Overview

overview

8

Static

static

3

2026-11-10...er.exe

windows10-2004-x64

8

2026-11-10...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 09:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-10_144f6ff35bbfcede9762d01b8875be14_amadey_dharma_elex_glassworm_smoke-loader.exe
  • Size 1.8MB
  • Sample261110-ll4ttaed37
  • SHA256 3e079b15aec194ceac9e9ce23f8ca1b176309c8f614702d3328b142c10d92087
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 4 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-10_144f6ff35bbfcede9762d01b8875be14_amadey_dharma_elex_glassworm_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-10_144f6ff35bbfcede9762d01b8875be14_amadey_dharma_elex_glassworm_smoke-loader.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      2⤵
      • Checks processor information in registry
      PID:4308
    • C:\Windows\SysWOW64\CMD.EXE
      CMD.EXE /c fltmc load BkavSetupSd
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Windows\SysWOW64\fltMC.exe
        fltmc load BkavSetupSd
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:1444
    • C:\Users\Admin\AppData\Local\Temp\07343.tmp\SetupB.exe
      "C:\Users\Admin\AppData\Local\Temp\07343.tmp\SetupB.exe" x
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3668
      • C:\Users\Admin\AppData\Local\Temp\_ISE718.tmp\Bk4v531up.exe
        "C:\Users\Admin\AppData\Local\Temp\_ISE718.tmp\Bk4v531up.exe" x
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2328
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3148
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4052
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:4144
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:5136
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:4620
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3808
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3372
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:4948
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:896
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3188
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:4696
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:5280
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 1600 1576 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:1820
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 1652 1616 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:4368
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:2940
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 1600 1576 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:3524
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 1652 1616 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:1752
        • C:\Windows\system32\grpconv.exe
          grpconv -o
          1⤵
            PID:3392
          • C:\Windows\system32\DRIVERS\BkavSetupSd.sys
            system32\DRIVERS\BkavSetupSd.sys
            1⤵
            • Executes dropped EXE
            PID:552

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Windows Command Shell

                1
                T1059.003

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Defense Evasion

                Modify Registry

                1
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                4
                T1012

