Overview

overview

8

Static

static

3

2026-11-12...er.exe

windows10-2004-x64

8

2026-11-12...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 01:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-12_600b894d6404b2f7c4b08f76a4c582d9_amadey_dharma_elex_glassworm_smoke-loader.exe
  • Size 1.8MB
  • Sample261113-cc56vaex3s
  • SHA256 84dc032c1310025919f831f7edc18a4bdd24cab66e2274e0e154adc7a1d0c404
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 4 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 56 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-12_600b894d6404b2f7c4b08f76a4c582d9_amadey_dharma_elex_glassworm_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-12_600b894d6404b2f7c4b08f76a4c582d9_amadey_dharma_elex_glassworm_smoke-loader.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      2⤵
      • Checks processor information in registry
      PID:5792
    • C:\Windows\SysWOW64\CMD.EXE
      CMD.EXE /c fltmc load BkavSetupSd
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3348
      • C:\Windows\SysWOW64\fltMC.exe
        fltmc load BkavSetupSd
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:1800
    • C:\Users\Admin\AppData\Local\Temp\04539.tmp\SetupB.exe
      "C:\Users\Admin\AppData\Local\Temp\04539.tmp\SetupB.exe" x
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5908
      • C:\Users\Admin\AppData\Local\Temp\_ISCC77.tmp\Bk4v531up.exe
        "C:\Users\Admin\AppData\Local\Temp\_ISCC77.tmp\Bk4v531up.exe" x
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1716
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5516
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:356
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:1036
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1300
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:3648
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    PID:4860
  • C:\Windows\system32\DRIVERS\BkavSetupSd.sys
    system32\DRIVERS\BkavSetupSd.sys
    1⤵
    • Executes dropped EXE
    PID:3800
  • C:\Windows\system32\grpconv.exe
    grpconv -o
    1⤵
      PID:6004
    • C:\Windows\System32\ReFsDedupSvc.exe
      C:\Windows\System32\ReFsDedupSvc.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4900
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      PID:2192
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4220
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3068
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1408
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:2696
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
        2⤵
          PID:5204
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:1316
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 3000 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
            • Modifies data under HKEY_USERS
            PID:6104
          • C:\Windows\System32\SearchProtocolHost.exe
            "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:2432
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 3000 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
              PID:1884
            • C:\Windows\System32\SearchFilterHost.exe
              "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
              2⤵
                PID:2832
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:2468

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    Windows Command Shell

                    1
                    T1059.003

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Defense Evasion

                    Modify Registry

                    1
                    T1112

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Peripheral Device Discovery

                    2
                    T1120

                    Query Registry

                    4
                    T1012

                    System Information Discovery

                    4
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Network Configuration Discovery

