Overview

overview

8

Static

static

3

2026-09-09...il.exe

windows10-2004-x64

8

2026-09-09...il.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 00:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-09_0eb8ecfd4059931ac61627f6bea7b0f4_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
  • Size 2.8MB
  • Sample260910-ama3cavvhw
  • SHA256 53482e2be3d531a98b3adc032c4b210326f1fbe735e6b7e58748add9f8169994
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 6 IoCs
    defense_evasion
  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 57 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-09_0eb8ecfd4059931ac61627f6bea7b0f4_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-09_0eb8ecfd4059931ac61627f6bea7b0f4_amadey_avoslocker_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="upWire"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1220
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall delete rule name="upWire"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:5436
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3392
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="upWire" dir=out action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:568
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5788
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="upWire" dir=in action=allow program="C:\Windows\SysWOW64\wire\upWire.exe"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:5248
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="wire"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall delete rule name="wire"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1612
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3928
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="wire" dir=out action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:3824
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2468
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="wire" dir=in action=allow program="C:\Windows\SysWOW64\wire\wire.exe"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1632
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4980
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4268
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:1672
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2132
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:3492
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1796
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3956
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:4220
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:4652
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4156
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:6124
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:3668
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:1168
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
          • Modifies data under HKEY_USERS
          PID:5816
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:3692
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:3752
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
            2⤵
              PID:2164

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Windows Command Shell

                1
                T1059.003

                Persistence

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Privilege Escalation

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Defense Evasion

                Impair Defenses

                1
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                3
                T1012

