Overview

overview

7

Static

static

3

2026-08-09...at.exe

windows10-2004-x64

7

2026-08-09...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    144s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 06:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_4ddbac6f848e2083e7193a9fce8e7d1a_amadey_elex_luca-stealer_mespinoza_njrat.exe
  • Size 1.7MB
  • Sample260809-hm8bvasfpe
  • SHA256 428c1b79ee9c32edc693956d0debc83c27ce8c471f16461c4db1203e6b444507
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryransomwarespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_4ddbac6f848e2083e7193a9fce8e7d1a_amadey_elex_luca-stealer_mespinoza_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_4ddbac6f848e2083e7193a9fce8e7d1a_amadey_elex_luca-stealer_mespinoza_njrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1468
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:1968
  • C:\Windows\System32\GameInputSvc.exe
    C:\Windows\System32\GameInputSvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Windows\System32\GameInputSvc.exe
      "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:1684
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:120
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1288
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:2692
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:5096
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:5656
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:2528
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4724
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1932
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:1376
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:3356
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:5860
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:2848
  • C:\Windows\system32\TieringEngineService.exe
    C:\Windows\system32\TieringEngineService.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:5852
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2936
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:3056
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4536
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3156
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    PID:2156
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:804
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:3384
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:1436
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 952 2876 2856 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:1184
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2904 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:4632
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
          PID:5724
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 952 2876 2856 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:1320
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2904 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
              PID:1808

