Overview

overview

7

Static

static

3

2026-10-10...at.exe

windows10-2004-x64

7

2026-10-10...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 08:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-10_903919bc0be25c86ead2985c17b2e134_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
  • Size 3.9MB
  • Sample261011-ka8sysfz4r
  • SHA256 6806da9043dd9da2d8c6a244175bee9bc1c74167ec56eb81cd8266a6a02663eb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_903919bc0be25c86ead2985c17b2e134_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_903919bc0be25c86ead2985c17b2e134_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4236
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4940
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2736
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2160
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1872
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:3360
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5364
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1084
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:2828
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:3496
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2068
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3172
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:1340
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:1880
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:2272
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:5936
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:2004
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
          PID:1784
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:3780

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 33d39249f518afa79ee7c5ec2a78ae093b3eeaf69daf540923a3d4db184139c9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.7MB
              • SHA256 991000d6530d7b8017e67868cb152562fc3cb8cccc1c5cb8e0361540e6f45cb0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 2.0MB
              • SHA256 08ba99220acd6ea3243752bc0a4f55e540cf049e30f93ef3ccfe70b62e2970f0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 d6f81db6dba5251c627e1688c86c3001ccb0ef09cf115d6cacbafe189ce41fec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 bf5d12832e5351bbb74fafb02ea271a5f3e47330e882a4a1f76d543055b7b3f1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.4MB
              • SHA256 db78b337d576dca1cdad19d77c8fe3416b2ca71971ccb6f3be5d8380fee69065
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.7MB
              • SHA256 45a232e859205dcb414eb2e6fa9400f7aedd42e55b11b28f48bf81018b16eba0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 85099af7c264be072f46a8f5c22d73f55ebf10a76c4378027a9b9a0f24ad0c75
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.8MB
              • SHA256 f19c4cdb447254bfac5554a8d782f2712a9d396ef9f7903babd62166614cc888
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 25b83cbe81c8729db0d03a7495ebfa81f1a142cdd702551cd2d01c96df9a2ad4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 fb13f6f09bf3c28039dc5a216da6e83e21dbd6c474ce65577c867c4e68d17dca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 a60eb7ecbdaec77101ec07d1c16ff9f3cd996faf8b2f2de386057c202bbff7c7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.7MB
              • SHA256 17595d07d4f7035da623ff45a675b85df58af96f5832d8f7d1f283d7a39cfb96
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.5MB
              • SHA256 45776d7c4bbd47ba2dac0f1ecea87665f2bc50f52828e4c9e6feb1d0c910b384
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 d710aa6fb1d152910415201e5897acc348fb08647e2244d240f18819542498f8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 6.6MB
              • SHA256 d6d6f97cab88dd620b43df1d2d61a7ec8894c159d40f0d8944310caa45c4f735
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 96afc68554737df487a952a39a8378e3fb17a3ae8813585821f1cdd77325bbaa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 d86ac08578761806b66b16ab5ccb24b9b303faa836daf5a120ef241ec0fd3ac7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 bd6d64007ebfd051fe30dcff60d0034380c7f5aa43d1dd4fdfbcc2fc934d169c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 2.2MB
              • SHA256 f0a19f2a70bd32cc5693802179afe252f989787df65eff5e21e3df8daf19ee33
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 2.4MB
              • SHA256 b67688a133c534b935bdf7c0e51eaae52930726ece9d795adaa984e16b0b2956
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 2.0MB
              • SHA256 ce82ad687d32f11abe565549b89bd8b7b1b7fcf3286764b325e0a7a99934d15d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.4MB
              • SHA256 99b0f0ddd16a00919805db77d966dd726ba828beed60b5902fc9e28c90479d99
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.4MB
              • SHA256 9b3a88ac4382a8c7fc2b2ea1aeac4067c0d34363dcc441c0de5ee4e4f1d34618
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.4MB
              • SHA256 9124f170b4827c1f19b6df675fc1825a19ef201e87e67a369061a8b5097b20fc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.5MB
              • SHA256 c2a6d7e9234137ec1dd242abd83aee9de8d2f8c3a6437bff52a51d2029545830
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.4MB
              • SHA256 02c11bb4f2240b78077829d27836cbc0d88d301798f98e956f22f264930d8b00
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 1.4MB
              • SHA256 07975c3966b67cb9de93ae21e6a4c00649ff35db7cc639121190e783d6044a68
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 1.4MB
              • SHA256 0f438f86c4c1d8d854c33c7a6ca8646165d9a01347c4c0371477421ad4e6545d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 1.7MB
              • SHA256 7530f1b37023ea681d7033b4d42bb99ca74835b26a120034444d798c09e0f0e1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 1.4MB