                System Information Discovery

                4
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                • Size 2.7MB
                • SHA256 41fe79b337dceb9a7301528b6af705eedbab6a728284f3d49b16f0cb01fc1661
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 1.4MB
                • SHA256 592152b6d74cd5de6674ce32d013d6a8936f102279c459aefe4b88f5cd57fa3b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 1.7MB
                • SHA256 bddf1630f07d9d576476c2a2eaef4ccdecdecbdf05bd66da28b480dd9e066b66
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zFM.exe
                • Path C:\Program Files\7-Zip\7zFM.exe
                • Size 1.5MB
                • SHA256 e37e70571e1731a5f16d1707d5ec6603fccedcf4054d07f41c751d550f16b40c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zG.exe
                • Path C:\Program Files\7-Zip\7zG.exe
                • Size 1.2MB
                • SHA256 c9dbb5e0a7a16696b739698a5115d6c36b546e0abf976e8f3e4e3078a06e82ad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall.exe
                • Path C:\Program Files\7-Zip\Uninstall.exe
                • Size 1.2MB
                • SHA256 94bccadabe21856f7549809271af14b236ccf86f3463ed57e6cf0776992b3163
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 1.4MB
                • SHA256 80cce7fbcf9e31c570a84013a57f8d75278f554234f1dcce1ffd2881ea348ffc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 4.6MB
                • SHA256 2dfaeb4b0833da0b4cf1cf89ee193394f1fab34d0c9a064718df63c3bac4fbcd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 1.5MB
                • SHA256 d9e4f5e9479a42cf756e3317b9ae14e674c1f66e3bdcbad5a5711cc9579bf7dd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 24.0MB
                • SHA256 627b7355133dbcf27c2ca0d212e81d46257a1f49a71b6fda234ecbf5e8b48ec3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 2.7MB
                • SHA256 07ff12567c99c036de249ea7e8f0a06d6717fbc2c1b068d05109071e927ac321
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICLUA.EXE
                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                • Size 1.1MB
                • SHA256 c0f75e01a5f09e90fecc879a1f236274493c7d486d86f8e382c03c676072d110
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 1.4MB
                • SHA256 fcdc1850fd6696bf89e2dfe5d0868d687149b2931800b6f59d4f3f1237be6c2e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 1.3MB
                • SHA256 dff531017022151a5dc7de63a9a451daeb2b9eff4b5661f4137761159c5f0c11
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 6.6MB
                • SHA256 32a9415c2567950a2ed3dc47fbe2fa71ce33b6104b2402205a171af59856bc6f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                • Size 6.6MB
                • SHA256 c2cd246d1290e38afee6ca5b04cf0450bd2c060c094cf16f5e6e579f6f37ab53
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 2.3MB
                • SHA256 a9a32fdf284be7aa8d4057150a7ebe38b4cfce063371c4d54f9aefce0e16d897
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 4.0MB
                • SHA256 c77f355d54320ae31dc6a776e02defc2d9bd64567a51550f27a1adb91242a3ab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 2.8MB
                • SHA256 f8d8d9ed7d096df960be3373164183acf7ca420f6ce44c004781f313c2d066e5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 2.2MB
                • SHA256 3298efa2657d75df2ae97c8528ed5a3edde63417984ea4e0fdf81eb5bb050a45
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                os_update_handler.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                • Size 2.4MB
                • SHA256 1559d6a773f4613cfbc5de3e559ef279d29367ea4b942338aa006fa796e4e7af
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_proxy.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                • Size 2.0MB
                • SHA256 8249e39afdfb0c0da1b7ef0c4662b8497d4d3179f13e68af898bff0adadd8930
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 1.2MB
                • SHA256 251055521471f2aa9c6eeb40599f9cc76b6d3a81cc167bad306aa1de8bf6eeff
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 1.2MB
                • SHA256 5a21d9f65815a6eaa85f978fdda324001fa2c578796aaaa0c6e79cb255d90b93
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 1.2MB
                • SHA256 e24790b3576d8e4958ff373cbee4fc1b3370ecd07ac12e0dfa8d3f36016e3b20
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jabswitch.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                • Size 1.2MB
                • SHA256 20a89c271d954bc960801c7d0d75144d4b08bc79d337ff4f6c434b3c8a6c38bf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 1.2MB
                • SHA256 968f2a9a518160ad34a3a3ca6b608cfa5112b65c0b51880578669ff151c8c828
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jarsigner.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                • Size 1.2MB
                • SHA256 e8d9ff51c3b7289536b303ddbbdd01d64c05a6b84a7948dfac62695f4ce1869c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java-rmi.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                • Size 1.2MB
                • SHA256 ea6896fd5c73de0c369d155f8c6d87738ef173a7bec110c50e3b8783706c265c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                • Size 1.4MB
                • SHA256 e64ffa386a3ec907b43f3fdf1d7bd3498ff02576c7af9ec790a38a5f636a110d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javac.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                • Size 1.2MB
                • SHA256 5f425ca43cf71bd2d48025f2d7ad9ee621c1e2eb39d1a7194e02de00ce602c85
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javadoc.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                • Size 1.2MB
                • SHA256 5c1b4ed93e9801e7402ce6df46be24ce8673c86c0ba703fea4a5ac27f5c7b620
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javafxpackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                • Size 1.3MB