                System Information Discovery

                4
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                • Size 2.7MB
                • SHA256 715acb10464241730dd0eef67141b120fc2f24bfc36e8c148b1f042aa591f3ec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 1.4MB
                • SHA256 6574c7eb3aee33e5d29bb2ceef6ce435be1daf0fa0112810a97833d37c636201
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 1.7MB
                • SHA256 fdae42eac86765ea04b7757631af6d518fc0ddb814d3d9dd672a982cb8104112
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zFM.exe
                • Path C:\Program Files\7-Zip\7zFM.exe
                • Size 1.5MB
                • SHA256 80a1df8cecf60d1a065b95621b5ecea5fcff3bed6e6a376a655797c9c51e4e0d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zG.exe
                • Path C:\Program Files\7-Zip\7zG.exe
                • Size 1.2MB
                • SHA256 5c9197a9908a8c0989122b1f7bc766564e2ea97399b7e0c916586ca9261ea144
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall.exe
                • Path C:\Program Files\7-Zip\Uninstall.exe
                • Size 1.2MB
                • SHA256 88c2ed6e3e2b4430428d5bce76f71881d3c8a15be6422cd8fee2e0db5e3cbbb1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 1.4MB
                • SHA256 62be5dd51e69eddc61eec0a711121a6aca7e95eb5720c1e7df8b7be7dc333140
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 4.6MB
                • SHA256 bc0c46d4be191d6c42ad3923c8a545187ef5a8b8a129f2eef5d830e32dd33bd3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 1.5MB
                • SHA256 83e22f2712c3a6d1524d867d6f745f04ffe07a5b5d0c75cd0db6478cb3cf652e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 24.0MB
                • SHA256 d419885e4c3539558efc7e2aba43564e06b6b134d55c109694f6bbf345b3198e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 2.7MB
                • SHA256 8b6b8f17cb4d538dbd876a5bdcad4684215010f3ad28a9dec13e49c47760c7e6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICLUA.EXE
                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                • Size 1.1MB
                • SHA256 dcce92cd9d4f475add099e58a4a1143422641962f497e42afa2ac24bdd7629f4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 1.4MB
                • SHA256 9b51d4c59951955d532a7bdbda6cb7319d636de3aeb110476289232daca4a632
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 1.3MB
                • SHA256 0f3ae8d4ae6a88590e361d5b55de991f033aab5195f5c0d529ce0bb31eb8117e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 6.6MB
                • SHA256 d5378b8d3fc77bfc05ca78d12c00aee21898235cd872920f11dfc0018698e382
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                • Size 6.6MB
                • SHA256 a69dc143ece1c453667735376b68cc5a3845f86728b64a4c185cd7f4a90ab966
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 2.3MB
                • SHA256 a6c0817a6c70061023c37effb79fb68a5f0dc6a81bc709cf8f4455491fa02067
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 4.0MB
                • SHA256 d66e946dfeeb8a4ba769e7d24d8860c099dbaa739df67aec49fd28048a4f98c7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 2.8MB
                • SHA256 818c10681ae3aedce258d74ba74ccee17e873b29e09eb66a506992008a3d83d8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 2.2MB
                • SHA256 438c666e39d976dfae35948c22bd2bf7f69c9d87992a24dded6e8ad313342426
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                os_update_handler.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                • Size 2.4MB
                • SHA256 2acda337d6a171a73b7192f80c4b6b165297058e398346f5ef24faa316ecfa07
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_proxy.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                • Size 2.0MB
                • SHA256 b8b6de155c4466bb6290e15b58b1a7c7e6bd15a2c2afd418230eee653b51e687
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 1.2MB
                • SHA256 54196eb1df3754175cc791d609b8f4e35352331e292c56ab84add629786c1517
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 1.2MB
                • SHA256 098b6116b677d944b48733aead3f107099da80efcb1eb24e9509a6a276f3c714
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 1.2MB
                • SHA256 a59047cc8f2cf360621c3ac47514184bcd3f733949c8d8f2c912b0ee6746edf6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jabswitch.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                • Size 1.2MB
                • SHA256 daf72af42d7a83c1dad2345a77596b5af03dbb51ee647c9095b04bfd2f1ba257
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 1.2MB
                • SHA256 bb487f2eaac15079b2f1742f7b689d6c9a579696cf95dfb2cac7c5ddcc3833a5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jarsigner.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                • Size 1.2MB
                • SHA256 91c5731a43a4184d119efc50031aab2391457435702312cc7472389846477772
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java-rmi.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                • Size 1.2MB
                • SHA256 a287a720601d711af65197cf8158935ffb1afe907cd54d90b432e3e64184e739
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                • Size 1.4MB
                • SHA256 95b5b0402b1b00d27a5022f4e6d5503eb7dcc296891dec3804c7bd10fa16952c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javac.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                • Size 1.2MB
                • SHA256 a8278375be9b06a5f5c8c3a597a5f6e97a28deb23e48884a894de8ebad251542
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javadoc.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                • Size 1.2MB
                • SHA256 86ef4049a86dd5a28d9852d4c65a062b7bbd4ff98061518afd359a7728a711a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javafxpackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                • Size 1.3MB
                • SHA256 97d63333d8b7715d12f4a6010a2df7585fea48223f229e9eb75db85aa2d1467c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javah.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                • Size 1.2MB
                • SHA256 1fde0f82cad918ce44c8b42066941e3841d84efce76895b12a2ddf9871bd6fec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                • Size 1.2MB
                • SHA256 19c72d703c44f6d7c44da81266116c6dac5cd04ad01d34dcdc6b8077d044a956
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javapackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                • Size 1.3MB
                • SHA256 cc95e19ce4bb061e45c86d024651e92407fa11d75ee425f4b352e8cf34445707
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaw.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                • Size 1.4MB