                    1
                    T1016

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    elevation_service.exe
                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                    • Size 2.7MB
                    • SHA256 650a4d724562f41c94f9e84c01fa23d32b4b5868e68def1ed942762fe13aada3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    maintenanceservice.exe
                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                    • Size 1.4MB
                    • SHA256 773841043d82126f68b2df3c3f20fc22a252f5e20d66e5929a5b1020556290bf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    7z.exe
                    • Path C:\Program Files\7-Zip\7z.exe
                    • Size 1.7MB
                    • SHA256 7ede4acd18dbc1a7545ee3e29917eea302684f4dbba9bd8008559180d3ae9a39
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    7zFM.exe
                    • Path C:\Program Files\7-Zip\7zFM.exe
                    • Size 1.5MB
                    • SHA256 dd77ff8d40a515bfe021a18dec5e15ae32845762dde5d23ace450fdce0ce614c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    7zG.exe
                    • Path C:\Program Files\7-Zip\7zG.exe
                    • Size 1.2MB
                    • SHA256 c1426d27d6699491158a0fae1b933858b91c3e2895807b9f977eb3d8aab61ada
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Uninstall.exe
                    • Path C:\Program Files\7-Zip\Uninstall.exe
                    • Size 1.2MB
                    • SHA256 1e0e259ceb0e1912df786f13c4178350ac2c1bec0b41c3ce2b1484f9ae7a5aa7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AppVShNotify.exe
                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                    • Size 1.4MB
                    • SHA256 e99ac2562b13a9e954ae29c3331611c3d83df089c9204346cce272f6f44071e3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IntegratedOffice.exe
                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                    • Size 4.6MB
                    • SHA256 8c7966b280e8d65d7c7c7a990f8adb5c053b7defd9ed4f11eeba7a42b925723d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MavInject32.exe
                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                    • Size 1.5MB
                    • SHA256 eccab41f3bc36576c41c4b27c8addc56dd8640c9a7cfb12a9ed72ea88de23ebb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OfficeC2RClient.exe
                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                    • Size 24.0MB
                    • SHA256 1f6c66fc9f277afeb5f11f6a835c9402843b533250a7108777b4668057151093
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    appvcleaner.exe
                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                    • Size 2.7MB
                    • SHA256 d2891a753b88efb12d8459845de06dc806461bb8941596e8e35d6541d40c4cfd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    LICLUA.EXE
                    • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                    • Size 1.1MB
                    • SHA256 7a8d43eebef4bfbcf0bef83788e0b0ab395f1d14dabd5c9ec78031ae57820346
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OSE.EXE
                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                    • Size 1.4MB
                    • SHA256 a5da258bd0b10b62f274b6728e7e7ff477cae244ab073acbe2249ec5b896aedd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VSTOInstaller.exe
                    • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                    • Size 1.3MB
                    • SHA256 8ce9cd3868cfa85a134d50332cd1b086303e50c2120daaf15fb0563742a2bd06
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    chrmstp.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                    • Size 6.6MB
                    • SHA256 0473cd3707debf09b78c92ce9b1913b1a7a76398527be18a90addb66b9a2319d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    setup.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                    • Size 6.6MB
                    • SHA256 a3859fd1a1ff758fac4bd72f66ed4fd35cdc11fa712e16ed5c876a9a66dc9446
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    chrome_pwa_launcher.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                    • Size 2.3MB
                    • SHA256 0af25c2c0f667faefda9bb3c5ec92140a3a2b5b4bd38d33c659238a011c978e8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    elevated_tracing_service.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                    • Size 4.0MB
                    • SHA256 60b0fae4377c626e7ed5b91c297ff8d22660edbd89e7651099fbab905bdaf01a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    elevation_service.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                    • Size 2.8MB
                    • SHA256 40ecff9848056ff419f5d0e3345cf13fdbde16530c062ecd0a6f99d13d57dfc0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    notification_helper.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                    • Size 2.2MB
                    • SHA256 6d85838c45fe82dbc2f17b29a82c7f1758e94b8bdd438f93a2e80ae1d2ddcaba
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    os_update_handler.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                    • Size 2.4MB
                    • SHA256 f34797a3c69571cd614b69eec7819ef6fd7665415bcfb9fa1befb415786bb5bb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    chrome_proxy.exe
                    • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                    • Size 2.0MB
                    • SHA256 1014b4f583664d0db6f559aa489ed48e74f4cef0aaee0ebff187e764ebf8e207
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    appletviewer.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                    • Size 1.2MB
                    • SHA256 3a374817da33074a56a69f1a3fb2ef7c090fc7ef4528bd850a209b062bdf3684
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    extcheck.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                    • Size 1.2MB
                    • SHA256 db4cf014becb677b8e332cf71d9ed438e02b1468c0b3a5c53d20fa7ba5dd52a4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idlj.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                    • Size 1.2MB
                    • SHA256 61db1e92d0542fcc336167fa6f1aa045417fd11de8b8b4fdb1a35f5cac894a08
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jabswitch.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                    • Size 1.2MB
                    • SHA256 6e4446cbc48ca3958f1413bf392c66c4d5ae3519f1e2e29f656d5af5c64d2cf0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jar.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                    • Size 1.2MB
                    • SHA256 277cc030b73fd3eaea070f16bc46117e28bc6689a180e9edbfd15f8f7533c419
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jarsigner.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                    • Size 1.2MB
                    • SHA256 5fb4452322be11b0d5c76ea50307beb67554942c03406992c16dd370a8e987e8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    java-rmi.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                    • Size 1.2MB
                    • SHA256 686819eaddcc4ac7657a5307014d22d0c0967ff3e86adb910b832ff97f293a09
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    java.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                    • Size 1.5MB
                    • SHA256 e61519f0aa7531683f9dbb3d3c40304d590a8f60474eda1fd251bb8ffb029686
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javac.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                    • Size 1.2MB
                    • SHA256 acb3520e6390c525a4a9011e821c1a3f385ce38e2a9e752370f72401b334686f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javadoc.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                    • Size 1.2MB
                    • SHA256 ad4a2df34742f9fbc7ac42408996d5f12e1839ba98ea09d243e9a9178affbc32
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javafxpackager.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                    • Size 1.3MB
                    • SHA256 9b3994984fefd85d60ec09f12bcc79340a36978c54710139429d6b3f7cc7e5c8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javah.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                    • Size 1.2MB
                    • SHA256 9ca054cc19071bf76d5a1fbb7fcc04e591f12157d06202a14293dd8dc3ea5024