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                • Size 2.7MB
                • SHA256 eb2c5613f1776dabf8790aaeee4172fb46ba87137ea363b2ae156e47f1c0a9fe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 849KB
                • SHA256 f61295b6630109d9081c4f0745ebb0bb26e253dfdce9df00dd3f931495e48256
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 1.1MB
                • SHA256 4cae622ae670d4890c2bf9af620c8e8f3b2a73e8c0d21e77d873143bd6d3ab5d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zFM.exe
                • Path C:\Program Files\7-Zip\7zFM.exe
                • Size 1.5MB
                • SHA256 11a2089e6762b0223f5a73331547c3a557864ba008a0446ec79214abe97e5095
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zG.exe
                • Path C:\Program Files\7-Zip\7zG.exe
                • Size 1.3MB
                • SHA256 913019553481fad7d818bb4f1217b997a6b9774e68c2f40db5abf2d0c2a70c09
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall.exe
                • Path C:\Program Files\7-Zip\Uninstall.exe
                • Size 603KB
                • SHA256 da90910a0024a4121caaf9a50b824b510ae3da2f5bc69d9cc37edf7403f9125b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 863KB
                • SHA256 0a15b65c66b47ac075bc66d58650b75b7231c16e51d813b23ed7e7b54cc16b5c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 4.7MB
                • SHA256 ddf7f61398074c0d5a3e670540a82dc0859389b647e01d0ba80feea6a5daace5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 932KB
                • SHA256 7d09b74e4380543dd506a3f5eb923c13565f228b754ff73618108b72fe9bb4b2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 17.4MB
                • SHA256 63fbfbcb09ee9fc2ac97060388ff79385fa7c6ce297d2a0b2fc50610468fee65
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 2.7MB
                • SHA256 22c48362bee839c6d7fdc21e96840403301930b57e1a635276176a53a42f6bff
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICLUA.EXE
                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                • Size 1.1MB
                • SHA256 f221e2c7ad4ab986932c203228605ad9893ccaeec84c971c6e22332843e3a2ac
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 829KB
                • SHA256 bc5ae2b65429da454b194c36fd5b819a2dac3024a0d34c5da03e0ee98e4a597b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 679KB
                • SHA256 abce412ad250a1b82b04f9211fab8cd20a667f7a1fad1133820097459e394789
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 6.6MB
                • SHA256 1e665fe2fd51044244ac83a5e29c1ba7419f71c104d9a7a100183dec5b686c93
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                • Size 6.6MB
                • SHA256 71b0e9da3330cc0041aca74e4d4629dff5a2ac5b5d0fc30d57772d761f1e6bee
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 2.3MB
                • SHA256 deffce263fa9e9f161932a2a92789f976225590b5f5eaedaeb8425329ca213f3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 4.0MB
                • SHA256 e60a630d649987cad54b0990a332ceb237377adbb4f4ec4bc7a8e5befc779d9f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 2.8MB
                • SHA256 b79db79f2a8e3f251e87b95ade82cd6a4da45057fcd18db7e8ed84aed0d37568
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 2.2MB
                • SHA256 57b5062a6eae4ac1a67b0248cc195efb30dc5189ea65a517b6f449d63f444d02
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                os_update_handler.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                • Size 2.4MB
                • SHA256 9c3f8c8ae8a773d5642bb06de0df6cb9c063c2464e2d4222722cdd1cfcb52b20
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_proxy.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                • Size 2.0MB
                • SHA256 9361a8898ae7fea6b596ec92cf7647d25f25ce6bd37df6b144bb8bc3de30814d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 602KB
                • SHA256 6b062caf8af0da4ff59cb18eb30223c81ca3fc7dceb4ed023e326fc0137b94de
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 602KB
                • SHA256 fb96235901088cc8a198a95177d2b6958ff12c28b1a0f729db5b0eea2fa0615b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 602KB
                • SHA256 33cb501a39699980df33af65cfb05c425ee34e10784da02ab8bc35f95985d295
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jabswitch.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                • Size 623KB
                • SHA256 43262e848a4552a2966e81190a17e7abe8fdecba091ac3546185be2f9cb19448
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 602KB
                • SHA256 6927f344def24e9bdb9e35b379ed7bdad812b5369c63c840c04b36783d059ba5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jarsigner.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                • Size 602KB
                • SHA256 9d33555bff4ee716486f5509ea1cb16b14a23da5969bb3cc27f9e391a75465b7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java-rmi.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                • Size 602KB
                • SHA256 d29b6727d3a30baa2410d043717968d096ee8cc0130fa5f8213f198892332b09
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                • Size 864KB
                • SHA256 9e91bfbc3cead23056169eb887fbd0b1e3e1ee11f200b73cbdbcdf0db9513a0e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javac.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                • Size 602KB
                • SHA256 c9e60469ff485cdea78463400e73e7815bb4bc466b4a34610f70d098e911420e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javadoc.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                • Size 602KB
                • SHA256 5a20e732b18279ba91674deff71ef49d928119d37df78d357beff79c291bd92b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MsSense.exe
                • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                • Size 1.1MB
                • SHA256 6b50b6cbb95a670039ada9dad47659275975dfdf7b498d38dca9f1be2e0d627a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                NisSrv.exe
                • Path C:\Program Files\Windows Defender\NisSrv.exe
                • Size 3.6MB
                • SHA256 c2208f4306477eed29ede1923c009bb4edb209c424006ed454312305a9d7f76e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wmpnetwk.exe
                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                • Size 1.5MB
                • SHA256 5f46769b04bb924be8907e70b8553f2d5943e65b155646963c0c9dd5aec2268f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 722KB
                • SHA256 5608d5bec06cbbef08c10657e8018e7a3fa0b5d2f4095b46178ff80bab6c867f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 610KB
                • SHA256 b9bc6a7e2fbc89b53f835c013c924e6897d54bd64b57b0fc1b5cf8ceb7dbb075
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\System32\AgentService.exe
                • Size 1.4MB
                • SHA256 44728778fed9a98a23e04bfbebad4c25038f14cc21d37dfea5832f9d51a6aa56
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GameInputSvc.exe
                • Path C:\Windows\System32\GameInputSvc.exe
                • Size 664KB
                • SHA256 5e2787e36d73c1becd571a2585ad5c6d0cf021954238488ebf34907d921cc9a9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Locator.exe
                • Path C:\Windows\System32\Locator.exe
                • Size 628KB
                • SHA256 a302c62745975b1a4441a33d4c3a6974e664173972fc665ca38d897e1c37eb01
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 1.1MB
                • SHA256 ea2b58aa0c09f640e501d8e965205a4acd33db3fe8f69aa27297ff0cb18abaed
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 832KB
                • SHA256 56e6278f49ef95b445618e5f5342a2470829e05bbc42010a10667b2d91fc2f29
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ReFsDedupSvc.exe
                • Path C:\Windows\System32\ReFsDedupSvc.exe
                • Size 2.7MB
                • SHA256 33f9e03275da9be103622f95884666c367c9fb30bf4e6e4c0c93248701aff07d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.5MB
                • SHA256 d28306fdf8e59766dd1f6f18eeb9bf7eff958c8c94f65e04a644eb77ae44b931
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.7MB
                • SHA256 48e1e520f16d68a15c7e79b427535b544a17168db1b66d38057398e30c1f6614
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TieringEngineService.exe
                • Path C:\Windows\System32\TieringEngineService.exe
                • Size 936KB
                • SHA256 94005720f533c01d38e21616a1d611b7770abbc07cc41d395ffb66ec0dec62d8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSSVC.exe
                • Path C:\Windows\System32\VSSVC.exe
                • Size 2.0MB
                • SHA256 f207fa03b988ae106d23c0ced207e9132ccc5189d858184ce1b5ac77b8f30544
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                alg.exe
                • Path C:\Windows\System32\alg.exe
                • Size 780KB
                • SHA256 9bc4e3527d6533f50a5b6cf37667bc4410296d0c20e0c8327502b61b5bdee09f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msdtc.exe
                • Path C:\Windows\System32\msdtc.exe
                • Size 764KB
                • SHA256 cf142243ad185ebc82cb22a5f0b44f50a67622f8486e06d63db2c618244ee53a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                snmptrap.exe
                • Path C:\Windows\System32\snmptrap.exe
                • Size 636KB
                • SHA256 865e2dc24304b4ad244e8d0873c03d8110b7edb57da28f3b9575af97c25a1497
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vds.exe
                • Path C:\Windows\System32\vds.exe
                • Size 1.2MB
                • SHA256 568c7ee24c305ec7909681dbde95c81d07f788a9c6a19490596e04b43d6f5e6d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WmiApSrv.exe
                • Path C:\Windows\System32\wbem\WmiApSrv.exe
                • Size 796KB
                • SHA256 7f80d5321fd84e7e1e8754e35226b0dc3768cfbd1150a8666e66f065abb47608
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wbengine.exe
                • Path C:\Windows\System32\wbengine.exe
                • Size 2.1MB
                • SHA256 6f934dfc587d04f29b52f8020a7f7191e44e00873dd6191403ce6ffb72e8f3b9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVClient.exe
                • Path C:\Windows\system32\AppVClient.exe
                • Size 1.3MB
                • SHA256 83e18ef15c294972314a36f5c09371b994213ead814b6aa1628202f27d582305
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SgrmBroker.exe
                • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                • Size 992KB
                • SHA256 a8b35f48d712e4dc03c94013823eca478f9649a367e9d89405a7e0ad242c12c0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msiexec.exe
                • Path C:\Windows\system32\msiexec.exe
                • Size 772KB
                • SHA256 b59d56ebda81360268aa95e2ba87d34b56b0de7390e2ad4f9d1d3fcd4a2035a5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/120-43-0x0000019E5A440000-0x0000019E5A588000-memory.dmp
                Download

