Overview

overview

8

Static

static

3

2026-11-10...er.exe

windows10-2004-x64

8

2026-11-10...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/11/2026, 09:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-10_144f6ff35bbfcede9762d01b8875be14_amadey_dharma_elex_glassworm_smoke-loader.exe
  • Size 1.8MB
  • Sample261110-ll4ttaed37
  • SHA256 3e079b15aec194ceac9e9ce23f8ca1b176309c8f614702d3328b142c10d92087
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 4 IoCs
  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-10_144f6ff35bbfcede9762d01b8875be14_amadey_dharma_elex_glassworm_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-10_144f6ff35bbfcede9762d01b8875be14_amadey_dharma_elex_glassworm_smoke-loader.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:928
    • C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      2⤵
      • Checks processor information in registry
      PID:4404
    • C:\Windows\SysWOW64\CMD.EXE
      CMD.EXE /c fltmc load BkavSetupSd
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3824
      • C:\Windows\SysWOW64\fltMC.exe
        fltmc load BkavSetupSd
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:1464
    • C:\Users\Admin\AppData\Local\Temp\091B8.tmp\SetupB.exe
      "C:\Users\Admin\AppData\Local\Temp\091B8.tmp\SetupB.exe" x
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:6136
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2536
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4496
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2100
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2632
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4856
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:944
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3424
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:960
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:572
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4972
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3280
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2924
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:772
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:3156
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3604
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3800
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:1684
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2444
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3964
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1248
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3336
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1856
      • C:\Windows\system32\grpconv.exe
        grpconv -o
        1⤵
          PID:2932
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:5060
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Direct Volume Access: Opens a physical disk for reading
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1496
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:3740
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
            2⤵
            • Modifies data under HKEY_USERS
            PID:2324

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              Windows Command Shell

              1
              T1059.003

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Defense Evasion

              Direct Volume Access

              1
              T1006

              Modify Registry

              1
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              3
              T1012

