Overview

overview

7

Static

static

3

2026-08-09...ar.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 10:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_4310d1f872f354d1eb6347f3021892b8_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 5.0MB
  • Sample260809-madc6adm5t
  • SHA256 c48e31c25f86f891abecce9d3ce75e2c86240ce20c482b126177b2b16c4ae2fe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryransomwarespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_4310d1f872f354d1eb6347f3021892b8_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_4310d1f872f354d1eb6347f3021892b8_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_4310d1f872f354d1eb6347f3021892b8_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-09_4310d1f872f354d1eb6347f3021892b8_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Chromium\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=131.0.6743.0 --initial-client-data=0x2b0,0x2b4,0x2b8,0x284,0x2bc,0x14040a9f8,0x14040aa08,0x14040aa18
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4256
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2356
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:6128
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:5568
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:5664
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5784
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5844
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:5888
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:6048
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3336
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:1312
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2308
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:3800
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3344
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:1264
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1180
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:2112
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:3320
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:3740
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1028
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:312
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3908
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1924
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:468
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4232
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1872
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:2004

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 20d6ab0157eac5320f07b9c054e4791a937be83fdd7950166857f2a4cff8be60
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.7MB
            • SHA256 32745c4f344da533bcc32c77555200fe2bb59460957c709de64c2cb65fe6223f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 2.0MB
            • SHA256 73cddaeaf36bbeb8805ee7da679b39206b79da0341b510e68d102c106d215820
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 006b3db4077a82dbc74412811bbbd707e0e76cfa10d91f8e56bee9b390f19328
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 57d0a9083225a528a644d46e3144bbdcf2e8debe1688ebcee4edf2e9d0fb3420
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.4MB
            • SHA256 4fca6b283cf21eee1cf4f2f868d00e64ea9c54f482e61158a3cb2a06b135be09
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.7MB
            • SHA256 f31fed928b295d5306c38c9276201f79fd6b09a8a58c67c536a90d55126cf51d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 d2be81a9ca8e95a2e599074d1036aabc45d6bdc95f86ed4daea504f061e35eab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.8MB
            • SHA256 9475daa8026a042846727ab5feb9e7a701a675501a2bb06b6aa21a3cda0c302c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 ad6ecb4e26cad426bd8a6b926c795b5125f6316618dc74c16440d47554807430
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 2910a94031507bc86afc514c42a847378e41b4b560e98a694aca01d4f7d096fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 66b7ce6b0dd1276216b245ff673110658e43427e9b22c8f10c47aabb9557e25b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.7MB
            • SHA256 51f41904d7e5163085770f5aaa30ade9032d44c0699363eb91e83f1b19fd63ab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.5MB
            • SHA256 286eed1d663614a43420faf394c9b53ecf0b67d2a097bfdef49a215a93acd5e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
            • Size 6.6MB
            • SHA256 ba6373373e6b9c540eeca7553ab01d8f4cff65738ef8fca5f38ce6eebe32173f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
            • Size 6.6MB
            • SHA256 29d77336aaf8d3e6867e42109e4a2094f0e4fe63d55469a8431142a3d084af73
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 723975b2601e0c78fac8bae782cc78910b29be7502826a7f1e8dc8cdc3df56bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
            • Size 4.0MB
            • SHA256 586eeb1be0c1d7fb5d6480bde4243644156d72fb60be2cd60b118916d1bea7ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 e31d5dc463cd2786d10a9b2ce3a6933b9c78c3e885513b352c951a8379fba4b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
            • Size 2.2MB
            • SHA256 89eb1498739593b52400f3c8c93a77dca2735f142e993ccc42ace4c9d62160bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            os_update_handler.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
            • Size 2.4MB