                memory/120-44-0x0000019E5A590000-0x0000019E5A5F6000-memory.dmp
                Download

                memory/120-45-0x0000019E5A590000-0x0000019E5A5F6000-memory.dmp
                Download

                memory/804-221-0x00007FF7F3E80000-0x00007FF7F41BF000-memory.dmp
                Download

                memory/804-219-0x0000021F5FDF0000-0x0000021F5FE56000-memory.dmp
                Download

                memory/804-222-0x0000021F5FDF0000-0x0000021F5FE56000-memory.dmp
                Download

                memory/804-248-0x00007FF7F3E80000-0x00007FF7F41BF000-memory.dmp
                Download

                memory/1288-51-0x000002ADDA370000-0x000002ADDA4B8000-memory.dmp
                Download

                memory/1288-52-0x000002ADDA5E0000-0x000002ADDA646000-memory.dmp
                Download

                memory/1288-53-0x000002ADDA5E0000-0x000002ADDA646000-memory.dmp
                Download

                memory/1376-198-0x00007FF79B7A0000-0x00007FF79B84E000-memory.dmp
                Download

                memory/1376-125-0x0000025BC7300000-0x0000025BC7366000-memory.dmp
                Download

                memory/1376-124-0x0000025BC7300000-0x0000025BC7366000-memory.dmp
                Download

                memory/1376-123-0x00007FF79B7A0000-0x00007FF79B84E000-memory.dmp
                Download

                memory/1468-1-0x0000000002D00000-0x0000000002D69000-memory.dmp
                Download

                memory/1468-6-0x0000000002D00000-0x0000000002D69000-memory.dmp
                Download

                memory/1468-0-0x0000000002BA0000-0x0000000002CAB000-memory.dmp
                Download