                • SHA256 d9387c7c4b1d2c1ace038ad53a7e45c04d7707acdd27640a05453da4a74770d5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javah.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                • Size 1.2MB
                • SHA256 f8a5ff42b26889e277ce1340521f48c96c315221a5a2ed1e1cb640d262684117
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                • Size 1.2MB
                • SHA256 e834aeba1d99ca76c0cbc9a82e60aeac3c8bcccd51185810d6cd78fcf1a40458
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javapackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                • Size 1.3MB
                • SHA256 cf4757b0cc1688a0858449a6424fba7e244b7eea5ff797f6b9965d9b11d8233a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaw.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                • Size 1.4MB
                • SHA256 4b33f32d0302671d58071dc5e8f2de4452c9193e7ca289d638e2ee737b2768dc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaws.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                • Size 1.6MB
                • SHA256 79ca6331993554d4ccd0a217c613b12db74a754d190fa79fb2a87befa9ea9e7b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jcmd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                • Size 1.2MB
                • SHA256 ddbaee3a48d9de98a30d3775a74975d3a974f75016d5895359254d9ab63eea86
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jconsole.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
                • Size 1.2MB
                • SHA256 8408a28eb9a48550752853300d37e0cc5d8b3f0b4daf671d21225400ea4de983
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdb.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
                • Size 1.2MB
                • SHA256 6eb1317e6e014ee41a6d39919dcf0c197c7223ab8a86a566ac5205923d408022
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdeps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
                • Size 1.2MB
                • SHA256 546b75da29bde42c25b8f24b33dcf33c950f03b9437de447cc8f4ffd0ac2aeef
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jhat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
                • Size 1.2MB
                • SHA256 d5ca5d0730bf6d9aa5f87caf5ffd661f6df83115ad90d1d07dce351320f2a15b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jinfo.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
                • Size 1.2MB
                • SHA256 4d5cdc3eda47d47c2021e1b0b737b9972a326c29143e4341932344cb42bc88ca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jjs.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
                • Size 1.2MB
                • SHA256 4c1944183ffdf18f0e731492195d28eadf26104d0d74bffb5efe1e6d2732ce69
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jmap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
                • Size 1.2MB
                • SHA256 56050e36dacbcdcb26fe998e140c20ffecdc20f6e03aad8273a7b1aa42cf1ef1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MsSense.exe
                • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                • Size 1.6MB
                • SHA256 33e4d8eb7e2cd8a709370cfa78bf65882ba16de8b3ae27e0d3b2db0f76d965fb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                NisSrv.exe
                • Path C:\Program Files\Windows Defender\NisSrv.exe
                • Size 3.5MB
                • SHA256 1b5d021de4ac4a83f7f334afc8b884c4c48e68d2d1e9882d65360b704a740993
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wmpnetwk.exe
                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                • Size 1.4MB
                • SHA256 ad467fb94173f68478b0681c5eb9d564d3c69907ca5dc0154a411aedeccf82df
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 1.3MB
                • SHA256 920ec8b2eae2eb287d8dce1e34cece4196877c5da03d716fc755f19ceb10ee8c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                • Size 1.2MB
                • SHA256 b6b5527b7f209d09a571845a6ef98a0781ed7d94c34cc2ff748d10dcea1143a0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db-wal
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                • Size 1.2MB
                • SHA256 ca0c34fef8a0520e9120f154012e266b9c7ab21d56981642cdc9f7553aece2a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 1.2MB
                • SHA256 dba9dc40ec7315b49d685348faf3ae309d3a0b3676a1a70d438a743f53ba25f2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\System32\AgentService.exe
                • Size 1.4MB
                • SHA256 e54afd027a8d27660a55179ff85ff93c372949debaa79208267970e4cbaa5cb1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 1.7MB
                • SHA256 28ff2fbc6a36a606a52d46f8ad4bd3d9e2bbf8329163d42021ebecd76f4ded2f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 1.4MB
                • SHA256 47a15fb336e5ea87be1047448673666e2e06ec665581effb1a5cc755adb64e0f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ReFsDedupSvc.exe
                • Path C:\Windows\System32\ReFsDedupSvc.exe
                • Size 2.6MB
                • SHA256 be81e8de14e301f9741f441c533762c5d607b6114e90ecd00a9df9ea33856415
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.4MB
                • SHA256 de7009a54ae2a01a7f6c895c57add8615ed0eec95006b894c1af01388f1adbd8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.7MB
                • SHA256 fafc3654ff5eb01663b03218632a93882fb964711078e292fca5822e0f26c5bc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVClient.exe
                • Path C:\Windows\system32\AppVClient.exe
                • Size 1.3MB
                • SHA256 61f340fe87ee45c069017f7bf98773f5340d283ea626f015eb50065d4d72e279
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SgrmBroker.exe
                • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                • Size 1.6MB
                • SHA256 9a4e04819b8881f8d6a80a750e9493a1fd740291c199953a82acf021a577ad46
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1672-36-0x0000000140000000-0x0000000140214000-memory.dmp
                Download

