724-7-0x00000000021A0000-0x0000000002200000-memory.dmp
              Download