              System Information Discovery

              3
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 a27c49b66dd7de8e656e89969c909f9b8304e1f670d08adc14dea5717d56d326
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.4MB
              • SHA256 86072ec22eaa5e69041924741d64abaffb34bc04daf7351fee6d407c3759749e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.7MB
              • SHA256 9177f7d0224e2e2a8c5a494b4ab6e5091f607c94e827bf174389536416c5743d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 e662794204c3fd0606ec0e903b5f0e73f41a3d3dd94d16aa85d9bd08dae2e2ac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 2c1be649ae67bd1556d8794e0632c08f58c91c3ca0f238c6d4dd2d90b9b2777d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.2MB
              • SHA256 74576dab1ded1f893627b8bb9a86eee4cb8f121eb4df5dd4d860d8fd1177a007
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.4MB
              • SHA256 fadf7cd292c1257f845098a23bb2af60c525167bb17fe5a0165e10748b87b26a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 306b76059f35eb272e4ec0935e10c85b38cc9ae924e3c7c71479380caa654bc5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.5MB
              • SHA256 999aa27c9363213b6f7fbe8773289b70694004cfa81940f5dc8c17987b06b668
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 b0e0bd8c631d9f55a4cdae8cc7c8bfaac316d0befae17e31dce3923a51149919
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 e3fa7a60ba1dc98d78492c91573b301b9383803a653a6c7bc918f5bdc68e1066
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 ba0d6c40e96c3940f718a4df7e522d2af9a8a2afed9b01c5bb66190b6b734bac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.4MB
              • SHA256 c6f5aa5ac6df406da6b7401855da4bc4d984537af47dda59e7740bb682d42057
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.3MB
              • SHA256 bdaa87c1724dac5f01a9a75085c3b3026093bc64850d22856c0b845da688d93e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 14a1680ba5ceb9dfec83125eac4707959aefc90c779be1671d2b382b4dfc0bf7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 6.6MB
              • SHA256 b81fec6607d504e88b4a4df64a6c68f15b48f8178b1842ddc27bbbac9e340744
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 f40158ba541b4d0cbd9aa1226b13dc6d809b00ff40de928588f853dfa2888014
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 f22712c88c3e4673d779ce371bff38d9459ab15f6104e0b5e8999ea16b532d93
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 c1bec162ef3e974cded1fa48070c543f6ce09e6e75d186cce6074ccd65f422bb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 2.2MB
              • SHA256 ec0d1ad3eaecd478ffa30702aef424259bcae035561610c9637c1130f56c43bf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 2.4MB
              • SHA256 db32ab2057acdca4b370dd7f33a9aadc80be22f5f6723e53e01384fe10193e42
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 2.0MB
              • SHA256 0177979a619b942e12b21ed19af2cb7643f90e0a522e2ed3b7c50a570b63b168
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.2MB
              • SHA256 e564edaee34dd544a99f94043fe0d90952d70003f3dfa0da45d0bcfed30cd093
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.2MB
              • SHA256 6c295bbae2e1bfcef95d14aa139b1c44a770d09cf0b503c7526b80bb8a9768bc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.2MB
              • SHA256 524ba045086709a64d4e9431fcad024270c45da0e5465ed79c6b8751abb129e1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.2MB
              • SHA256 c6c6cadaa4b234307303ba3f2579035a29a4389fd72302cba9ae91c89ac40096
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.2MB
              • SHA256 453aa9d348296a090be512cd501f76f5d652654a6f108ea6b061e5334b8f57ce
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 1.2MB
              • SHA256 ed6c0baa3bdde18288f012f61f761531f0c89090a99794c5282efc06d29405a8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 1.2MB
              • SHA256 d5825d1b710cb62fabf0287638728fb64388fbd61153ddccb1c93573fb78d283
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 1.4MB
              • SHA256 d98564cbfd9e57549ce01f11d72eaeeb9dd5b9de11a9d02715e84021e81f8a6c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 1.2MB
              • SHA256 89311597321b06421f6c4908924a8897fd0eb80262259ee04f7b0d5ffbf3f770
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 1.2MB
              • SHA256 47403df83e7a5070d9e22accd53897ddb7070f97909773e71b60e09331eb410d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 1.3MB
              • SHA256 60c6e762494c98407db03f1c97d330694d593d277ea35ef7ac8742207d4e294d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 1.2MB
              • SHA256 c6c1ecb725003f9cc6d35f243d97d6e3179dbf255f39374940f493ed143b85e7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 1.2MB
              • SHA256 461219cdad4376c72d8d2b6aec83b842c7e988a59c2ad883b226666d76c163da
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 1.3MB
              • SHA256 d0bd99bd8928b6d5d8af7e56f56132510ce56ff1fe2a6d0a3305d40de943853f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 f4ff51f90c87f002e7cfcf527be6163a71332e448814d67621ccac66e270f746
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.3MB
              • SHA256 156fcf062c51bc27fe279b7ebba8d60d389bcb43b355e52525a69abce720fa12
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BkavSetupSd.sys
              • Path C:\Users\Admin\AppData\Local\Temp\Bka7D25.tmp\BkavSetupSd.sys
              • Size 47KB
              • SHA256 5612490c30e55792b0ab380f058ebf7666c0c3b9207cd58ec7527cfb34e16fc2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              skn9FC7.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\skn9FC7.tmp
              • Size 399KB
              • SHA256 b8056ae3be61827ef1d99fa3cde48112fc2e22f979e5419406222aca1d5cfb18
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              skn9FC8.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\skn9FC8.tmp
              • Size 169KB
              • SHA256 0e08bb3107783e433bc87bdfce0b5240ee960d3c6d58e70a003383627b4f3d29
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WinHTTPLib.log
              • Path C:\WinHTTPLib.log
              • Size 575B
              • SHA256 9db5f81fda290ae306678103ad4bf237b09d45495290b8b7eab061ad9bbaff92
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              WinHTTPLib.log
              • Path C:\WinHTTPLib.log
              • Size 1KB
              • SHA256 11a30ac9025631fd1b37a51066ab339eea460965e24739fe1f11fb4189d2e092
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              WinHTTPLib.log
              • Path C:\WinHTTPLib.log
              • Size 1KB
              • SHA256 4c57878bf2193e7965861ebfd4d619d55497c6cb5ad2ce0c393b29acdc36414d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.2MB
              • SHA256 1d8afe6cfa528953b1b21bacb401bd4c0b7e051dc063731e2c4d2d41df6fcdc5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.7MB
              • SHA256 cd524a8f6f83ea791f750ff9808bfd8bea0c6d0d0ededbbc1445995a52888970
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 1.3MB
              • SHA256 46c1820e0ddd1d9c46ed27cfe5572072377136989bd15961b538586a5551e461
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 d18612c63ccfa76d24a961cd0e11f43563f382a9ae67ce8f8cb655549328dc15
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 1.2MB
              • SHA256 41c1fab644dda42651de529cb16f9a48f1488ea105da60e6dc86e6627ac4e780
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 1.5MB
              • SHA256 ff9c5dea69e31b461ae5297aabd667ad9d1eaf3b0aaa9349f3dac1e175c58f22
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.3MB
              • SHA256 a13c8fc7482dc9ca6f2291307e217de5e9f09387ff294124e83c44d84b332fc1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 a4c0970f42245f97346aa206c8320f45a4abbe46979c3f1004c4edeabbbc2bbc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 151fe1821d1d4c02909d3445e2c68dd50ca3d1143c9200609e0f23cb24501013
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 a7fd5d78c37646224ace24e0acf6e8e26eb20bb4b979a883aa5cc51f382e5b01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 1.5MB
              • SHA256 57ad733765e50bda40ddab4eb9a2465c97e7f6fa44deee5d9f71d9aee4e4b612
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 507590b634a876a7861ae922e28b3ce7466f453fe7d5cad5e675971b157d6f51
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 1.3MB
              • SHA256 89377b28cd1cd56f597df419449ced7f80e6af50bbb8518e1afdd8de16778ebd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 1.3MB
              • SHA256 ec19d8239098ae487cf775a9b4d8da42f4a770844939d6dde45ca647576402cd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 1.2MB
              • SHA256 d66d0087a12cb0c8ebd90fde132a07d01fc8c495927af995976f250ce9c7cf0d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 c89760dede81973e8c33efbe3b802a3ac5b7c375bc77b780a01652d45f7c3788
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 1.4MB
              • SHA256 f3a28737a37ae903c68d61781e647f938a0c7166163fc25202b462d2498e69d5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 9863a21f58775cb88b14c513177960b2d7964e92449bdbab19306c91e896a571
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 3c50cde48e92be72230c9e57bd46efe08247bd95e4a78087f71987737ab028c9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 1.5MB
              • SHA256 651a13f7dd1371b769264abc7b6b4db82fa55bc94cddd2d750c7ac7bbc84cdbc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 1.2MB
              • SHA256 c738967183e9f074307306120e19dd41972af0850c247eaf796fccd22726fe6f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/572-87-0x0000000140000000-0x000000014020E000-memory.dmp
              Download