                memory/1672-37-0x0000000001B40000-0x0000000001BA0000-memory.dmp
                Download

                memory/1672-43-0x0000000001B40000-0x0000000001BA0000-memory.dmp
                Download

                memory/1672-47-0x0000000001B40000-0x0000000001BA0000-memory.dmp
                Download

                memory/1672-49-0x0000000140000000-0x0000000140214000-memory.dmp
                Download

                memory/1796-74-0x0000000000400000-0x00000000005D6000-memory.dmp
                Download

                memory/1796-75-0x0000000000A20000-0x0000000000A87000-memory.dmp
                Download

                memory/1796-80-0x0000000000A20000-0x0000000000A87000-memory.dmp
                Download

                memory/1796-279-0x0000000000400000-0x00000000005D6000-memory.dmp
                Download

                memory/1824-1-0x0000000002680000-0x00000000026E7000-memory.dmp
                Download

                memory/1824-333-0x0000000000400000-0x00000000006EB000-memory.dmp
                Download

                memory/1824-6-0x0000000002680000-0x00000000026E7000-memory.dmp
                Download

                memory/1824-104-0x0000000000400000-0x00000000006EB000-memory.dmp
                Download

                memory/1824-0-0x0000000000400000-0x00000000006EB000-memory.dmp
                Download

                memory/2132-222-0x0000000140000000-0x000000014020E000-memory.dmp
                Download

                memory/2132-58-0x0000000000990000-0x00000000009F0000-memory.dmp
                Download

                memory/2132-52-0x0000000000990000-0x00000000009F0000-memory.dmp
                Download

                memory/2132-51-0x0000000140000000-0x000000014020E000-memory.dmp
                Download

                memory/2956-146-0x0000000000620000-0x0000000000680000-memory.dmp
                Download

                memory/2956-140-0x0000000000620000-0x0000000000680000-memory.dmp
                Download

                memory/2956-314-0x0000000140000000-0x0000000140172000-memory.dmp
                Download

                memory/2956-139-0x0000000140000000-0x0000000140172000-memory.dmp
                Download

                memory/3492-62-0x0000000140000000-0x000000014020A000-memory.dmp
                Download

                memory/3492-64-0x00000000006C0000-0x0000000000720000-memory.dmp
                Download

                memory/3492-257-0x0000000140000000-0x000000014020A000-memory.dmp
                Download

                memory/3492-70-0x00000000006C0000-0x0000000000720000-memory.dmp
                Download

                memory/3668-315-0x000001B234D50000-0x000001B234DFE000-memory.dmp
                Download

                memory/3668-424-0x000001B234D50000-0x000001B234DFE000-memory.dmp
                Download

                memory/3692-422-0x0000019707D10000-0x0000019707DBE000-memory.dmp
                Download

                memory/3956-85-0x0000000000740000-0x00000000007A0000-memory.dmp
                Download

                memory/3956-294-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/3956-84-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/3956-385-0x0000000000740000-0x00000000007A0000-memory.dmp
                Download

                memory/3956-91-0x0000000000740000-0x00000000007A0000-memory.dmp
                Download

                memory/3956-387-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/4156-124-0x0000000000800000-0x0000000000860000-memory.dmp
                Download

                memory/4156-123-0x0000000140000000-0x0000000140168000-memory.dmp
                Download

                memory/4156-130-0x0000000000800000-0x0000000000860000-memory.dmp
                Download

                memory/4156-137-0x0000000140000000-0x0000000140168000-memory.dmp
                Download

                memory/4156-132-0x0000000000800000-0x0000000000860000-memory.dmp
                Download

                memory/4220-308-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/4220-311-0x00000000007E0000-0x0000000000840000-memory.dmp
                Download

                memory/4220-106-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/4220-102-0x00000000007E0000-0x0000000000840000-memory.dmp
                Download

                memory/4220-96-0x00000000007E0000-0x0000000000840000-memory.dmp
                Download

                memory/4220-313-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/4268-31-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/4268-163-0x0000000140000000-0x00000001402D4000-memory.dmp
                Download

                memory/4268-25-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/4268-33-0x0000000140000000-0x00000001402D4000-memory.dmp
                Download

                memory/4652-117-0x0000000000D40000-0x0000000000DA0000-memory.dmp
                Download

                memory/4652-116-0x0000000140000000-0x000000014027D000-memory.dmp
                Download

                memory/4652-110-0x0000000000D40000-0x0000000000DA0000-memory.dmp
                Download

                memory/4652-310-0x0000000140000000-0x000000014027D000-memory.dmp
                Download

                memory/4980-122-0x0000000140000000-0x00000001402E9000-memory.dmp
                Download

                memory/4980-21-0x0000000000E10000-0x0000000000E70000-memory.dmp
                Download

                memory/4980-13-0x0000000000E10000-0x0000000000E70000-memory.dmp
                Download

                memory/4980-12-0x0000000140000000-0x00000001402E9000-memory.dmp
                Download

                memory/5816-326-0x00000214A5160000-0x00000214A53EB000-memory.dmp
                Download