Overview

overview

7

Static

static

3

2026-08-09...uk.exe

windows10-2004-x64

7

2026-08-09...uk.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 12:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe
  • Size 3.1MB
  • Sample260809-plndlsxfnb
  • SHA256 8e8e1d281517105488449e81131c6bb7f10b4ef933aa50103098327e697d26ae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 11 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_d62498585659a4c9ce5c7c1a04056dc6_cryptbot_icedid_mespinoza_njrat_ryuk.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5420
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4636
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2504
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:1856
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:5408
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:928
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    PID:5972
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:292
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:1540
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:3396
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:956
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:4956
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:804
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:5948
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2916 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:1432
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:5560
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:4252
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2916 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:4196

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 2ac34014284f762a16d6eb8356d19af6d5e52e1123ff4bcf62bb212036c6885e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.4MB
              • SHA256 2ed32c350dc49d5ea87a66fa70c9ff2766a0a21140f9070d16071e01ff857fc4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.7MB
              • SHA256 89b3b9b74c0fa8174c7f22bdb6fb5b42fa2b657895982fb0d4bdd3f30db922d5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 486a343b76bd9cf279897c87c0a82156148fe2dd25346718a2499a7143f454fe
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 7cfbe3ec8797755043209ac1b3aa4e8e61c6c870f4d8703331e93edbc139feb2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.2MB
              • SHA256 d5ee7446b28a6d2bebb407ebfa7be82a6da6b1c8f844076c2873c041fda83b1b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.4MB
              • SHA256 499a983005998e567ad5fdfbcb1601c86af67a62c4355ca5a347997db24c6b2b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 e68c1779af7b176f2e5168f603cd8035206bf7a0e52f0500c26fe9f9e0d0dce7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.5MB
              • SHA256 3594d60c5b84a0a54675dcea676b60799675487adcba2552081529f10d04f988
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 add92d98194bbf462c4ee62d3493feb60e744e3350a797384ebccdf168a0f96d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 20a3fd7bc2eda5ea9bc17c6e7c31682846cd563c64c4f284689ca9da9b385415
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 79082964a6e254ed9289e290f694750b3d3174beac16aa36cd64b2535e220c74
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.4MB
              • SHA256 e9914a715f512f866f0757b0bc3615ae787b3fc6603ae64f19457e70658906fd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.3MB
              • SHA256 bcde34c72ae1223ba0ca5a7e828fb70a50388eb0e7588aaa2d4977b1f8a1a039
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 5490256db01b42dead6e5c4b24c1909184f032feda1eef91a59e0bc6d4f154fb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 6.6MB
              • SHA256 44a3a6d6a52460b62e7eda6bdc4669f918dac4bbbff21e49139e488366404664
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 f7c583f609aa2690c65168aa61fca9ad6896dd383f3592bcebde1f3db3f4e8f6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 394f3224f4b81dda2e957e98475fc1c28706715e41ffe0326af16a1525985e25
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 d971a1bbf83ccde50376415401ca863d02deb5f65a2d4b57eca381c4d81095cc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 2.2MB
              • SHA256 80c3ac63518711805cc430c2def390cb6b70c264525e9ee51f87042619bf9f84
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 2.4MB
              • SHA256 92b5226d1f08568b97efceafbebaee5103f581253da67494e380fae74ade0a61
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 2.0MB
              • SHA256 205773669cdb9bca907bfe038e105a641ed0e79acc1040fd61088f9e826bcd61
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.2MB
              • SHA256 fa7d50caee0d11241f2128388a943519e242d1bbf7b6cb35e01b64293bf930e4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.2MB
              • SHA256 106aca5aeaa47dc1b37ad9b1337cd8f0ea711a910543771ab02d915371f23b76
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.2MB
              • SHA256 59b202499d2e6d32dfcc6d33b126f0ca1a9531ebb4a3c3572f96cb551061580b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.2MB
              • SHA256 d6e9fd8f03fecf28d6cd26d356feac440dfe0731172408ec4eba1b7a13cdecea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.2MB
              • SHA256 9b28bc19f1ec2c46842681b7f51d9d0fe05bd3776d9ef1efdbecb514552764b5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 1.2MB
              • SHA256 e1e4e97fe74550d22e12d1c01a8e68abae40f686fa77b6200ce888d7a3360375
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 1.2MB
              • SHA256 f7ebe00b67ab5f74a6bec4e87961e45cf50d460ea5c0417e1265b573bf3da78e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 1.4MB