            • SHA256 6466fda7bb9ae016ac50318cfe45a66b022f7c8c35a4f1c194a0739a9eecc136
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 2.0MB
            • SHA256 f00aa9d36964f80621ba8f2ab1b0364152a83c46a3177b7953ab4e321192279d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.4MB
            • SHA256 3f6b51936324438bd07507a4e7bd18621180b35a57ef008cef60fd8fcdce1c2d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.4MB
            • SHA256 0a92a6542df868ff561cb6cef387128ceb66dad84cfbf044b3942cedc5bab0b1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.4MB
            • SHA256 37dd0a5fc3a3c9af59454b89824804fb8628be901ac9084c9a05c2733e9a12e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.5MB
            • SHA256 590645888136e4456997c81421d844cf0a55d507e5c9428427c69f9668fb6eb7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.4MB
            • SHA256 a2f98d794b222efeefb7c54791d8172ecc01546680fefc937590506a2638f308
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.4MB
            • SHA256 6cea618c0d3d6bd3550dbdb54eb3e7fa1de2d19ba40294a40bdd04eee9828f25
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.4MB
            • SHA256 c6fe856c0d03d1f197edc699663e832feab70989e3937875ebb2680cc49e88bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.7MB
            • SHA256 dcfdb55aa4495368e16f3958e6657d43587c0cfc552e98a0c35f3c6921b7bc27
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.4MB
            • SHA256 eec0a7e8bee5db0958df583489afe8944b67994ec372c8f53152477866aa703f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.4MB
            • SHA256 146af8c8ac12f31615bd159d76debb9c3032b354385c52cd90876491967dfa1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.6MB
            • SHA256 23050981fcd6669cdda07f50e97b62e93e6f0e077e189228b7fac1cb08ab2f90
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.4MB
            • SHA256 e8af2a2bd6d91e6e223b277bf2f0e04e3feebe6237f384c9abca40cb6223da6f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.4MB
            • SHA256 94fb8a7f7a7c789bc965bfe9ac4d66daa64687b6bba88c4abed5fa1e7b1a7f14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 9a9ff3010a851c889f9a43fe99c30f4049ecfaea0022c4c8fd6a202f0e665534
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.6MB
            • SHA256 517ffaf06a088707d1739fdd3f49b15c699265276d845f109a5c47cff9e1531c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dd4cc28c5a3b5d25.bin
            • Path C:\Users\Admin\AppData\Roaming\dd4cc28c5a3b5d25.bin
            • Size 12KB
            • SHA256 f7eb2f32eaeca8e25bf9459bdffc1d6794e6701967cbd043d36f1a687607da70
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.4MB
            • SHA256 63bffc9784afbb5a8295b8028d2c73b326be36455e609aae16604c06e1b59ba6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 71c1c6b2c5d910dc5536ade333d7aaf0701df43aeaf68dc5ca0be4ff72d348e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.5MB
            • SHA256 591d02c2fb0dffcf7d16c364893bef4a55bd38218140f87019d76eb1d428b95e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 e41699a23f6176762b069ba0a5c97c9e35cff371c4c861af1898fd7bd97f6bd4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.4MB
            • SHA256 26741c64050fa8e0279c3151bdb706aa19670a2d907b401efe4485fbe393bd3c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.8MB
            • SHA256 79055f02cef0db59183cd2cc93b873073db03cd6c090def52af015259291b2bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.5MB
            • SHA256 28ecd057bc9a9d048a0bb4f791d3063b31c4dc6c30d832a9ed044252c00f77d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 5bd9f9dbf79666fdd3b2d0ee67ddcdb67cd0bf9bd9b4ace592c29a2a6856891d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 cefe2400157874ced2d4f6e51f584c9708a7def156f73918e4e5ec161096eee7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 42f60b1bdabbf0e3e3c780b4caef7a34efea86b1481dcc4fcc178c48a4a4fa88
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.7MB
            • SHA256 9ded8cab72e21eabc12745c211433071587fb52b190f7eda1884079e8676550b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 f10354bacd36856e878af7952395cf1a3453388c98598c618ab801716c1efe47
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.5MB
            • SHA256 aa75694defb5e577b3e68f92006671ff787c14e8d57791c4b9433a38796662d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.6MB
            • SHA256 e1fcdd16ee9c2cfb1681dcb3c1f511fa2c98dd055c567355e846769a244ea75b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.4MB
            • SHA256 065fdac399a71b65c50bc1af14ed062a90671eba5cf8d54d80f385398bfcd2b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 082cf40f1d9fce29fb2209dbc224d62cdc27745f52b3d0dab38cc053b2061f16
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.6MB
            • SHA256 ca8ebb6800b9493eb928f2a72e954748bb6b197863204756c13f2595b5cbf000
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 b58af8172fc6213da8d3df790d5141ad73301a5623b27a49dc3dd23aaf401b9b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 e753c6e6c8e88aedd3ce5f7c262674a9e71f2bade117b1882168409eccdd8250
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.7MB
            • SHA256 15815f6c2feae0cd07fdc0dc5e4ed2a723b5ccd2563663dbcb467acecdad8c5e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.5MB
            • SHA256 8eff21041dc16fad4b2a355cd5c64498b94c88883a4e5913e892d1c0a4c25fe5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/312-219-0x0000000000BC0000-0x0000000000C20000-memory.dmp
            Download