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javap.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                    • Size 1.2MB
                    • SHA256 d26c9537e58faa8a8fe0cf8bcfe7a2f5968d67fde03cffa2e2099dd78ac16eac
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javapackager.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                    • Size 1.3MB
                    • SHA256 4663562ffc6ffdd8f9b5119679b7b44c1af137a1d081d622dafc4339e55cab2c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javaw.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                    • Size 1.5MB
                    • SHA256 db8aee35da5f8e17b71fb0854bab1b677b44f7b6c3a738555bd21f3b0fa50bb0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javaws.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                    • Size 1.6MB
                    • SHA256 d205732ca9b5cc64405dbd0c213b3d7e348a6da3295cca2ff5067281c13732f5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jcmd.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                    • Size 1.2MB
                    • SHA256 46e704dbfba3bdbc9d4ce3ccb523133e13bfabdc7c5cd5b59bc7e7bf70645711
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jconsole.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
                    • Size 1.2MB
                    • SHA256 90222a1f31ffbca06684b40ab180eb2319b8d7868cce3eddffe12bf8bfd10465
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jdb.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
                    • Size 1.2MB
                    • SHA256 e37bb9bc5a7239f7d42aed1f9517826ecc2eb4ad56f05a1ccd93919c699cdef4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jdeps.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
                    • Size 1.2MB
                    • SHA256 141dac35ae51dbfa074bde267d450d53b8ea22b209d6b09db3125edff4c43212
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jhat.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
                    • Size 1.2MB
                    • SHA256 c817f9430b23ec2dfd732690e2ae33da789fbf9cf69d8e47cc2f4a5468048d6b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jinfo.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
                    • Size 1.2MB
                    • SHA256 b0a872f5d8d3679572926c7e0a9f03af34263917546c9427a2e5b9e03a47d2df
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MsSense.exe
                    • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                    • Size 1.6MB
                    • SHA256 927d028ccd21cca81f52a9d79c38f3c8ae6502688d4d79b2d447e9a07a18094e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    NisSrv.exe
                    • Path C:\Program Files\Windows Defender\NisSrv.exe
                    • Size 3.5MB
                    • SHA256 b8bf04f0ff5c5c7ab5fadfc6eb82b7616fda5db353605a0f2bd27c20df1791f0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    wmpnetwk.exe
                    • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                    • Size 1.4MB
                    • SHA256 ca856d8223addfefcdbb67add190c6f7008564255964f69dae8c6cdc41e1026f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dotnet.exe
                    • Path C:\Program Files\dotnet\dotnet.exe
                    • Size 1.3MB
                    • SHA256 b0021394713b3a05503c3542c53613e4aa79eb5d0dc2e5066790a46caee45fa1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Windows.db
                    • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                    • Size 1.1MB
                    • SHA256 095afabaaae211ea1fa4db3c88d0fefb9ab7299ac929f20be9ba14d7c548da67
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Windows.db-wal
                    • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                    • Size 1.5MB
                    • SHA256 311e431c3449009828bca7f24c73b62c0b16b359e32ae3d5d3a27aadd1996b4e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Bk4vSetupLanguageEng.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\Bk421D8.tmp\Bk4vSetupLanguageEng.dll
                    • Size 25KB
                    • SHA256 ec3eefe4369d8bcac2797f327632ece0f390ddcb8f671781a4cd79aba702f852
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Bk4vSetupLanguageVn.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\Bk421D8.tmp\Bk4vSetupLanguageVn.dll
                    • Size 25KB
                    • SHA256 e17c2d3c51035b2bad2cbd01181c468ab1bfb1b8914598a03ccbbc51a8055198
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    BkavSetupSd.sys
                    • Path C:\Users\Admin\AppData\Local\Temp\Bka2414.tmp\BkavSetupSd.sys
                    • Size 47KB
                    • SHA256 5612490c30e55792b0ab380f058ebf7666c0c3b9207cd58ec7527cfb34e16fc2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sknCB3C.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\sknCB3C.tmp
                    • Size 399KB
                    • SHA256 b8056ae3be61827ef1d99fa3cde48112fc2e22f979e5419406222aca1d5cfb18
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sknCB3D.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\sknCB3D.tmp
                    • Size 169KB
                    • SHA256 0e08bb3107783e433bc87bdfce0b5240ee960d3c6d58e70a003383627b4f3d29
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WinHTTPLib.log
                    • Path C:\WinHTTPLib.log
                    • Size 575B
                    • SHA256 9db5f81fda290ae306678103ad4bf237b09d45495290b8b7eab061ad9bbaff92
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    WinHTTPLib.log
                    • Path C:\WinHTTPLib.log
                    • Size 1KB
                    • SHA256 11a30ac9025631fd1b37a51066ab339eea460965e24739fe1f11fb4189d2e092
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    WinHTTPLib.log
                    • Path C:\WinHTTPLib.log
                    • Size 1KB
                    • SHA256 4c57878bf2193e7965861ebfd4d619d55497c6cb5ad2ce0c393b29acdc36414d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    perfhost.exe
                    • Path C:\Windows\SysWOW64\perfhost.exe
                    • Size 1.2MB
                    • SHA256 08c02929764e5d8d94be02f25a1e54db7ed18175995d9b3e085ca182bea9c5c6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AgentService.exe
                    • Path C:\Windows\System32\AgentService.exe
                    • Size 1.4MB
                    • SHA256 d5bf2f8db189268aba7461fbec344d0c570bbd9f14b03c88276805efed86c010
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ssh-agent.exe
                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                    • Size 1.7MB
                    • SHA256 2310e8b735b13199fb165374ef8b1c27f68bc624db01e494be7ffd565489b435
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    PerceptionSimulationService.exe
                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                    • Size 1.4MB
                    • SHA256 9afd1185abdc9e2f744cebbb80e46167f04c148f30dc1ba05150b06a2b8c0133
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ReFsDedupSvc.exe
                    • Path C:\Windows\System32\ReFsDedupSvc.exe
                    • Size 2.6MB
                    • SHA256 feb7c04a559fdd79184cfa7bb55b87da59042f3087355c0de7279341a2ef147b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SearchIndexer.exe
                    • Path C:\Windows\System32\SearchIndexer.exe
                    • Size 1.4MB
                    • SHA256 c95d7713dce0d8be47aff8ea1f25caf707dea0e74a3451f628ff9433124f7177
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SensorDataService.exe
                    • Path C:\Windows\System32\SensorDataService.exe
                    • Size 1.7MB
                    • SHA256 c0877f0b4a6389a47da196101fc3b16090dccb52fdd350116f85c2ec2bb9b8fc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AppVClient.exe
                    • Path C:\Windows\system32\AppVClient.exe
                    • Size 1.3MB
                    • SHA256 f19aa5970e536b336d8e8cf207fb46a572174d71dc9e9fa8ea589944ec392af4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SgrmBroker.exe
                    • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                    • Size 1.6MB
                    • SHA256 caf4336f470aa72b23e022bfd8ac3c1547ea6449c10bb0544d46be7c368a81c7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/356-33-0x00000000007E0000-0x0000000000840000-memory.dmp
                    Download