              • SHA256 e02deafaedcfc2c9a562f66da69fdf560b4ef87c614bbfc79607032a8dda7053
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 1.2MB
              • SHA256 06cb7c9e199cc40814c4893725b0c0779f7ca2e204811f2efc5f340d9698ced4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 1.2MB
              • SHA256 06e44dfe8929d781f84807c900b97f68c03e3691e73f98630210462016fa62ee
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 1.3MB
              • SHA256 389871333ef436d275ffccedaacd0b58755cf504043538756a45b4aecb247e70
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 1.2MB
              • SHA256 ff96ffdb1129ead544aaaccec763c30f4e3b8b8e9a4b0bc4762ba8df2061607d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 1.2MB
              • SHA256 34d08dc9d74257f633ccba62690b34e186b69120d4c49c811941f1be984b1023
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 1.3MB
              • SHA256 c1f69f967f6cac8075cdf35c9b6743d81326d6f3f9972266995fa1456f04340b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 1.4MB
              • SHA256 65e72d70500a0c1a9f9505a2b3b7728091c7c49e79ad919128b2a54460e1d0de
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
              • Size 1.6MB
              • SHA256 4fbfed0036d6d257c88ad46c348e1633e825d014be98dd42a70620e1c4f15bfa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jcmd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
              • Size 1.2MB
              • SHA256 a1d9f46af40d73323d549ea8465fb44649b655b1a8c6a4902537036c5c0fb502
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jconsole.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
              • Size 1.2MB
              • SHA256 0f419130740d73a2d11af1992e1414b85679aad06648541b3633836822f3dc3a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdb.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
              • Size 1.2MB
              • SHA256 21203462dd0d6f587b9cd605884ad9e85dd138eff452363e4239a186730653cb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdeps.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
              • Size 1.2MB
              • SHA256 bce01cc2275a72fcb3cd4179e51e9f2452cefad2c6ac7cb9c857d4ed1f1a3aba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jhat.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
              • Size 1.2MB
              • SHA256 6bd7fc7239b83f4daccf6c4e3c348e028ea9f5db27336eb73898f813b6d7914c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jinfo.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
              • Size 1.2MB
              • SHA256 5183950e8cd1c396e3eb7bac3e8b9353d51b14bfdd54b6c9b43f05d072189c92
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MsSense.exe
              • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
              • Size 1.6MB
              • SHA256 f6ecf516e0730710cb047f5f23b14964a4164e5626c0e189177d32a39a3dda6c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NisSrv.exe
              • Path C:\Program Files\Windows Defender\NisSrv.exe
              • Size 3.5MB
              • SHA256 bdb8e1bc262772e37e967b9ff1284902d5fff712eddf71fe0f53f1cf21d03517
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.4MB
              • SHA256 16467b6e43cb0fc9d9a6e40fd0ce88c6c1dc2fb766065236a486fed46469ac6c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.3MB
              • SHA256 f5178de6c772f017e3bbf3b5d71f54228e7df4b441693f2a55f257448e17369f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Windows.db
              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
              • Size 1.1MB
              • SHA256 2d48f6d6d25c38d9eb8ba15999e7383b654e1d7c2cb43ca6cfc16302a0f26192
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Windows.db-wal
              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
              • Size 1.4MB
              • SHA256 754d7b04fc1ce8e48516732486a894c9eeffce81bd5e7146d08433e880776d6e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WinRAR.lnk
              • Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
              • Size 1KB
              • SHA256 05be3e4ae1395979316bc1b7176c0d5570b76e64c3a5a2f8fc242e5a5e4f405e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.2MB
              • SHA256 f4488ab6b30c73cea927a1c2d764441993b0d3a8dd5ad6f9510d031415e9f96e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.4MB
              • SHA256 6904c4168a4c6274726a923f0f5c8af03cfcee91a5170a5c7985f8a1328404be
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 1.7MB
              • SHA256 387f1f747c5b6fa0483c11515016c3e0f0a0bde93c6ba7c816bd9d4cd95ede09
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.4MB
              • SHA256 62a0c65af17010dd84953cece8004263e539016c945f045f7c8f9c3a70d612be
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ReFsDedupSvc.exe
              • Path C:\Windows\System32\ReFsDedupSvc.exe
              • Size 2.6MB
              • SHA256 b04fded387795807d672cdf54aeb1439135130f4bf729d9937f8fbe7c91c2053
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 fabdddb718d49ca0c70cfd1b8b4a161b537fb8d51fc850f142321043bca779d4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.7MB
              • SHA256 5791f50f45438a020cabce080263abe5740ac55bf421680f233d5c5773c6d671
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 266c1e38d6e0e974a93f76320d5e5a925c9ac380836845373548f6a797c837ec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
              • Size 1.6MB
              • SHA256 9304a73284b9856238c92dc60373568aba7ee6f8d9b4206b526f0a309f02f227
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/292-88-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/292-321-0x0000000000720000-0x0000000000780000-memory.dmp
              Download