            memory/312-322-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/312-225-0x0000000000BC0000-0x0000000000C20000-memory.dmp
            Download

            memory/468-479-0x0000000140000000-0x00000001401A6000-memory.dmp
            Download

            memory/468-255-0x00000000006F0000-0x0000000000750000-memory.dmp
            Download

            memory/468-328-0x0000000140000000-0x00000001401A6000-memory.dmp
            Download

            memory/468-249-0x00000000006F0000-0x0000000000750000-memory.dmp
            Download

            memory/1028-212-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/1028-214-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/1028-217-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/1180-181-0x00000000006D0000-0x0000000000730000-memory.dmp
            Download

            memory/1180-175-0x00000000006D0000-0x0000000000730000-memory.dmp
            Download

            memory/1180-317-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1264-165-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/1264-171-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/1264-316-0x0000000140000000-0x0000000140176000-memory.dmp
            Download

            memory/1312-128-0x0000000000B60000-0x0000000000BC0000-memory.dmp
            Download

            memory/1312-122-0x0000000000B60000-0x0000000000BC0000-memory.dmp
            Download

            memory/1312-312-0x0000000140000000-0x000000014018B000-memory.dmp
            Download

            memory/1924-245-0x0000000000620000-0x0000000000680000-memory.dmp
            Download

            memory/1924-327-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/2004-489-0x00000204D2E60000-0x00000204D2E70000-memory.dmp
            Download

            memory/2004-490-0x00000204D2E60000-0x00000204D2E70000-memory.dmp
            Download

            memory/2004-484-0x00000204D2E60000-0x00000204D2E70000-memory.dmp
            Download

            memory/2004-485-0x00000204D2E60000-0x00000204D2E70000-memory.dmp
            Download

            memory/2004-493-0x00000204D2E60000-0x00000204D2E70000-memory.dmp
            Download

            memory/2004-492-0x00000204D2E60000-0x00000204D2E70000-memory.dmp
            Download

            memory/2004-491-0x00000204D2E60000-0x00000204D2E70000-memory.dmp
            Download

            memory/2004-483-0x00000204D2E60000-0x00000204D2E70000-memory.dmp
            Download

            memory/2004-488-0x00000204D2E60000-0x00000204D2E70000-memory.dmp
            Download

            memory/2004-487-0x00000204D2E60000-0x00000204D2E70000-memory.dmp
            Download

            memory/2004-486-0x00000204D2E60000-0x00000204D2E70000-memory.dmp
            Download

            memory/2112-320-0x0000000140000000-0x00000001401E2000-memory.dmp
            Download

            memory/2112-192-0x0000000000DE0000-0x0000000000E40000-memory.dmp
            Download

            memory/2112-186-0x0000000000DE0000-0x0000000000E40000-memory.dmp
            Download

            memory/2308-135-0x0000000000860000-0x00000000008C7000-memory.dmp
            Download

            memory/2308-140-0x0000000000860000-0x00000000008C7000-memory.dmp
            Download

            memory/2308-313-0x0000000000400000-0x0000000000577000-memory.dmp
            Download

