d4e6ed1abddd2b61da3e07819e761c7e0cfd37a426511f9371dabe59e3bed21a

Analysis

max time kernel
91s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.5MB
Sample260709-mc71jsgv8j
SHA256 d4e6ed1abddd2b61da3e07819e761c7e0cfd37a426511f9371dabe59e3bed21a
MD5 abb78a5ae2b21441fd9e056b1514833e
SHA1 1a57ab27616533187d7aa221dfa66be106c75284
SHA512 558027da9a807db3deb190202a8b191067f9b20155054cb55048df30b32a2fad4ad4afe11191d76ec695f55ed3dc714d7c960db4adbe1d3fbfa2d5a13135e257
SSDEEP 12288:jjndvQSr6XvbGIqBGr1m+91PLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcq:jLm5qMr1nDjf9n1i99k32tY5cz84
TLSH
T14675E01077D0C036F1B324764EBEC665967DB9712F2191CFA3C0266E6E70AD1A931B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 12 IoCs

pid	Process
1720	elevation_service.exe
1276	elevation_service.exe
4760	maintenanceservice.exe
4568	OSE.EXE
4256	PerceptionSimulationService.exe
3932	perfhost.exe
3096	ReFsDedupSvc.exe
3024	SensorDataService.exe
5748	ssh-agent.exe
5980	AgentService.exe
1392	SearchIndexer.exe
4904	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\40daa847f4cf0ea5.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120750\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc2aa0958c0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4bf94958c0fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000048c4e4958c0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f27fcc958c0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052c3ae958c0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022ad86958c0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2377119455-1173575704-3843639301-1000\{099FBD42-4646-4A10-A626-E6708801F331}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2377119455-1173575704-3843639301-1000\{5BE02A92-CBA0-4F96-9F64-383359D61A3F}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4976	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
4976	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
4976	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
4976	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
4976	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
4976	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
4976	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
4976	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
4976	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
4976	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1532	explorer.exe
1532	explorer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4976	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	1720	elevation_service.exe
Token: SeBackupPrivilege	3096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3096	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5980	AgentService.exe
Token: 33	1392	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeDebugPrivilege	1720	elevation_service.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
3612	sihost.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5876	AdobeARM.exe
3824	StartMenuExperienceHost.exe
3044	SearchHost.exe
1532	explorer.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 5876	4976	2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe	89
PID 1392 wrote to memory of 4924	1392	SearchIndexer.exe	102
PID 1392 wrote to memory of 4204	1392	SearchIndexer.exe	103
PID 1392 wrote to memory of 4488	1392	SearchIndexer.exe	104
PID 1392 wrote to memory of 5804	1392	SearchIndexer.exe	105
PID 3612 wrote to memory of 1532	3612	sihost.exe	110
PID 5876 wrote to memory of 4904	5876	AdobeARM.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_abb78a5ae2b21441fd9e056b1514833e_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1276

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4760

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4256

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3932

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3096

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3024

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5748

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5980

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2377119455-1173575704-3843639301-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2377119455-1173575704-3843639301-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2924 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:3360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2924 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3348

