Overview

overview

10

Static

static

10

2026-07-16...ar.exe

windows10-2004-x64

9

2026-07-16...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/07/2026, 16:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-16_c35dccb72cfa8b62aa701e56886ac875_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 1.6MB
  • Sample260716-thqrsagy2k
  • SHA256 e54ec1569eb839c99e7fe67d87c16a6e26fe21247b4e0a9c93b1a64d947143b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 2 IoCs
  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-16_c35dccb72cfa8b62aa701e56886ac875_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-16_c35dccb72cfa8b62aa701e56886ac875_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:908
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3548
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4064
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:4788
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:3532
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:2972
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    PID:5976
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:4480
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:2540
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:2440
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:260
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:472
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:944
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:3444
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:4796
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:5032
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:628
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:5900

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 409ddf1b79ac9c384ae8815323d501b73e92b6b3b5c524e75c92f7e32d6cfa85
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.4MB
              • SHA256 fe7079d9326d5fe4b00e7194a7b1b1da78f419741c1f556aa509fd69dbfff090
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.7MB
              • SHA256 f1afd84926df53beea914701a06049c7d6f3631e7107293f44f6be11868465e9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 b924ad950a0159549a5fb8b27c67045998ed22c5bb5bea671ef66859d8a1fbf1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 780267f8aa528ac5e615a9a995d74acf83fc83056aad0adaeb8d07202f4c30f7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.2MB
              • SHA256 931634dc378a40f562f63ed74d2d958d486769ba0f6fc6f0a46cb504cb56942b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.4MB
              • SHA256 7d7fbc0a6bd5c88da66dca80dda13871c5be4b12aa0f73772c869d8e4bf1bac1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 50ea59a43054d160d3ecec44b9b8063557303276c1b4c4397d74566c6cef2f24
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.5MB
              • SHA256 b64e7f1540d93ad7cf72c83784b621dcc28a5420880deb7bf96b91401bb24066
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 cfbbb48072852ce15c711433eb9a427147a7a8456ee2f52b0a6f6a8a6e6bf1f8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 e90ed02de2145e08efdf2be5d9e60e037c3bdeb968e305f07a0a4848dbd2a759
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 dc20e284b77545fed8a43a52c75c13d0061cd56fae2f45594fa43773cdae5ca8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.4MB
              • SHA256 0606dfb4af4f85c4bf7cf99424b5f878b3219e37b1dd4e9b5fdeadb4aacc6539
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.3MB
              • SHA256 adc4f98a5c76f29fca462322ac4fbfdce7fcd8cf9cbef8afa2a2328ff57caa9f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 690531eab8011f11d43aafc8d92fb7233179caaffd81d95d649c42f71878a496
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 6.6MB
              • SHA256 1ca75bfa1becf58e60033f892e0c435d771e6afcdf1974a8c3eaa5292644f179
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 e22200a0bb9cb7b3f004c5f38c189532ad26f1aadb6c977f0f0849cd60ed2b1c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 5276ced100c399471d01f4ecdf277260389cf654f6572565e26dce4f4d3c15fa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 0a444c7e00edd3ffe16af4be2c65415e87c561d5bb0c75db572eee5c91654b8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 2.2MB
              • SHA256 6e6d05d9304a7ef0e7c7e32982ebd8039d3eb44e304d809f0553fe5bc2baef4f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 2.4MB
              • SHA256 0d2e165b6f7ee0dda8c2305c7607386a05a3df69bfda80fa74bc772d6b8dd8d8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 2.0MB
              • SHA256 36deafeeed3811062aac1da9756e1e13afa11d0ccc80d584c8a6d8e70d9effaa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.2MB
              • SHA256 73a8f405e2ab7f97d8c6f625ca566fb910568267ce4de2dd8f700e59c00eae18
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.2MB
              • SHA256 263e48950837fcd87726e853c972c745b0d2a56fa0eabf29aa2e1cfd1c098c9b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.2MB
              • SHA256 a3570cd6cdd7c007d296605139d21733a302eaa7720ab92ebebb71dc13d7429d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.2MB
              • SHA256 580619c5346881f51bfb3986e3d4ec9c1d968586be8fff9653d4c604faad5492
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.2MB
              • SHA256 fa3ee73ecade4387b80c16e267d438d49b22c9c06aa75424dc9f47c8b01514c5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 1.2MB
              • SHA256 877be4b2bd57260089008f586aae90fa38f1acba28da7a276bd07b22d6699497
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 1.2MB
              • SHA256 c1070d08af9f4374468ed073afc91e07acc77b26186b8e13fbd436ee7eaac2a9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 1.4MB