                • SHA256 b41f0c3009c4ea85dbdd1157a59ff7230f1b41615bbcc7280c4985bb44d18a08
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaws.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                • Size 1.6MB
                • SHA256 a727437649e51e469d163e485e98fa2cf1c2ac264ab7f9f8637457d8d3e500e1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jcmd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                • Size 1.2MB
                • SHA256 f880c842a8022bb086baa17fd34430736008130edc0ae6652b539e1a4a87613c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jconsole.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
                • Size 1.2MB
                • SHA256 2c64c496c7fc12111355c0e2ad01a3d73c98e98d617acbfb42cc94138a999b80
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdb.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
                • Size 1.2MB
                • SHA256 e1cd10bfb32b7abb2d4ff4c45a451b9f71cf9dc2559afe88a5b936f4de2c19f2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdeps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
                • Size 1.2MB
                • SHA256 5e2970a4045cacfe0adc7652102a451a3106198e403b30482df2dcd56724b0e6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jhat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
                • Size 1.2MB
                • SHA256 d4802312323a8b42dd6a1ba78e71d08ce93c8ecd4f560d2cf14d2d50d09b0843
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jinfo.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
                • Size 1.2MB
                • SHA256 c653592fdeffa479eebd98718d092b5d5fb54ddba70c8686cca1716d4897227b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MsSense.exe
                • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                • Size 1.6MB
                • SHA256 8f9d3031add1d83b8baada06ff93c90ef2fdb36447c23d7be161395b64424e77
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                NisSrv.exe
                • Path C:\Program Files\Windows Defender\NisSrv.exe
                • Size 3.5MB
                • SHA256 a0b0f07281cbea84b68b162f52e139801cf1d33f6d50a7da3f3b3df738c31008
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wmpnetwk.exe
                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                • Size 1.4MB
                • SHA256 26851bcb8ee31c42e0da1add3d95f0f6f5077044fc5e0f872323c3571cee5aa4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 1.3MB
                • SHA256 1a3390117d3bedf1527dff484df756a11ed09bf75ff105edf2938c0afea9c895
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                • Size 1.0MB
                • SHA256 4b37655d04c2a4714e718c522704142777d9df5ccb4edd791fab1f58b318554d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db-wal
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                • Size 1.4MB
                • SHA256 f59175b660dcf891af99ef3ad2c55a72e700813e1064c23db7209cbea49ce7c5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Bk4vSetupLanguageEng.dll
                • Path C:\Users\Admin\AppData\Local\Temp\Bk43E8C.tmp\Bk4vSetupLanguageEng.dll
                • Size 25KB
                • SHA256 ec3eefe4369d8bcac2797f327632ece0f390ddcb8f671781a4cd79aba702f852
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Bk4vSetupLanguageVn.dll
                • Path C:\Users\Admin\AppData\Local\Temp\Bk43E8C.tmp\Bk4vSetupLanguageVn.dll
                • Size 25KB
                • SHA256 e17c2d3c51035b2bad2cbd01181c468ab1bfb1b8914598a03ccbbc51a8055198
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                BkavSetupSd.sys
                • Path C:\Users\Admin\AppData\Local\Temp\Bka4ED2.tmp\BkavSetupSd.sys
                • Size 47KB
                • SHA256 5612490c30e55792b0ab380f058ebf7666c0c3b9207cd58ec7527cfb34e16fc2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sknE58F.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\sknE58F.tmp
                • Size 399KB
                • SHA256 b8056ae3be61827ef1d99fa3cde48112fc2e22f979e5419406222aca1d5cfb18
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sknE590.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\sknE590.tmp
                • Size 169KB
                • SHA256 0e08bb3107783e433bc87bdfce0b5240ee960d3c6d58e70a003383627b4f3d29
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WinHTTPLib.log
                • Path C:\WinHTTPLib.log
                • Size 575B
                • SHA256 9db5f81fda290ae306678103ad4bf237b09d45495290b8b7eab061ad9bbaff92
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                WinHTTPLib.log
                • Path C:\WinHTTPLib.log
                • Size 1KB
                • SHA256 11a30ac9025631fd1b37a51066ab339eea460965e24739fe1f11fb4189d2e092
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                WinHTTPLib.log
                • Path C:\WinHTTPLib.log
                • Size 1KB
                • SHA256 4c57878bf2193e7965861ebfd4d619d55497c6cb5ad2ce0c393b29acdc36414d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 1.2MB
                • SHA256 a5e4266ca1e011eae8a6c96b185e4447facdff3ccc1a6a700b7e11df20994416
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\System32\AgentService.exe
                • Size 1.4MB
                • SHA256 7e7e5b3489ac79f1c593bb08080804cadbefe5ae7519faa0f654e7f9fe0e7d8f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 1.7MB
                • SHA256 758bf3bb827eb3503d3002594d94e2b787a2fd1ebce0a565b44bf2616467b4b4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 1.4MB
                • SHA256 7147c5e098f926b811fe7c94afc9bcbae6f46c4b55dcdefa28fb22afe93632ed
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ReFsDedupSvc.exe
                • Path C:\Windows\System32\ReFsDedupSvc.exe
                • Size 2.6MB
                • SHA256 53cf10cfb49defb199146c2b39f90dc1c2f9a895d75604d17ee28b801859b59e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.4MB
                • SHA256 b4d050c0c384d37751041c2b8ecb1920e4880e4a07d8236aaf0283759b79bf8e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.7MB
                • SHA256 99a730d2e75679eec995424f361ad9173bc14fe06cfa68b4ffef3968d79e205b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVClient.exe
                • Path C:\Windows\system32\AppVClient.exe
                • Size 1.3MB
                • SHA256 65045264840f1fc20af83a6481d3ab0c3d40f980db8f11c160712ac6eb03fed0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SgrmBroker.exe
                • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                • Size 1.6MB
                • SHA256 d7f1578c70eadc6d8806c0349d901291928b40113f431348fa1461673350f34d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/552-180-0x00007FF683940000-0x00007FF68394E000-memory.dmp
                Download