              • SHA256 ce8ca4fe82ca45d9442050b63720bc9d3ebeec51abcd0b8d35911f27d32c1fe6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 1.4MB
              • SHA256 9870f89aa0a3fcccfedecbd8159155842cb937d34b288b265bcffeb6829f435c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 1.6MB
              • SHA256 738b6a12e4e72c6c810df6724e7351b41f37ec63058a5ab7f5a4ad0558b8eb73
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 1.4MB
              • SHA256 33df6876a9e95a17daa7d124bdc2ade7b2c0be83a717075a08a8ea8cfa6b5e4b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 1.4MB
              • SHA256 d196b2f59490e49128919a3e94414fcfecd7425e62608e9edaee3b2aea35bb80
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 1.6MB
              • SHA256 f9487b820b08c1e868a46b2c341309251d7a35c5c9ebdfb61eea57b53c9578b5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 1.7MB
              • SHA256 6bfa1a107cb17744acde1ad38e927ca96cfefff7acc2987886572d5dbf0a55a2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
              • Size 1.9MB
              • SHA256 78f4eb9be5adc61ac5be821da2f1d24f55f6282eaee82847ec0b4024cd398ec9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jcmd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
              • Size 1.4MB
              • SHA256 b535492e3feb1dca5d969e872849d38ae87a0727dce6580db2bfaebcf5af3a31
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jconsole.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
              • Size 1.4MB
              • SHA256 2399de5980b7f14b2c906a9994d9ba9e59366934d208c92087fbdecb012bd85d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdb.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
              • Size 1.4MB
              • SHA256 5d0b4445b94408573525e333bcc7f139779cd2dbc0568ba879eb150bd9ec78e1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdeps.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
              • Size 1.4MB
              • SHA256 f8b3e9d988dd0545a3d3d2fa779d82a9a81efe71cb8c27f958dd563a5860ef55
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jhat.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
              • Size 1.4MB
              • SHA256 06f9e5fc15e5c8567d7a604ed051dbd23b6f73c5c22bfd2e95a5fd04f1a374ae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jinfo.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
              • Size 1.4MB
              • SHA256 cbe5606105ec7d5bc82efeaff435f8072afe499e3255d938d93ed50c0ecfd3ef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jjs.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
              • Size 1.4MB
              • SHA256 052c8c727a991d0835ddcbb7c39ad9240d118f913ca5d4f0a86e0a14f994d495
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MsSense.exe
              • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
              • Size 1.9MB
              • SHA256 37d42da2294dd290feddaa70c12ef49c46d1488a463f675b700275f933363664
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NisSrv.exe
              • Path C:\Program Files\Windows Defender\NisSrv.exe
              • Size 3.5MB
              • SHA256 0de87bf44f30d76ad1d458dffcd4edef80ff7bd352c6be9a8123fbe252a4d756
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.4MB
              • SHA256 ca081b198569f0d55a60ed8046c6ea269a5957124c41d5cc2fbc2293c7c7c1bf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.6MB
              • SHA256 6dbdc8bbc52c10ad350320754628abd9e6d2b0ec511f20baa7945923b2144307
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Windows.db
              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
              • Size 1.1MB
              • SHA256 36d436abf0fb7b23979cabd76fa2225b76cbfeb83962b7614cded3486fc6513f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Windows.db-wal
              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
              • Size 4KB
              • SHA256 439689e104dd36ab99c48b2af4b6db471785a8ad062495955afb57a554609eb3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Windows.db-wal
              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
              • Size 1.1MB
              • SHA256 42a56f28b5a9b203a300cb4bdba11cc7ebf907659f319dff333a5eda9de5a2d1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.4MB
              • SHA256 f578eea78724c8cec26fc987b09bbb980e2839442f72496c912814780c276bfd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.4MB
              • SHA256 e9b2cdc1d9d94074b140ceeef0d96ddea8e9008eb54b73e7a683dd54567c221e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 2.0MB
              • SHA256 4aca2e197ad332774a1b16d298c24fd8461b73efafc372ddc2278b92531e3905
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.7MB
              • SHA256 be4fb89f900c12a7bf5cfbf443777b089c7a6483860ccaafe1304e35ade7a60b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ReFsDedupSvc.exe
              • Path C:\Windows\System32\ReFsDedupSvc.exe
              • Size 2.6MB
              • SHA256 c4afddf246b8fd2b81ee2b88df679fa1ead4b5045eee06437b8521b6fee68d25
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 5729de812db2e5ccf0f6d3f30282b52ba8764dd7f3d695628fc8737dfde1ee10
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.7MB
              • SHA256 d57d7301b6b00a5d85256d6cf182dff3017367ef7f762b5b2b48124d4e964804
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 a586dc6391ca16415fe24f45fa62aab49fc07c7a3e12a09e8a3c4912a7ad9d6b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
              • Size 1.8MB
              • SHA256 f5c7c2d1d5b47fc7cdee75c36b118bcc4101e1ac3855f7fe5fa7d8bedf7517fc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1084-305-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/1084-92-0x0000000000750000-0x00000000007B0000-memory.dmp
              Download