              • SHA256 d8907d33419bdbcdc92feee119acce01172058252937007a6ad3bb2891b98b1b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 1.2MB
              • SHA256 de60ce8c4560d721e7dc58282376456bc41b58f5fe55eb243ed2482f37bc7fb5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 1.2MB
              • SHA256 b0ef0af7a7f46a092c4fdefc280a202900ec1966ddccdbfe297bb47ba5aba3e2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 1.3MB
              • SHA256 b7fa15628f7181a0f8bd6b5912b91bf0ff1dd81177588719f715b9705a148e0b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 1.2MB
              • SHA256 6a32b44b2084e40cbfde3c536b38dbb9158ab26fb7f5e40046614d8889dcad04
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 1.2MB
              • SHA256 71e59fd7414bcd1e1b4e7835ef9a19242d028dcfa73a59e15a3a863b0bb39759
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 1.3MB
              • SHA256 ca533323c2f56da3a81671d76ff4d9a4ef10eebc2584b950b38c126c2a3e9b6c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 1.4MB
              • SHA256 0e3b93215c66a361b453c18243c293cde5b49174cb98723bb4e201bf8cf0c5da
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
              • Size 1.6MB
              • SHA256 8094e323dd9470f9ad88f377241f3d1218f38f5cfbb309c1f65c573ac37f0533
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jcmd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
              • Size 1.2MB
              • SHA256 5c2211bf3c0c424873077e2851251f38eb04e96c0f2d738bb5f8cc06a47177d8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jconsole.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
              • Size 1.2MB
              • SHA256 923949096af25487f621332a43fc4b258dc441042df4bea4a1cb4a54a6278b56
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdb.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
              • Size 1.2MB
              • SHA256 5506eae364998d9a268385e5ad1d516160639fbfd983d5d26b0538e2cfc4c198
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdeps.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
              • Size 1.2MB
              • SHA256 ce333e0a4c20ad71f513caa1c5caaad86f5d8947b65a503ad6b89557bab1102f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jhat.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
              • Size 1.2MB
              • SHA256 e11dc35ab118d75a9c4ef97e7bd5ec99ec3f08b12946b2c17ca3da7cef1d1b07
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jinfo.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
              • Size 1.2MB
              • SHA256 20db85bd131cabf855c29c0efa013fe1f6a73d61396051ccd9fbf97e7842dc44
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jjs.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
              • Size 1.2MB
              • SHA256 63db14eb67dcbf5b52a4a77588bb5c41876028d1fa5c336de2f12696e45a27a2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MsSense.exe
              • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
              • Size 1.6MB
              • SHA256 e1e0a88b9912f6ae269a57dfd993402749acc1dc869154cf3ca16eb5cac99a0d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NisSrv.exe
              • Path C:\Program Files\Windows Defender\NisSrv.exe
              • Size 3.5MB
              • SHA256 0dbcd54e146bc71c96162cc779fe523598c3a358fbeff43ec9bef348766aa02c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.4MB
              • SHA256 2c160d442f407c7e8f97501f7fbeeb2ec2cebacb316036f56a8c334775f7af8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.3MB
              • SHA256 8cc6106a8286a5d54ae59d1136db08871dbf5925b7072f29b671328091967a06
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Windows.db
              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
              • Size 1.2MB
              • SHA256 b622061f40b42b00a9860929993a051d9b1d9b8ae243c7faa3686513474a31c9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Windows.db-wal
              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
              • Size 1.4MB
              • SHA256 34be23132bc9d0a4e04896a4ca5b85a759b0847dbe74d8c7425ea50c51581001
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.2MB
              • SHA256 68b28a1728fa0a54dd642a86759c69a27d265e3bd6ad355c9e35d0ca5d1543ee
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.4MB
              • SHA256 0ddc72326b127ff57905ef5da888f998d90352b1a2ba5b07c818a6078a1a9b92
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 1.7MB
              • SHA256 9bf12110ba76630bbbddea768b42ead5fb2a1b39eb650568d210f708b8400814
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ReFsDedupSvc.exe
              • Path C:\Windows\System32\ReFsDedupSvc.exe
              • Size 2.6MB
              • SHA256 ee9b7d415d1eca4554ed219707b31ec352b9a56b2b2222dee246138052736d78
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 eae66064f3907940eefee3d6f9435e47a7785f632c9b82f35fcfe01f050754fa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.7MB
              • SHA256 e250edc8b04c5156ed67a6917951eab7dcec5ed44c5908dc1a890dabe48b2125
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 b78993cf8101510b0c1ca755b9c042844e674161da01dbb5e80b5a7daea701da
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.4MB
              • SHA256 23fadc1310c452e4adbee9ea385e61b0aab69021caa543c39fa5dcc1c20beb3b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
              • Size 1.6MB
              • SHA256 e7d7aa6bb3c4e3ac526ec162bf2ffcc05806064a8fd26e3267362b06d036cd22
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/260-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp
              Download