                    memory/356-27-0x00000000007E0000-0x0000000000840000-memory.dmp
                    Download

                    memory/356-34-0x00000000007E0000-0x0000000000840000-memory.dmp
                    Download

                    memory/356-26-0x0000000140000000-0x00000001402D4000-memory.dmp
                    Download

                    memory/356-124-0x0000000140000000-0x00000001402D4000-memory.dmp
                    Download

                    memory/1036-52-0x0000000002370000-0x00000000023D0000-memory.dmp
                    Download

                    memory/1036-54-0x0000000140000000-0x0000000140176000-memory.dmp
                    Download

                    memory/1036-38-0x0000000140000000-0x0000000140176000-memory.dmp
                    Download

                    memory/1036-39-0x0000000002370000-0x00000000023D0000-memory.dmp
                    Download

                    memory/1036-45-0x0000000002370000-0x00000000023D0000-memory.dmp
                    Download

                    memory/1300-66-0x0000000140000000-0x0000000140170000-memory.dmp
                    Download

                    memory/1300-67-0x0000000000980000-0x00000000009E0000-memory.dmp
                    Download

                    memory/1300-73-0x0000000000980000-0x00000000009E0000-memory.dmp
                    Download

                    memory/1300-176-0x0000000140000000-0x0000000140170000-memory.dmp
                    Download

