Overview

overview

8

Static

static

3

2026-11-12...er.exe

windows10-2004-x64

8

2026-11-12...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 08:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-12_0c2ca89aad6040af5ea5ab3e868546d1_amadey_dharma_elex_glassworm_smoke-loader.exe
  • Size 1.8MB
  • Sample261113-kee2fasv7m
  • SHA256 97f3dccf7846672161c3dd2c9a037891befb268d3232bf54b84632334aaeed64
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 4 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-12_0c2ca89aad6040af5ea5ab3e868546d1_amadey_dharma_elex_glassworm_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-12_0c2ca89aad6040af5ea5ab3e868546d1_amadey_dharma_elex_glassworm_smoke-loader.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3684
    • C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      2⤵
      • Checks processor information in registry
      PID:3924
    • C:\Windows\SysWOW64\CMD.EXE
      CMD.EXE /c fltmc load BkavSetupSd
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Windows\SysWOW64\fltMC.exe
        fltmc load BkavSetupSd
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:1304
    • C:\Users\Admin\AppData\Local\Temp\0937D.tmp\SetupB.exe
      "C:\Users\Admin\AppData\Local\Temp\0937D.tmp\SetupB.exe" x
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1292
      • C:\Users\Admin\AppData\Local\Temp\_IS5786.tmp\Bk4v531up.exe
        "C:\Users\Admin\AppData\Local\Temp\_IS5786.tmp\Bk4v531up.exe" x
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4456
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3332
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4600
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:5212
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2608
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:4536
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    PID:5968
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3320
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:5232
  • C:\Windows\system32\grpconv.exe
    grpconv -o
    1⤵
      PID:3216
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:1244
    • C:\Windows\system32\DRIVERS\BkavSetupSd.sys
      system32\DRIVERS\BkavSetupSd.sys
      1⤵
      • Executes dropped EXE
      PID:5168
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5064
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:896
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:5516
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
        2⤵
          PID:5460
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2440 2452 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
          • Modifies data under HKEY_USERS
          PID:4360
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 1612 2584 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
          • Modifies data under HKEY_USERS
          PID:1148
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:4088
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2440 2452 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:6104
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 1612 2584 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
            2⤵
              PID:5904

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Windows Command Shell

                1
                T1059.003

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Defense Evasion

                Modify Registry

                1
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                4
                T1012