              memory/572-74-0x00000000004E0000-0x0000000000540000-memory.dmp
              Download

              memory/572-80-0x00000000004E0000-0x0000000000540000-memory.dmp
              Download

              memory/572-170-0x0000000140000000-0x000000014020E000-memory.dmp
              Download

              memory/772-436-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/772-130-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/772-189-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/928-1-0x0000000000B70000-0x0000000000BD7000-memory.dmp
              Download

              memory/928-8-0x0000000000B70000-0x0000000000BD7000-memory.dmp
              Download

              memory/928-0-0x0000000000400000-0x00000000005CB000-memory.dmp
              Download

              memory/928-86-0x0000000000400000-0x00000000005CB000-memory.dmp
              Download

              memory/928-516-0x0000000000400000-0x00000000005CB000-memory.dmp
              Download

              memory/944-49-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/944-52-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/944-43-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/944-158-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/960-165-0x0000000140000000-0x00000001401F8000-memory.dmp
              Download

              memory/960-69-0x0000000140000000-0x00000001401F8000-memory.dmp
              Download

              memory/1248-171-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/1248-400-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/1496-231-0x0000000009E60000-0x0000000009E68000-memory.dmp
              Download

              memory/1496-442-0x000000000DDC0000-0x000000000DDC8000-memory.dmp
              Download