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1532

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3044

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 5a1f956d76d59b89346bf7ea2e9792d91411aa3a1fb3747d865c99e3cb67a756
MD5 25741dcbf9869ab880b72e8521865d01
SHA1 5b6a6b1bbeae05e2ff707f910742620028d37266
SHA512 99511b61620f91bc8759974aeeefbf09560dd7b317d8651933f3d5905070a3ae82f1cae00d904a54f74d277c8eb7457ca02fdb07078c2dfdf49a6c8fab51669e
SSDEEP 98304:8rbT54hEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTGEHGt4:uonfW/JLGMcblLheTG0N
TLSH
T1F8A6BF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 aae87f4d584b05286905a9a403040f4ddd015800467804e7abfbd68fef6ebadf
MD5 a0bf181b5f89cdb9f57b97962519c752
SHA1 14c31ff926d0c0da99379822d2ee904f3b63771c
SHA512 b91a65dabf71eeb5c41385b62fb3c996e2de5c0ece0ea2f31e9485428206931bad40ea95ea0ae573bcb3e66c5e7b8d8d4fc59de24cf338d5148a1e5451bc2d17
SSDEEP 49152:eTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJfln1i99ZG5v4:eTfiG/nzU90ZEHGt4
TLSH
T17EE5E526A2C8C0EBE5642170CC69BBF900546D78DBA2CDD7BD447E16B9307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.2MB
SHA256 9cf40f82dbf172a0290bfb8fcf82c26c00242606417b6a563d477a6b7b52d4f6
MD5 cc77d57e135294d69c6153dd72e84411
SHA1 262167b43e754bf9eedce16c8696187bb85dc596
SHA512 7aca95be2c67921168304ee38c1ba15bb9c32385e4fe7f7340cc9f6f8dc05f47f6660267fe16f2f7f1b541ff209bcdd91044713bd26a76b2aea0af7403279677
SSDEEP 12288:lFY1LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:zY9f9n1i99k32tY5cz84
TLSH
T16B552313BB45C7A6F51252B60CE58FF8E5BCCA18EF9465A3D311265B2CFC9E4243062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.3MB
SHA256 3b6afd48190564fb22322b88705ca1b799f688aab94f7d1cfa223966690cee92
MD5 a56ae4f7baa7037099c72b3e2f5d7e63
SHA1 466274e8ba7db029542edbf7cfa1d973269df901
SHA512 986ac66eb850e658b819f8113cd4f47faa123dc24acc917cbbad9b8f06cb4fc269385fcde4bffa86e1c655bad06046b34e25b7a2d13a56249493c9b447e9a13c
SSDEEP 12288:r5CFLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:rif9n1i99k32tY5cz84
TLSH
T1A4551222F5C585F1F62601B24C9AAFEAD02CEA384F7094D3F3944F3E297C5E25A71562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 121dac335566caa283f865715523e6ed4987955a76f38d6cbebbc4c85b06f2cd
MD5 dbcc6b55851d298fc36ecbd9ec8c8251
SHA1 82ce9436d5336818698ca7d5e8f8677c8d62f002
SHA512 93c5793b26718e7d089ec657b5cfd3f5c93934c43a92ea3364517121c14e35d70ea86b9e17598994ae362fb553be2cbb7ba8668ed6d0c1810af4691dc62b70fc
SSDEEP 12288:16dVWnxlMEn7nFKbltn+Ch/m6XxLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5c:EATAbD+Omehf9n1i99k32tY5cz84
TLSH
T1C475E01177D0C135F1B329768ABFD728556CB9715F6881CFE3881A6E1DB0AE0A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1b44b86ec5186beec468610200dd9be479f8dc19130a666e12464b59cdf31dd8
MD5 1889f86af61ba0a4f7f073db17e541ee
SHA1 dcdb5668236179d8c749c7af02ad019ed831b18e
SHA512 647db1e7ec4e8eb2dd50bbc2f55d081d1335e050bf82b306388254a2ec3f7ec5d5ebdd32b06ddbd92103b347be2e2f17d530b8f964bb1803484af0b8e6fb9db1
SSDEEP 49152:9b+632BuPkFKRrdE6ohvstBhuXjfS4LWxniln1i99ZG5v4:D3q6sjBNEHGt4
TLSH
T148D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ec89f26488bf3c31c56334fe9bd23bd9d8581ff0c77f200ac097986a7ec9a755