                memory/1684-114-0x00007FF6D97B0000-0x00007FF6D9879000-memory.dmp
                Download

                memory/1684-34-0x000001F6ADB00000-0x000001F6ADB66000-memory.dmp
                Download

                memory/1684-35-0x00007FF6D97B0000-0x00007FF6D9879000-memory.dmp
                Download

                memory/1684-37-0x000001F6ADB00000-0x000001F6ADB66000-memory.dmp
                Download

                memory/1684-36-0x000001F6ADB00000-0x000001F6ADB66000-memory.dmp
                Download

                memory/1932-259-0x00007FF62B470000-0x00007FF62BBB4000-memory.dmp
                Download

                memory/1932-121-0x00007FF62B470000-0x00007FF62BBB4000-memory.dmp
                Download

                memory/1932-195-0x00007FF62B470000-0x00007FF62BBB4000-memory.dmp
                Download

                memory/1932-115-0x000001CF760F0000-0x000001CF76156000-memory.dmp
                Download

                memory/1932-257-0x000001CF760F0000-0x000001CF76156000-memory.dmp
                Download

                memory/1932-116-0x000001CF760F0000-0x000001CF76156000-memory.dmp
                Download

                memory/1968-16-0x00000278DEAD0000-0x00000278DEB36000-memory.dmp
                Download

                memory/1968-17-0x00000278DEAD0000-0x00000278DEB36000-memory.dmp
                Download

                memory/1968-14-0x00007FF691620000-0x00007FF691743000-memory.dmp
                Download

                memory/1968-15-0x00000278DEAD0000-0x00000278DEB36000-memory.dmp
                Download

                memory/1968-91-0x00007FF691620000-0x00007FF691743000-memory.dmp
                Download

                memory/2156-209-0x000002BCDC400000-0x000002BCDC466000-memory.dmp
                Download

                memory/2156-211-0x000002BCDC400000-0x000002BCDC466000-memory.dmp
                Download

                memory/2156-210-0x00007FF7B47D0000-0x00007FF7B48FF000-memory.dmp
                Download

                memory/2156-247-0x00007FF7B47D0000-0x00007FF7B48FF000-memory.dmp
                Download

                memory/2528-168-0x00007FF7B7960000-0x00007FF7B7AAA000-memory.dmp
                Download

                memory/2528-95-0x0000020BBA150000-0x0000020BBA1B6000-memory.dmp
                Download

                memory/2528-94-0x0000020BBA150000-0x0000020BBA1B6000-memory.dmp
                Download

                memory/2528-93-0x00007FF7B7960000-0x00007FF7B7AAA000-memory.dmp
                Download

                memory/2692-61-0x000001D6F63A0000-0x000001D6F6406000-memory.dmp
                Download

                memory/2692-69-0x00007FF6769F0000-0x00007FF676B58000-memory.dmp
                Download

                memory/2692-59-0x00007FF6769F0000-0x00007FF676B58000-memory.dmp
                Download

                memory/2692-60-0x000001D6F63A0000-0x000001D6F6406000-memory.dmp
                Download

                memory/2692-66-0x000001D6F63A0000-0x000001D6F6406000-memory.dmp
                Download

                memory/2848-152-0x000001CE4C8B0000-0x000001CE4C916000-memory.dmp
                Download

                memory/2848-151-0x00007FF6A7800000-0x00007FF6A7AA3000-memory.dmp
                Download

                memory/2848-153-0x000001CE4C8B0000-0x000001CE4C916000-memory.dmp
                Download

                memory/2848-220-0x00007FF6A7800000-0x00007FF6A7AA3000-memory.dmp
                Download

                memory/2936-170-0x000002BE38650000-0x000002BE386B6000-memory.dmp
                Download

                memory/2936-171-0x000002BE38650000-0x000002BE386B6000-memory.dmp
                Download

                memory/2936-177-0x00007FF6ED450000-0x00007FF6ED771000-memory.dmp
                Download

                memory/2936-175-0x000002BE38650000-0x000002BE386B6000-memory.dmp
                Download

                memory/2936-169-0x00007FF6ED450000-0x00007FF6ED771000-memory.dmp
                Download

                memory/2948-111-0x00007FF6D97B0000-0x00007FF6D9879000-memory.dmp
                Download

                memory/2948-25-0x00007FF6D97B0000-0x00007FF6D9879000-memory.dmp
                Download