              memory/260-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp
              Download

              memory/260-135-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/260-122-0x0000000000C90000-0x0000000000CF0000-memory.dmp
              Download

              memory/260-120-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/908-81-0x0000000140000000-0x0000000140194000-memory.dmp
              Download

              memory/908-0-0x0000000140000000-0x0000000140194000-memory.dmp
              Download

              memory/908-9-0x0000000000E70000-0x0000000000ED0000-memory.dmp
              Download

              memory/908-1-0x0000000000E70000-0x0000000000ED0000-memory.dmp
              Download

              memory/2160-138-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/2160-137-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/2160-144-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/2160-311-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/2440-115-0x00000000007C0000-0x0000000000820000-memory.dmp
              Download

              memory/2440-307-0x0000000140000000-0x00000001401DD000-memory.dmp
              Download

              memory/2440-107-0x0000000140000000-0x00000001401DD000-memory.dmp
              Download

              memory/2440-109-0x00000000007C0000-0x0000000000820000-memory.dmp
              Download

              memory/2540-308-0x0000000000730000-0x0000000000790000-memory.dmp
              Download

              memory/2540-94-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/2540-306-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/2540-101-0x0000000000730000-0x0000000000790000-memory.dmp
              Download

              memory/2540-310-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/2540-95-0x0000000000730000-0x0000000000790000-memory.dmp
              Download

              memory/2972-74-0x0000000000C40000-0x0000000000CA0000-memory.dmp
              Download

              memory/2972-289-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/2972-66-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/2972-68-0x0000000000C40000-0x0000000000CA0000-memory.dmp
              Download

              memory/3532-272-0x0000000140000000-0x000000014016E000-memory.dmp
              Download

              memory/3532-61-0x0000000000860000-0x00000000008C0000-memory.dmp
              Download

              memory/3532-55-0x0000000000860000-0x00000000008C0000-memory.dmp
              Download

              memory/3532-54-0x0000000140000000-0x000000014016E000-memory.dmp
              Download

              memory/3548-14-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/3548-106-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/3548-15-0x0000000000E20000-0x0000000000E80000-memory.dmp
              Download

              memory/3548-21-0x0000000000E20000-0x0000000000E80000-memory.dmp
              Download

              memory/4064-31-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/4064-119-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/4064-28-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/4064-35-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/4064-36-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/4480-89-0x0000000000560000-0x00000000005C0000-memory.dmp
              Download

              memory/4480-82-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/4480-305-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/4480-322-0x0000000000560000-0x00000000005C0000-memory.dmp
              Download

              memory/4480-324-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/4480-83-0x0000000000560000-0x00000000005C0000-memory.dmp
              Download

              memory/4788-41-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/4788-40-0x0000000140000000-0x0000000140174000-memory.dmp
              Download

              memory/4788-47-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/4788-63-0x0000000140000000-0x0000000140174000-memory.dmp
              Download

              memory/4788-51-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/5976-304-0x0000000000400000-0x0000000000535000-memory.dmp
              Download

              memory/5976-78-0x0000000000400000-0x0000000000535000-memory.dmp
              Download