MD5 0f3dad802efb20aa3504e601bc3d9be2
SHA1 43047c7086f1d65d116eb90250a366732ee365b7
SHA512 69f5440858e752e89a5546593ea14c6587d1906dad20f064e633769fadfc154ad815bccbc8bbc8a2d8b9bf7203ca1ec0faac42eff515f0bc424d80c4d8d607df
SSDEEP 12288:h1XLsswWkxy2lRq2czA1LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:PXYfDtczA9f9n1i99k32tY5cz84
TLSH
T176650129B3D408F9FD27827DCCA2C911EA32784547A0E78B03A49A661F377D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 b4304ac30afe7f66f2f635190e041f44ac55893d7761145519d524d916139f9b
MD5 53586335b267f874153416be0dce1111
SHA1 f779003a2cfb0b5b0c56d81bb67b23caa783b1a9
SHA512 527a62a816fc23de72d1323f5b3716394cd283a55b265d3c45f4c315dc4830d9cf96020ca7a0855cdfdaa8a0c2c914ace58e06dbc458176fabfbf012d92b5320
SSDEEP 24576:k0Le5ji0hmxxrMMf9n1i99k32tY5cz84:kPji0Ajrln1i99ZG5v4
TLSH
T135859E16F6748335D073C0B9C5D2A69EED7130865B308ACB4286D77C3E6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b0bfac9f016ca7c91685a673f1395c9ad97c77d4812f20633dd3c4e89eca19c9
MD5 7a3b0097d7dabf896179825a3cac8733
SHA1 cf3dcea10d1c074975a0b9a075d4ff262ce35063
SHA512 4e11e03037419f192762b9046b4d233b90380b566dcc02563381a47fbd8d2a763cd58da730b339b80dd9eb3693cc611af94d71e4cdad6228435d00963323f839
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWn6q8wyu2f9n1i99k32tY5cz84:j/ezSC6vUzPveHjy/ln1i99ZG5v4
TLSH
T1E9756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8db41f70e4d16f00eeb013a4e450545ed99925f2cfa8629a6ef2851242decb6a
MD5 ec3f03917a89dda3f5d28721d418d77b
SHA1 e016fc34646e0e331d4bb77531ecd0cab31ab8a6
SHA512 1991557122559941f4d0b03f6f6964b8824f302eae27558808a5317b4f87b5d2d7278c0ae46e03db7766df05e8c30ebc29368a1f51a9c3ec3490d026777631ef
SSDEEP 24576:zVbqPb88hv/l+Y5f9n1i99k32tY5cz84:zVO88hXl+uln1i99ZG5v4
TLSH
T1D5559E66F5748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2d6373919a993279b7218c265802975f6d11de2fe8f48383fcb81356a354edc0
MD5 06fb68ff96774dd2f2afe8f27cb7b4f7
SHA1 d6721a1c4272ef2fc76362dd1212cb348cc7186e
SHA512 3fbb1eb4b321a8c935c7260e4cb70a317b5856b7196a24df87114af807823503d387d5e930d536f4ddef03ba73431ce2962eb8b915fac17174f4a89e20bd8cd2
SSDEEP 12288:ILsLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:ILIf9n1i99k32tY5cz84
TLSH
T1E3452353F60891D9F72722BA9CD5CDF4AA7C5F0CACE8A812D3617A9738FCD78A050512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0cfb63d987a3724f77c0fd7390adb33f42a5494c4c56de87a35c0f5b0fe0c0e1
MD5 ee652d878987742537c74a253c9ac884
SHA1 29776152d09824e2eaa029b6be480bdf7313d428
SHA512 d01660ee1689534cc0a21a6b4bb721c68011caeecd2e8db8bc9ceadd915d2e526e5686159e244ca50aa72d064e9f7e8a3573f8a1823d8c670ce30de18c5c5116
SSDEEP 12288:NeBNUbTVO86URLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:NJIUBf9n1i99k32tY5cz84
TLSH
T13765CF3BEE28FCD2C23A5DB95A91C640E77278304F61A3CBD165830E9E279E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f58c2d7f0053700fde6ee1c87625ef565bb05a51e8dc9bdccbfe76610d289497
MD5 93d644a541f71367cfa43ccf4a413ff8
SHA1 9f599ea4174f68058dd1bf4eda1e97380f91eb4e
SHA512 9d6f9de0e52b1ffec2ac8061628b9d895197125c14632747a4f98a80998779455c59bf00e7d26d198afff32aea116289eb776f53e30455ef55e12dc2942ec5f8
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THy:mQvGAdlCEL8c/DRNw5CUEHGt4
TLSH