                System Information Discovery

                4
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                • Size 2.7MB
                • SHA256 a119a24c2b34898baed074e9a459316f372ae435cac7ab915606ec6d3ee2f67c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 1.4MB
                • SHA256 63ed9d77b52d76578f661c0776bae059d39823bcf26756b73572cf787c86d03c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 1.7MB
                • SHA256 f058d7744bfcd0f458c47eb455e3cd0de3dbfa6131c377f20495f6f5b59b7277
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zFM.exe
                • Path C:\Program Files\7-Zip\7zFM.exe
                • Size 1.5MB
                • SHA256 c08b7ba4559dd289682e509fda8641dc54811f184f6d48286c6a2d42a19e324a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zG.exe
                • Path C:\Program Files\7-Zip\7zG.exe
                • Size 1.2MB
                • SHA256 46dff447be30ee59581766ca7e54f4a06c2d6973645386c270c4046c520be5c6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall.exe
                • Path C:\Program Files\7-Zip\Uninstall.exe
                • Size 1.2MB
                • SHA256 1a4722fda922ac01420abf81d3cc985c192010affaa7ef70586fc00eecb01fa4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 1.4MB
                • SHA256 a5b865ff20583cb673a493c8d93fa2f51d4163385f459f94a95bb68581f52c6e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 4.6MB
                • SHA256 245eb54dc7c9087d7201cb6fe218efc7dfccd8b1f375f6d9fbe3aa7d8d6a1e0e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 1.5MB
                • SHA256 3b55f0c82f55d651b264593b9065d3ac953f3bff5294b571808db4ed057d846b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 24.0MB
                • SHA256 10cf8b2de1404adf79de2d3943a4aa3d2a97f99690e6bfd394704576898455bf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 2.7MB
                • SHA256 ef41144df99cf6bec88836da3285101410f3c15a3cba7036862080741534d525
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICLUA.EXE
                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                • Size 1.1MB
                • SHA256 b324afab5303e4cbe2457267e01a31c5a4eb8d4c7d47d8f5d5a83475d5534a73
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 1.4MB
                • SHA256 0264dbe5a65723c652b26868ffcee44e6a75eb0e5c88fe381968564e7a4ce4e1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 1.3MB
                • SHA256 8ef2e2ef152106ad67cec70b9f9656671188efbc08826405fa765c2d31fd31f4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 6.6MB
                • SHA256 6a9ff5dcc3f30bc6d36487d482475625342f9fbbc61659e80f35a770fb966aa9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                • Size 6.6MB
                • SHA256 cd41ca8cd8762b5c6cc3565267e578c630bfccb3eefc49cdb28158dce830f141
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 2.3MB
                • SHA256 fc3e3a6d88df9e6c0a09782587ee2dc047e75cdd0e3b7ba9e959f4351ed9359f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 4.0MB
                • SHA256 e0ae7f64d767af1e34354dda1ee703fa285b8ba87ade02c66b2bcc1824c8a8ab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 2.8MB
                • SHA256 6bc8d493d521c7ff12cf2cde5c8cfdb1d3d5582c9ce85f260b25c5582dfade74
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 2.2MB
                • SHA256 9b5e600dbb9ca4fbf656494a64f74451c74150e15131ba4e9e6a9c67ce403529
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                os_update_handler.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                • Size 2.4MB
                • SHA256 81afebf363405cf48e9f1516f54af6b9eea4534a9456e748eb2c0dd7c487481d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_proxy.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                • Size 2.0MB
                • SHA256 e65af4222b7c160fd2edc289911f232a69f77cd333ede880e317171019c55768
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 1.2MB
                • SHA256 0d534f03aaf6e1ae9ac096aeb87f593fa59e6cc30a0216ae8f43c83504de2528
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 1.2MB
                • SHA256 c8e95796463957dade16bc1e70c25c9c002d3627a716c03629f0698c364ec6a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 1.2MB
                • SHA256 e67cbe7797a31c346a0e0fc07ebfd67c0a242c490194007fd6564df25b631dc9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jabswitch.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                • Size 1.2MB
                • SHA256 b399067947f4955e36839946f2bacbb0345bb8b8f0a1b2fc6b4d64ddcd6a228f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 1.2MB
                • SHA256 89ae58bb3a4fe0b1905b4cdb0422bf32bc3611742b661cf6d0104e80467f6502
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jarsigner.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                • Size 1.2MB
                • SHA256 a1149f02edf6cc59a7c7881f1d78d7956ef72b943a60694369c83314759f7771
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java-rmi.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                • Size 1.2MB
                • SHA256 bca4c356d3725e8f34d8e8dc905f75b06e79907e6dc1a8ad4320890386b4d515
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                • Size 1.4MB
                • SHA256 5d963e6124dd6cf9d400dc4d9cc35b95c54203dd883f613e9157313061b17940
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javac.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                • Size 1.2MB
                • SHA256 281b22f97251cc2484190be4619809e097652a2e247c02f577df5733688fe64f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javadoc.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                • Size 1.2MB
                • SHA256 29604a99ea82a94d5159f31a815f47a0fb465e87d88a05a228ec8a7b035f4247
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javafxpackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                • Size 1.3MB
                • SHA256 d3614fc3083ca4428bf2da3ecc20c7d7070299524f209edbe678c941da828925
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javah.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                • Size 1.2MB
                • SHA256 cf034a275bb4a62eca597e99960e64861257d607ca871e399b0a2ad41a5e868e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                • Size 1.2MB
                • SHA256 98b9690c956e2cd6fa7c1e89f104738e9ab64cc978b2e9500dc803e6541a1d16
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javapackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                • Size 1.3MB
                • SHA256 3f537de9104a170880f423ee325e8bc52ddb48c851e2ccea9f61bd8ee2fdc224
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaw.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                • Size 1.4MB
                • SHA256 1ee7af2afca6af5dbb7ecf5fda28f0c74ad29351050e91de3a04d06aad063b64