              memory/1496-196-0x0000000001770000-0x0000000001780000-memory.dmp
              Download

              memory/1496-438-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/1496-190-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/1496-212-0x00000000018F0000-0x0000000001900000-memory.dmp
              Download

              memory/1856-182-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/1856-435-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/2324-402-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-410-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-432-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-431-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-430-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-429-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-428-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-427-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-426-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-425-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-424-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-423-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-422-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-421-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-420-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-419-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-418-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-417-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-414-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-413-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-412-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-415-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-416-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-434-0x0000018F43B90000-0x0000018F43C90000-memory.dmp
              Download

              memory/2324-411-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-433-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-409-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-408-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-407-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-406-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-405-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-404-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-403-0x0000018F43990000-0x0000018F439A0000-memory.dmp
              Download

              memory/2324-504-0x0000018F43B90000-0x0000018F43C90000-memory.dmp
              Download

              memory/2444-372-0x0000000140000000-0x0000000140221000-memory.dmp
              Download

              memory/2444-162-0x0000000140000000-0x0000000140221000-memory.dmp
              Download

              memory/2536-114-0x0000000140000000-0x00000001401E9000-memory.dmp
              Download

              memory/2536-13-0x0000000140000000-0x00000001401E9000-memory.dmp
              Download

              memory/2632-30-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/2632-70-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/2924-126-0x0000000140000000-0x00000001401D4000-memory.dmp
              Download

              memory/3156-134-0x0000000140000000-0x00000001401D5000-memory.dmp
              Download

              memory/3156-240-0x0000000140000000-0x00000001401D5000-memory.dmp
              Download

              memory/3280-116-0x00000000006B0000-0x0000000000717000-memory.dmp
              Download

              memory/3280-181-0x0000000000400000-0x00000000005D6000-memory.dmp
              Download

              memory/3280-123-0x0000000000400000-0x00000000005D6000-memory.dmp
              Download

              memory/3280-121-0x00000000006B0000-0x0000000000717000-memory.dmp
              Download

              memory/3336-178-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/3336-401-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/3424-60-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/3424-65-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/3424-67-0x0000000140000000-0x0000000140214000-memory.dmp
              Download

              memory/3424-54-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/3424-63-0x0000000140000000-0x0000000140214000-memory.dmp
              Download

              memory/3604-138-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/3604-139-0x0000000000750000-0x00000000007B0000-memory.dmp
              Download

              memory/3604-292-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/3604-145-0x0000000000750000-0x00000000007B0000-memory.dmp
              Download

              memory/3800-344-0x0000000140000000-0x0000000140241000-memory.dmp
              Download

              memory/3800-159-0x0000000140000000-0x0000000140241000-memory.dmp
              Download

              memory/3800-156-0x0000000000D90000-0x0000000000DF0000-memory.dmp
              Download

              memory/3800-150-0x0000000000D90000-0x0000000000DF0000-memory.dmp
              Download

              memory/3964-167-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/3964-168-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/4496-115-0x0000000140000000-0x00000001401E8000-memory.dmp
              Download

              memory/4496-24-0x0000000140000000-0x00000001401E8000-memory.dmp
              Download

              memory/4496-25-0x00000000006D0000-0x0000000000730000-memory.dmp
              Download

              memory/4496-16-0x00000000006D0000-0x0000000000730000-memory.dmp
              Download

              memory/4856-32-0x0000000000CA0000-0x0000000000D00000-memory.dmp
              Download

              memory/4856-40-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/4856-137-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/4856-38-0x0000000000CA0000-0x0000000000D00000-memory.dmp
              Download

              memory/4972-98-0x0000000000BA0000-0x0000000000C00000-memory.dmp
              Download

              memory/4972-92-0x0000000000BA0000-0x0000000000C00000-memory.dmp
              Download

              memory/4972-100-0x0000000140000000-0x00000001401EA000-memory.dmp
              Download

              memory/4972-177-0x0000000140000000-0x00000001401EA000-memory.dmp
              Download

              memory/5060-185-0x0000000140000000-0x0000000140205000-memory.dmp
              Download

              memory/5060-437-0x0000000140000000-0x0000000140205000-memory.dmp
              Download