T1B9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6fc070410c7f92a71ae877d90a2b7ee4eb502e907df1789d86d2c8b32ead7989
MD5 cf7541e55b4568d171f32b14cf781b7d
SHA1 26f47227e489a12c7fe6ccfba04e4138e8814087
SHA512 1214dae5a9c8a1121f819be1d5e48d41a29721ea2a95b59d64d87b50a4e6cb5ee4d0f6c4ef47719c23109d04f9a3ff22beedab2ad020e6fb2a07df19ae982a6a
SSDEEP 12288:tAwSfxL/2Dc3RDLLmt0LDQewsAj3LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5/:e0ewsAj7f9n1i99k32tY5cz84
TLSH
T16375E031FE74E036D37B0DB61B66C716583C7A204FA129C3E3A84E9E19746D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7f13f5173b4a0df56519e08b875eae7059c8539543335722b8788d9855bd8dcd
MD5 a92e1df3c641f3e592c16bc3c6c8aae6
SHA1 73f02b04f94ca736c8a8d00c299399e517ee6bf0
SHA512 9ca9aed6755291d5aee07f09bd6c446db7919bb01cccf5d4998ffb8134291d9bc47bb440b05bc85776563bb67f5cf81999ed7807fa3edb2e2207d2e4fb43587c
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHB0N:fUEtQevvqc2W1cpV2tI32
TLSH
T107474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a8386795cfc19c567ac3cb166ec8f8e8aee7bf98d0bc0272a84fff4e6530a0f0
MD5 38fa7b0dba9d9c5b58ba718a85baf719
SHA1 40fd0f58ff19e58271b99f32d3b1c4559fd088df
SHA512 b5fa81392209e7c6620dd5f9999044909ccb4adf3ab42798900f6caa51accfeb1efff7268d1f17d4112087211b58c0d73e5045bbe645781f2b61ea6307b1327b
SSDEEP 49152:cCbRquA/m2yL5zifFiV+XenmE3/zbln1i99ZG5v4:VoqHVjnmAEHGt4
TLSH
T147D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2f8ee79eef2d3019f36b344e676519d1dbcd25a724b460029d2f180356d968fd
MD5 4382a756d172d72d9b82bd7b4859f5eb
SHA1 bb916b8743844f04a6166f4ab888cac574cd75a4
SHA512 f93edd2b329fedc05922301f39c7addf266ca5ccef9595a20cbed72c6a03c927f18d23455c0fe933719bed263d73e546bd353c210084e4f7a00d3a4698f66b16
SSDEEP 24576:tAhGL3IFoiwtA5l7S53af9n1i99k32tY5cz84:tAMUFoiq5Kln1i99ZG5v4
TLSH
T17A359D81E7F945D4F5B3AAB899B68570EA76BCA95E30C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 78d5ba20d30a759656395e60b3428091af9676eb096a65e974415bab2950f01f
MD5 871bef8d5e5d7e632e4d6a63f78afae9
SHA1 5e4d67776899350407107f40384bc7ee8a0ade8a
SHA512 a9f8746a57b8aef7358f0add132c32ac4c4c8bb0640b4e943d2087dc93aaa672ba57c48aed1bb995d4697677642ace3e03e49801ef3686700385d8d86659e622
SSDEEP 12288:amw5HEjsChNVBFgl0WDm+C2LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcL2:zwu4OWff9n1i99k32tY5cz84
TLSH
T1E465F14676A80CF9F9675239C997C536F7B2BC052A60DB1F4360C65B2F37720AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cb96d9d06029c054fe86bc70bd3e42f6377057f3357a5dbf629462a9fd8a36e3
MD5 5c94be10b2b163dd6265655432a02ebb
SHA1 af79922afdb292c68eb358e56720113dc9089cfe
SHA512 ed924339aac15377285ef6d440323cca572bbb079c7a5b45a64220ca5c2004f82ab1224b480d818bc224bff9bb853afb7437b137706257dac95d64f48ff4058e
SSDEEP 12288:ueZ1IynLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:zZu0f9n1i99k32tY5cz84
TLSH
T1AC551257339860F9F223527DCCE18A94E771781967B493CF5324469A2F7AEE42C38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e38ec3b89ec3f9691cd39bff7d04c0c79d9efab540964d397f5da5b6a32f3716
MD5 7e8d1feb9f69ca4c8a630ca193d699d0
SHA1 b039f559a40a817de22304be406b28e631c2407c
SHA512 2f97bf0aa21728bd0d8a7f4796185dd6e3f8eb7535a8d6e154c30c0ac4f4a90167c4d2f283656334839bf1bbec198af6e2d1fa3f352601c086ef57ba8a8a93c0