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaws.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                • Size 1.6MB
                • SHA256 c663286f4dbc76aa8a11721c756e221af969f550fbac6f4c90cf3f1a1f65906c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jcmd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                • Size 1.2MB
                • SHA256 51a6cdb71c3141b1292939ca9cb6cf4e92b8e1c78a24544fe826e3f9546037e3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jconsole.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
                • Size 1.2MB
                • SHA256 aefbf72c8ad656a92bb4a9be9dd1b15208af7c0fd45b5fa8c2873449300d80bc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdb.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
                • Size 1.2MB
                • SHA256 6879e18df41dd99cbb1c050b7f90b6d97c299b02915e7dc91ab84abbf2941574
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdeps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
                • Size 1.2MB
                • SHA256 b8f6e3f91f5f2225796d41b055c7a39aa9fd6dae3c2e978dc0e710ac3ae7dd80
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jhat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
                • Size 1.2MB
                • SHA256 4d48f3d1bfb96241369d03bacdeb0f7d78782f5bf9e551450fd1d73eb5b66186
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jinfo.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
                • Size 1.2MB
                • SHA256 dffab5f89b0fe371ff8b0786d7b2c1946d58a812c95245b368686451c93834df
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MsSense.exe
                • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                • Size 1.6MB
                • SHA256 3e97168ddcf361cb3e49690fa3d73f1ee87e865a3d806f4ee176c754a8240cd3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                NisSrv.exe
                • Path C:\Program Files\Windows Defender\NisSrv.exe
                • Size 3.5MB
                • SHA256 7b0d1a2e307ddbcce851b77bb72ea68cdecbfd5f90a08a7be3291108edd6c549
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wmpnetwk.exe
                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                • Size 1.4MB
                • SHA256 8668d873c5b0d9be5243621d9bc494e87598a4913c7826fa8e2c0a616a0f33a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 1.3MB
                • SHA256 5c20fb7bb5839fa6f2a46e73a749d77ae8a3fe10bf1dc7430585f362dc284bee
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                • Size 1.2MB
                • SHA256 52522aac8547b13e9adcec852289960a8eca1d3f0825dc694482b5724ce36c1b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db-wal
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                • Size 1.1MB
                • SHA256 1bbbc2f3492465f7bae033080a04a5d810953e8f67132c148ea9a7f763c7b798
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db-wal
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                • Size 4KB
                • SHA256 55b360c1caa616b1ba96eeec5c5d8f89aa1a2aa83e9d7daaf9509d4981a62d63
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Bk4vSetupLanguageEng.dll
                • Path C:\Users\Admin\AppData\Local\Temp\Bk4B022.tmp\Bk4vSetupLanguageEng.dll
                • Size 25KB
                • SHA256 ec3eefe4369d8bcac2797f327632ece0f390ddcb8f671781a4cd79aba702f852
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Bk4vSetupLanguageVn.dll
                • Path C:\Users\Admin\AppData\Local\Temp\Bk4B022.tmp\Bk4vSetupLanguageVn.dll
                • Size 25KB
                • SHA256 e17c2d3c51035b2bad2cbd01181c468ab1bfb1b8914598a03ccbbc51a8055198
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                BkavSetupSd.sys
                • Path C:\Users\Admin\AppData\Local\Temp\Bka7797.tmp\BkavSetupSd.sys
                • Size 47KB
                • SHA256 5612490c30e55792b0ab380f058ebf7666c0c3b9207cd58ec7527cfb34e16fc2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                skn563B.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\skn563B.tmp
                • Size 399KB
                • SHA256 b8056ae3be61827ef1d99fa3cde48112fc2e22f979e5419406222aca1d5cfb18
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                skn563C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\skn563C.tmp
                • Size 169KB
                • SHA256 0e08bb3107783e433bc87bdfce0b5240ee960d3c6d58e70a003383627b4f3d29
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WinHTTPLib.log
                • Path C:\WinHTTPLib.log
                • Size 575B
                • SHA256 9db5f81fda290ae306678103ad4bf237b09d45495290b8b7eab061ad9bbaff92
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                WinHTTPLib.log
                • Path C:\WinHTTPLib.log
                • Size 1KB
                • SHA256 11a30ac9025631fd1b37a51066ab339eea460965e24739fe1f11fb4189d2e092
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                WinHTTPLib.log
                • Path C:\WinHTTPLib.log
                • Size 1KB
                • SHA256 4c57878bf2193e7965861ebfd4d619d55497c6cb5ad2ce0c393b29acdc36414d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 1.2MB
                • SHA256 47cc33af246326f5f30492c3bf1b92be281f10e2136a4d3a60168290c29c98e9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\System32\AgentService.exe
                • Size 1.4MB
                • SHA256 bae5edf301d60efac696871ba5fd92d6ce4fc5689c006fdfe7430a5986dc39e4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 1.7MB
                • SHA256 6f2474e88575df782b3f70dc01e88260e6ff6d11df0e61a66858e069d795ddfc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 1.4MB
                • SHA256 2fcf53c6de2e0d6be0214cd66d2044e575d1de4bbc24956f5be4befe82c87c9a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ReFsDedupSvc.exe
                • Path C:\Windows\System32\ReFsDedupSvc.exe
                • Size 2.6MB
                • SHA256 61b4d603124f17e4fee4e323b5a1c3ee651a5b6c8524b67d273aeabe74462fc8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.4MB
                • SHA256 2346bebebf49ba3f7897db52608682bdf924e487268c7ed0732012d020283621
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.7MB
                • SHA256 860fb0d805713a3818fd457d144ba671314c8f0b259c111a2c8d3146417d064e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVClient.exe
                • Path C:\Windows\system32\AppVClient.exe
                • Size 1.3MB
                • SHA256 6d9a2dece8b3859357a48443ead7a35d620695d30e7bfbaf32d971d2ecd4c6cd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SgrmBroker.exe
                • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                • Size 1.6MB
                • SHA256 6e9829b2ff6d2da6702b8df3973bc99ad9637b94c51000b97bade3df12879499
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/896-348-0x0000000140000000-0x0000000140172000-memory.dmp
                Download