                memory/2948-26-0x00000265DF820000-0x00000265DF886000-memory.dmp
                Download

                memory/2948-28-0x00000265DF820000-0x00000265DF886000-memory.dmp
                Download

                memory/2948-27-0x00000265DF820000-0x00000265DF886000-memory.dmp
                Download

                memory/3056-242-0x00007FF7AEDD0000-0x00007FF7AF05B000-memory.dmp
                Download

                memory/3056-186-0x00007FF7AEDD0000-0x00007FF7AF05B000-memory.dmp
                Download

                memory/3056-182-0x000001EA303F0000-0x000001EA30456000-memory.dmp
                Download

                memory/3056-181-0x000001EA303F0000-0x000001EA30456000-memory.dmp
                Download

                memory/3156-246-0x00007FF6E04A0000-0x00007FF6E09A7000-memory.dmp
                Download

                memory/3156-200-0x0000026D13AA0000-0x0000026D13B06000-memory.dmp
                Download

                memory/3156-204-0x00007FF6E04A0000-0x00007FF6E09A7000-memory.dmp
                Download

                memory/3156-199-0x0000026D13AA0000-0x0000026D13B06000-memory.dmp
                Download

                memory/3356-239-0x00007FF78C0E0000-0x00007FF78C4F7000-memory.dmp
                Download

                memory/3356-237-0x000001CA8E000000-0x000001CA8E066000-memory.dmp
                Download

                memory/3356-208-0x00007FF78C0E0000-0x00007FF78C4F7000-memory.dmp
                Download

                memory/3356-132-0x00007FF78C0E0000-0x00007FF78C4F7000-memory.dmp
                Download

                memory/3356-133-0x000001CA8E000000-0x000001CA8E066000-memory.dmp
                Download

                memory/3356-134-0x000001CA8E000000-0x000001CA8E066000-memory.dmp
                Download

                memory/4536-189-0x00007FF754B40000-0x00007FF755011000-memory.dmp
                Download

                memory/4536-190-0x000001F8C37D0000-0x000001F8C3836000-memory.dmp
                Download

                memory/4536-191-0x000001F8C37D0000-0x000001F8C3836000-memory.dmp
                Download

                memory/4536-243-0x00007FF754B40000-0x00007FF755011000-memory.dmp
                Download

                memory/4632-363-0x0000020EA5830000-0x0000020EA59FA000-memory.dmp
                Download

                memory/4724-180-0x0000000000400000-0x00000000004AE000-memory.dmp
                Download

                memory/4724-101-0x0000000000400000-0x00000000004AE000-memory.dmp
                Download

                memory/4724-107-0x00000000009A0000-0x0000000000A09000-memory.dmp
                Download

                memory/4724-102-0x00000000009A0000-0x0000000000A09000-memory.dmp
                Download

                memory/5096-73-0x000001D947630000-0x000001D947696000-memory.dmp
                Download

                memory/5096-159-0x00007FF624750000-0x00007FF62486A000-memory.dmp
                Download

                memory/5096-71-0x00007FF624750000-0x00007FF62486A000-memory.dmp
                Download

                memory/5096-72-0x000001D947630000-0x000001D947696000-memory.dmp
                Download

                memory/5656-85-0x00000164A6E80000-0x00000164A6EE6000-memory.dmp
                Download

                memory/5656-84-0x00000164A6E80000-0x00000164A6EE6000-memory.dmp
                Download

                memory/5656-83-0x00000164A6C00000-0x00000164A6D48000-memory.dmp
                Download

                memory/5852-161-0x000001B71AC10000-0x000001B71AC76000-memory.dmp
                Download

                memory/5852-234-0x00007FF65C720000-0x00007FF65C8B5000-memory.dmp
                Download

                memory/5852-162-0x000001B71AC10000-0x000001B71AC76000-memory.dmp
                Download

                memory/5852-160-0x00007FF65C720000-0x00007FF65C8B5000-memory.dmp
                Download

                memory/5860-216-0x00007FF795500000-0x00007FF7955B4000-memory.dmp
                Download

                memory/5860-141-0x00007FF795500000-0x00007FF7955B4000-memory.dmp
                Download

                memory/5860-143-0x0000022452640000-0x00000224526A6000-memory.dmp
                Download

                memory/5860-142-0x0000022452640000-0x00000224526A6000-memory.dmp
                Download