                    memory/1408-155-0x0000000000620000-0x0000000000680000-memory.dmp
                    Download

                    memory/1408-347-0x0000000140000000-0x0000000140172000-memory.dmp
                    Download

                    memory/1408-161-0x0000000000620000-0x0000000000680000-memory.dmp
                    Download

                    memory/1408-154-0x0000000140000000-0x0000000140172000-memory.dmp
                    Download

                    memory/2192-112-0x0000000140000000-0x00000001401BA000-memory.dmp
                    Download

                    memory/2192-342-0x0000000140000000-0x00000001401BA000-memory.dmp
                    Download

                    memory/2192-346-0x0000000140000000-0x00000001401BA000-memory.dmp
                    Download

                    memory/2192-344-0x0000000000850000-0x00000000008B0000-memory.dmp
                    Download

                    memory/2192-119-0x0000000000850000-0x00000000008B0000-memory.dmp
                    Download

                    memory/2192-113-0x0000000000850000-0x00000000008B0000-memory.dmp
                    Download

                    memory/3068-138-0x0000000140000000-0x0000000140168000-memory.dmp
                    Download

                    memory/3068-147-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                    Download

                    memory/3068-145-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                    Download

                    memory/3068-139-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                    Download

                    memory/3068-149-0x0000000140000000-0x0000000140168000-memory.dmp
                    Download

                    memory/3584-438-0x0000000000400000-0x00000000005CB000-memory.dmp
                    Download

                    memory/3584-90-0x0000000000400000-0x00000000005CB000-memory.dmp
                    Download

                    memory/3584-0-0x0000000000400000-0x00000000005CB000-memory.dmp
                    Download

                    memory/3584-7-0x0000000000D30000-0x0000000000D97000-memory.dmp
                    Download

                    memory/3584-6-0x0000000000D30000-0x0000000000D97000-memory.dmp
                    Download

                    memory/3584-1-0x0000000000D30000-0x0000000000D97000-memory.dmp
                    Download

                    memory/3648-86-0x0000000000BA0000-0x0000000000C00000-memory.dmp
                    Download

                    memory/3648-80-0x0000000000BA0000-0x0000000000C00000-memory.dmp
                    Download

                    memory/3648-77-0x0000000140000000-0x000000014016B000-memory.dmp
                    Download

                    memory/3648-198-0x0000000140000000-0x000000014016B000-memory.dmp
                    Download

                    memory/3800-93-0x00007FF6AA900000-0x00007FF6AA90E000-memory.dmp
                    Download

                    memory/4220-125-0x0000000140000000-0x00000001401DF000-memory.dmp
                    Download

                    memory/4220-133-0x0000000000D00000-0x0000000000D60000-memory.dmp
                    Download

                    memory/4220-343-0x0000000140000000-0x00000001401DF000-memory.dmp
                    Download

                    memory/4220-127-0x0000000000D00000-0x0000000000D60000-memory.dmp
                    Download

                    memory/4860-91-0x0000000000400000-0x0000000000538000-memory.dmp
                    Download

                    memory/4860-300-0x0000000000400000-0x0000000000538000-memory.dmp
                    Download

                    memory/4900-337-0x0000000140000000-0x00000001402C9000-memory.dmp
                    Download

                    memory/4900-361-0x0000000140000000-0x00000001402C9000-memory.dmp
                    Download

                    memory/4900-106-0x0000000140000000-0x00000001402C9000-memory.dmp
                    Download

                    memory/4900-107-0x00000000004E0000-0x0000000000540000-memory.dmp
                    Download

                    memory/4900-100-0x00000000004E0000-0x0000000000540000-memory.dmp
                    Download

                    memory/4900-359-0x00000000004E0000-0x0000000000540000-memory.dmp
                    Download

                    memory/5516-99-0x0000000140000000-0x00000001402E9000-memory.dmp
                    Download

                    memory/5516-20-0x0000000000E60000-0x0000000000EC0000-memory.dmp
                    Download

                    memory/5516-21-0x0000000000E60000-0x0000000000EC0000-memory.dmp
                    Download

                    memory/5516-14-0x0000000000E60000-0x0000000000EC0000-memory.dmp
                    Download

                    memory/5516-13-0x0000000140000000-0x00000001402E9000-memory.dmp
                    Download

                    memory/6104-358-0x0000022CE6330000-0x0000022CE64FA000-memory.dmp
                    Download