                memory/896-314-0x0000000140000000-0x000000014027D000-memory.dmp
                Download

                memory/896-114-0x0000000140000000-0x000000014027D000-memory.dmp
                Download

                memory/896-133-0x0000000000E10000-0x0000000000E70000-memory.dmp
                Download

                memory/896-127-0x0000000000E10000-0x0000000000E70000-memory.dmp
                Download

                memory/1064-157-0x0000000000620000-0x0000000000680000-memory.dmp
                Download

                memory/1064-163-0x0000000000620000-0x0000000000680000-memory.dmp
                Download

                memory/1064-354-0x0000000140000000-0x0000000140172000-memory.dmp
                Download

                memory/1064-156-0x0000000140000000-0x0000000140172000-memory.dmp
                Download

                memory/1752-506-0x00000253EE480000-0x00000253EE64A000-memory.dmp
                Download

                memory/2716-85-0x0000000000400000-0x00000000005CB000-memory.dmp
                Download

                memory/2716-1-0x0000000000BC0000-0x0000000000C27000-memory.dmp
                Download

                memory/2716-6-0x0000000000BC0000-0x0000000000C27000-memory.dmp
                Download

                memory/2716-443-0x0000000000400000-0x00000000005CB000-memory.dmp
                Download

                memory/2716-0-0x0000000000400000-0x00000000005CB000-memory.dmp
                Download

                memory/2716-7-0x0000000000BC0000-0x0000000000C27000-memory.dmp
                Download

                memory/3148-110-0x0000000140000000-0x00000001402E9000-memory.dmp
                Download

                memory/3148-13-0x0000000140000000-0x00000001402E9000-memory.dmp
                Download

                memory/3148-22-0x00000000007B0000-0x0000000000810000-memory.dmp
                Download

                memory/3148-14-0x00000000007B0000-0x0000000000810000-memory.dmp
                Download

                memory/3188-140-0x00000000006B0000-0x0000000000710000-memory.dmp
                Download

                memory/3188-139-0x0000000140000000-0x0000000140168000-memory.dmp
                Download

                memory/3188-146-0x00000000006B0000-0x0000000000710000-memory.dmp
                Download

                memory/3188-153-0x0000000140000000-0x0000000140168000-memory.dmp
                Download

                memory/3188-150-0x00000000006B0000-0x0000000000710000-memory.dmp
                Download

                memory/3372-366-0x0000000000750000-0x00000000007B0000-memory.dmp
                Download

                memory/3372-86-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/3372-230-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/3372-87-0x0000000000750000-0x00000000007B0000-memory.dmp
                Download

                memory/3372-93-0x0000000000750000-0x00000000007B0000-memory.dmp
                Download

                memory/3372-368-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/3524-505-0x0000022C54A50000-0x0000022C54C7D000-memory.dmp
                Download

                memory/3808-75-0x0000000000400000-0x00000000005D6000-memory.dmp
                Download

                memory/3808-81-0x0000000000940000-0x00000000009A7000-memory.dmp
                Download

                memory/3808-76-0x0000000000940000-0x00000000009A7000-memory.dmp
                Download

                memory/3808-198-0x0000000000400000-0x00000000005D6000-memory.dmp
                Download

                memory/4052-26-0x0000000140000000-0x00000001402D4000-memory.dmp
                Download

                memory/4052-138-0x0000000140000000-0x00000001402D4000-memory.dmp
                Download

                memory/4052-27-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/4052-35-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/4144-115-0x0000000140000000-0x0000000140214000-memory.dmp
                Download

                memory/4144-49-0x0000000001B40000-0x0000000001BA0000-memory.dmp
                Download

                memory/4144-39-0x0000000001B40000-0x0000000001BA0000-memory.dmp
                Download

                memory/4144-45-0x0000000001B40000-0x0000000001BA0000-memory.dmp
                Download

                memory/4144-38-0x0000000140000000-0x0000000140214000-memory.dmp
                Download

                memory/4368-365-0x0000029C36AA0000-0x0000029C37120000-memory.dmp
                Download

                memory/4368-463-0x0000029C36AA0000-0x0000029C37120000-memory.dmp
                Download

                memory/4620-65-0x0000000000C10000-0x0000000000C70000-memory.dmp
                Download

                memory/4620-71-0x0000000000C10000-0x0000000000C70000-memory.dmp
                Download

                memory/4620-63-0x0000000140000000-0x000000014020A000-memory.dmp
                Download

                memory/4620-185-0x0000000140000000-0x000000014020A000-memory.dmp
                Download

                memory/4948-328-0x00000000007B0000-0x0000000000810000-memory.dmp
                Download

                memory/4948-330-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/4948-105-0x00000000007B0000-0x0000000000810000-memory.dmp
                Download

                memory/4948-263-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/4948-98-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/5136-53-0x0000000000860000-0x00000000008C0000-memory.dmp
                Download

                memory/5136-59-0x0000000000860000-0x00000000008C0000-memory.dmp
                Download

                memory/5136-179-0x0000000140000000-0x000000014020E000-memory.dmp
                Download

                memory/5136-52-0x0000000140000000-0x000000014020E000-memory.dmp
                Download