            memory/2356-37-0x0000000000740000-0x00000000007A0000-memory.dmp
            Download

            memory/2356-35-0x0000000140000000-0x000000014018A000-memory.dmp
            Download

            memory/2356-29-0x0000000000740000-0x00000000007A0000-memory.dmp
            Download

            memory/2356-36-0x0000000000740000-0x00000000007A0000-memory.dmp
            Download

            memory/2356-476-0x0000000140000000-0x000000014018A000-memory.dmp
            Download

            memory/2872-6-0x0000000001F80000-0x0000000001FE0000-memory.dmp
            Download

            memory/2872-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp
            Download

            memory/2872-26-0x0000000140000000-0x0000000140517000-memory.dmp
            Download

            memory/2872-18-0x0000000140000000-0x0000000140517000-memory.dmp
            Download

            memory/3336-112-0x00000000007C0000-0x0000000000820000-memory.dmp
            Download

            memory/3336-118-0x00000000007C0000-0x0000000000820000-memory.dmp
            Download

            memory/3336-311-0x0000000140000000-0x00000001401AF000-memory.dmp
            Download

            memory/3344-472-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3344-160-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/3344-315-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3344-154-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/3344-470-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/3740-202-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/3740-321-0x0000000140000000-0x00000001401C2000-memory.dmp
            Download

            memory/3800-150-0x0000000000620000-0x0000000000680000-memory.dmp
            Download

            memory/3800-144-0x0000000000620000-0x0000000000680000-memory.dmp
            Download

            memory/3800-314-0x0000000140000000-0x0000000140175000-memory.dmp
            Download

            memory/3908-229-0x0000000000700000-0x0000000000760000-memory.dmp
            Download

            memory/3908-326-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3908-478-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3908-235-0x0000000000700000-0x0000000000760000-memory.dmp
            Download

            memory/4232-260-0x0000000000610000-0x0000000000670000-memory.dmp
            Download

            memory/4232-480-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4232-323-0x000000000A200000-0x000000000A208000-memory.dmp
            Download

            memory/4232-292-0x0000000001DC0000-0x0000000001DD0000-memory.dmp
            Download

            memory/4232-329-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4232-276-0x0000000001B10000-0x0000000001B20000-memory.dmp
            Download

            memory/4232-474-0x000000000D0A0000-0x000000000D0A8000-memory.dmp
            Download

            memory/4232-266-0x0000000000610000-0x0000000000670000-memory.dmp
            Download

            memory/4256-19-0x0000000140000000-0x0000000140517000-memory.dmp
            Download

            memory/4256-473-0x0000000140000000-0x0000000140517000-memory.dmp
            Download

            memory/4256-16-0x00000000007F0000-0x0000000000850000-memory.dmp
            Download

            memory/4256-10-0x00000000007F0000-0x0000000000850000-memory.dmp
            Download

            memory/5664-97-0x0000000000940000-0x00000000009A0000-memory.dmp
            Download

            memory/5664-99-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/5664-54-0x0000000000940000-0x00000000009A0000-memory.dmp
            Download

            memory/5664-60-0x0000000000940000-0x00000000009A0000-memory.dmp
            Download

            memory/5784-308-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/5784-70-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/5784-64-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/5844-309-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/5844-74-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/5844-80-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/5888-90-0x0000000001AB0000-0x0000000001B10000-memory.dmp
            Download

            memory/5888-94-0x0000000001AB0000-0x0000000001B10000-memory.dmp
            Download

            memory/5888-84-0x0000000001AB0000-0x0000000001B10000-memory.dmp
            Download

            memory/5888-96-0x0000000140000000-0x00000001401B5000-memory.dmp
            Download

            memory/6048-107-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/6048-332-0x0000000140000000-0x0000000140199000-memory.dmp
            Download

            memory/6048-101-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/6128-477-0x0000000140000000-0x0000000140189000-memory.dmp
            Download

            memory/6128-50-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/6128-49-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/6128-41-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/6128-47-0x0000000140000000-0x0000000140189000-memory.dmp
            Download