              memory/292-323-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/292-80-0x0000000000720000-0x0000000000780000-memory.dmp
              Download

              memory/292-86-0x0000000000720000-0x0000000000780000-memory.dmp
              Download

              memory/292-303-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/928-283-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/928-64-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/928-72-0x0000000000740000-0x00000000007A0000-memory.dmp
              Download

              memory/928-66-0x0000000000740000-0x00000000007A0000-memory.dmp
              Download

              memory/956-124-0x0000000000C70000-0x0000000000CD0000-memory.dmp
              Download

              memory/956-117-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/956-118-0x0000000000C70000-0x0000000000CD0000-memory.dmp
              Download

              memory/956-129-0x0000000000C70000-0x0000000000CD0000-memory.dmp
              Download

              memory/956-131-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/1540-306-0x0000000000770000-0x00000000007D0000-memory.dmp
              Download

              memory/1540-308-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/1540-99-0x0000000000770000-0x00000000007D0000-memory.dmp
              Download

              memory/1540-93-0x0000000000770000-0x00000000007D0000-memory.dmp
              Download

              memory/1540-304-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/1540-92-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/1856-51-0x0000000140000000-0x0000000140174000-memory.dmp
              Download

              memory/1856-38-0x0000000140000000-0x0000000140174000-memory.dmp
              Download

              memory/1856-49-0x0000000002390000-0x00000000023F0000-memory.dmp
              Download

              memory/1856-45-0x0000000002390000-0x00000000023F0000-memory.dmp
              Download

              memory/1856-39-0x0000000002390000-0x00000000023F0000-memory.dmp
              Download

              memory/2504-27-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/2504-34-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/2504-157-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/2504-33-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/3396-104-0x0000000140000000-0x00000001401DD000-memory.dmp
              Download

              memory/3396-305-0x0000000140000000-0x00000001401DD000-memory.dmp
              Download

              memory/3396-112-0x0000000000D40000-0x0000000000DA0000-memory.dmp
              Download

              memory/4276-309-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/4276-134-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/4276-141-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/4276-133-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/4636-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp
              Download

              memory/4636-116-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/4636-22-0x0000000000D40000-0x0000000000DA0000-memory.dmp
              Download

              memory/4636-15-0x0000000000D40000-0x0000000000DA0000-memory.dmp
              Download

              memory/4636-14-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/5408-60-0x0000000000870000-0x00000000008D0000-memory.dmp
              Download

              memory/5408-54-0x0000000000870000-0x00000000008D0000-memory.dmp
              Download

              memory/5408-53-0x0000000140000000-0x000000014016E000-memory.dmp
              Download

              memory/5408-245-0x0000000140000000-0x000000014016E000-memory.dmp
              Download

              memory/5420-8-0x0000000140000000-0x00000001403B9000-memory.dmp
              Download

              memory/5420-6-0x0000000002150000-0x00000000021B0000-memory.dmp
              Download

              memory/5420-79-0x0000000140000000-0x00000001403B9000-memory.dmp
              Download

              memory/5420-0-0x0000000002150000-0x00000000021B0000-memory.dmp
              Download

              memory/5972-76-0x0000000000400000-0x0000000000535000-memory.dmp
              Download

              memory/5972-290-0x0000000000400000-0x0000000000535000-memory.dmp
              Download