                memory/896-160-0x0000000140000000-0x0000000140172000-memory.dmp
                Download

                memory/896-161-0x0000000000620000-0x0000000000680000-memory.dmp
                Download

                memory/896-154-0x0000000000620000-0x0000000000680000-memory.dmp
                Download

                memory/1244-330-0x0000000140000000-0x000000014027D000-memory.dmp
                Download

                memory/1244-121-0x0000000000D70000-0x0000000000DD0000-memory.dmp
                Download

                memory/1244-127-0x0000000000D70000-0x0000000000DD0000-memory.dmp
                Download

                memory/1244-120-0x0000000140000000-0x000000014027D000-memory.dmp
                Download

                memory/2608-54-0x0000000000970000-0x00000000009D0000-memory.dmp
                Download

                memory/2608-204-0x0000000140000000-0x000000014020E000-memory.dmp
                Download

                memory/2608-53-0x0000000140000000-0x000000014020E000-memory.dmp
                Download

                memory/2608-60-0x0000000000970000-0x00000000009D0000-memory.dmp
                Download

                memory/3320-100-0x00000000007F0000-0x0000000000850000-memory.dmp
                Download

                memory/3320-361-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/3320-360-0x00000000007F0000-0x0000000000850000-memory.dmp
                Download

                memory/3320-99-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/3320-93-0x00000000007F0000-0x0000000000850000-memory.dmp
                Download

                memory/3320-312-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/3332-13-0x0000000140000000-0x00000001402E9000-memory.dmp
                Download

                memory/3332-20-0x00000000007B0000-0x0000000000810000-memory.dmp
                Download

                memory/3332-118-0x0000000140000000-0x00000001402E9000-memory.dmp
                Download

                memory/3332-14-0x00000000007B0000-0x0000000000810000-memory.dmp
                Download

                memory/3332-21-0x00000000007B0000-0x0000000000810000-memory.dmp
                Download

                memory/3684-1-0x0000000000D00000-0x0000000000D67000-memory.dmp
                Download

                memory/3684-7-0x0000000000D00000-0x0000000000D67000-memory.dmp
                Download

                memory/3684-92-0x0000000000400000-0x00000000005CB000-memory.dmp
                Download

                memory/3684-6-0x0000000000D00000-0x0000000000D67000-memory.dmp
                Download

                memory/3684-0-0x0000000000400000-0x00000000005CB000-memory.dmp
                Download

                memory/3684-429-0x0000000000400000-0x00000000005CB000-memory.dmp
                Download

                memory/4536-64-0x0000000140000000-0x000000014020A000-memory.dmp
                Download

                memory/4536-244-0x0000000140000000-0x000000014020A000-memory.dmp
                Download

                memory/4536-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                Download

                memory/4536-66-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                Download

                memory/4600-134-0x0000000140000000-0x00000001402D4000-memory.dmp
                Download

                memory/4600-27-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/4600-26-0x0000000140000000-0x00000001402D4000-memory.dmp
                Download

                memory/4600-34-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/4600-33-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/5064-142-0x0000000000810000-0x0000000000870000-memory.dmp
                Download

                memory/5064-136-0x0000000000810000-0x0000000000870000-memory.dmp
                Download

                memory/5064-135-0x0000000140000000-0x0000000140168000-memory.dmp
                Download

                memory/5064-146-0x0000000140000000-0x0000000140168000-memory.dmp
                Download

                memory/5064-144-0x0000000000810000-0x0000000000870000-memory.dmp
                Download

                memory/5168-131-0x00007FF6B39F0000-0x00007FF6B39FE000-memory.dmp
                Download

                memory/5212-49-0x0000000000C00000-0x0000000000C60000-memory.dmp
                Download

                memory/5212-39-0x0000000000C00000-0x0000000000C60000-memory.dmp
                Download

                memory/5212-38-0x0000000140000000-0x0000000140214000-memory.dmp
                Download

                memory/5212-45-0x0000000000C00000-0x0000000000C60000-memory.dmp
                Download

                memory/5212-52-0x0000000140000000-0x0000000140214000-memory.dmp
                Download

                memory/5232-106-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/5232-113-0x0000000000800000-0x0000000000860000-memory.dmp
                Download

                memory/5232-107-0x0000000000800000-0x0000000000860000-memory.dmp
                Download

                memory/5232-315-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/5232-345-0x0000000000800000-0x0000000000860000-memory.dmp
                Download

                memory/5232-347-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/5968-277-0x0000000000400000-0x00000000005D6000-memory.dmp
                Download

                memory/5968-79-0x0000000000400000-0x00000000005D6000-memory.dmp
                Download