              memory/1084-86-0x0000000000750000-0x00000000007B0000-memory.dmp
              Download

              memory/1084-94-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/1084-335-0x0000000000750000-0x00000000007B0000-memory.dmp
              Download

              memory/1084-338-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/1872-55-0x0000000000870000-0x00000000008D0000-memory.dmp
              Download

              memory/1872-48-0x0000000140000000-0x00000001401AF000-memory.dmp
              Download

              memory/1872-275-0x0000000140000000-0x00000001401AF000-memory.dmp
              Download

              memory/1872-49-0x0000000000870000-0x00000000008D0000-memory.dmp
              Download

              memory/2068-134-0x0000000000740000-0x00000000007A0000-memory.dmp
              Download

              memory/2068-141-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/2068-139-0x0000000000740000-0x00000000007A0000-memory.dmp
              Download

              memory/2068-128-0x0000000000740000-0x00000000007A0000-memory.dmp
              Download

              memory/2160-37-0x0000000140000000-0x00000001401B5000-memory.dmp
              Download

              memory/2160-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp
              Download

              memory/2160-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp
              Download

              memory/2160-72-0x0000000140000000-0x00000001401B5000-memory.dmp
              Download

              memory/2160-70-0x0000000000CE0000-0x0000000000D40000-memory.dmp
              Download

              memory/2736-26-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/2736-32-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/2736-34-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/2736-176-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/2828-98-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/2828-316-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/2828-314-0x00000000007C0000-0x0000000000820000-memory.dmp
              Download

              memory/2828-108-0x00000000007C0000-0x0000000000820000-memory.dmp
              Download

              memory/2828-99-0x00000000007C0000-0x0000000000820000-memory.dmp
              Download

              memory/3172-146-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/3172-322-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/3172-175-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/3172-152-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/3360-67-0x0000000000780000-0x00000000007E0000-memory.dmp
              Download

              memory/3360-61-0x0000000000780000-0x00000000007E0000-memory.dmp
              Download

              memory/3360-287-0x0000000140000000-0x00000001401AB000-memory.dmp
              Download

              memory/3360-59-0x0000000140000000-0x00000001401AB000-memory.dmp
              Download

              memory/3496-174-0x0000000140000000-0x000000014021E000-memory.dmp
              Download

              memory/3496-321-0x00000000007C0000-0x0000000000992000-memory.dmp
              Download

              memory/3496-114-0x0000000000ED0000-0x0000000000F30000-memory.dmp
              Download

              memory/3496-120-0x0000000000ED0000-0x0000000000F30000-memory.dmp
              Download

              memory/3496-337-0x00000000007C0000-0x0000000000992000-memory.dmp
              Download

              memory/3496-415-0x00000000007C0000-0x0000000000992000-memory.dmp
              Download

              memory/4236-6-0x0000000002680000-0x00000000026E7000-memory.dmp
              Download

              memory/4236-7-0x0000000002680000-0x00000000026E7000-memory.dmp
              Download

              memory/4236-0-0x0000000000400000-0x00000000007FB000-memory.dmp
              Download

              memory/4236-85-0x0000000000400000-0x00000000007FB000-memory.dmp
              Download

              memory/4236-1-0x0000000002680000-0x00000000026E7000-memory.dmp
              Download

              memory/4940-13-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/4940-20-0x0000000000E30000-0x0000000000E90000-memory.dmp
              Download

              memory/4940-21-0x0000000000E30000-0x0000000000E90000-memory.dmp
              Download

              memory/4940-14-0x0000000000E30000-0x0000000000E90000-memory.dmp
              Download

              memory/4940-172-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/5364-75-0x0000000000400000-0x0000000000577000-memory.dmp
              Download

              memory/5364-76-0x0000000000970000-0x00000000009D7000-memory.dmp
              Download

              memory/5364-81-0x0000000000970000-0x00000000009D7000-memory.dmp
              Download

              memory/5364-298-0x0000000000400000-0x0000000000577000-memory.dmp
              Download

              memory/5936-334-0x0000016F0D6A0000-0x0000016F0D823000-memory.dmp
              Download

              memory/5936-413-0x0000016F0D6A0000-0x0000016F0D823000-memory.dmp
              Download