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ue:6QRQyi36YOcPbLvw2gAf+PN3zEHGt4
TLSH
T177667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4fd61f353a3b64c052435495eab991f8ae10ea95bd1f35093e7376e3a168efde
MD5 1e49d82fce583aa93f044cb6da0d4b1c
SHA1 5c5b40928a99b784778c3a7072844e4f43253075
SHA512 e8b8c29fc995d320ffadcca2938e37ba9e7a5a40adbe6c793ae7529f3d5312d2e125f35f48b0af15d44fbfa1d22abf852fb9023427dc547a000b7cc4e5135eed
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ue:kQRQyi36YOcPbLvw2gAf+PN3zEHGt4
TLSH
T103667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b4ceca193b68bf9dcc2e529c5866e3ee9a7df92fe3f2e36d07053de8ce5fdb63
MD5 a120991ec3e419b1fd32f33997812a62
SHA1 fd84619cb88d9d483f4a28188745287aae80aa7c
SHA512 57148d1e8e953ef6c44bd3a406b1c7b7bad47f6256fbcd92d459568ca5109068607d9f07bd395d63032574a88c244f7dbaa0907062db3ddbacaeb746cc3dd882
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0kf9n1i99k32tY5:o68Qg55nhceWu7PNU3/rln1i99ZG5v4
TLSH
T137B54933B2F600A9D44DE1769F4A873196E17C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c95aca2120ad3b256da393b4ddb89cc4f3e45024f792c29a8bbf2218e71850a5
MD5 c9287c9c70b22410e5b686a7b47d0944
SHA1 5b47dbe4283dd1b82cc72a28908b34364a22a821
SHA512 2a44bbfd846ed821d4529f58b898ea1cc013269f622b55fd5f88fcf145ff68412508ed3ffeb000ce4a0c3daa1b050d2f8cb7dce8066ccb5d92d28ecca1d1697d
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99k:Cy5112gYy5azzVvt69nLKnhZOEHGt4
TLSH
T1C6167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b458957dd6a34a06fd75863ce85c17a41792f4bd368966db31703a6bb856e8fb
MD5 f25cad447b302a79ff2649b433df94dd
SHA1 52ab5aca05543b056a263b35bb755ec0db48c04d
SHA512 b0cc10d258c83b6334b14df539cd82eb7b30d40574cc41f5c2950caeaa8ab40677a55c5aa0a6ff6aed884794dab505a44b3d345ed4e5573cf1f1191e47a28135
SSDEEP 49152:4B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glLln1i99ZG5v4:Su6Jmdxd2dZEHGt4
TLSH
T1EED59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0ea0d4f7e16d1af9fd2da9531a81bbc2cb0f78e7c59f9445c49000acc22b9448
MD5 e88b618146ada3608e287f8e8652d4de
SHA1 e08e7184d7be5b094e3caf6131e6f49ee3e0343f
SHA512 5520d9615c3346fa076f88606d6a02f388d2f981e930515415360d73337bd55fe7a311d3c045a6a34b06f20fb96a76f07290b31e7778dc68eaab027475b21d8b
SSDEEP 49152:g1hpsNoJpF1A63U44CwH7R4xhln1i99ZG5v4:gmifPWRAEHGt4
TLSH
T10AB5BE13F29801E8D05ED17887569632EA72BC450B34B6DF0A90B7962F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 184e4ef610bc4a9516cd9de409a57b190350395d9e207bb09b54e8b09129b645
MD5 d063e0f9ae3ee16593cc77316b357189
SHA1 7e24368424636e9118a02af47c719ae2555fbf88
SHA512 a89e99aa883aecfc21c048c874e1861e18ef65a30a6560a9e1f532628e0f1fbce60d4541b59c79093d8ca68fabf2b418aef386d0454f97af81b04377a0922886
SSDEEP 49152:gSuZQIY0Be2KcRVtOnks6NMHq0ln1i99ZG5v4:65dKii61yEHGt4
TLSH
T1E9C5BF03F2E940E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 52c4de4d5ad22995af69f1bbc112cbb05edd821865193aed902e9f37fc819c68
MD5 33c5203cea831754343e55843362165d
SHA1 1e41f7f9acd87c47686fc0cddce5b76f61c41eff
SHA512 8fc8cc2a3f64d6e7e0c917f7d5189b69f181ac89efec25bc57777ddf646f05fb90ef8ec1dd954082d05a597134905d6bf269e0cb6fc6428f4d4ac1d02bacc045
SSDEEP 49152:FhtSn8EApI0fig3giDn0AP5w9ln1i99ZG5v4:0X2imphsEHGt4
TLSH
T1CA95BE13F2D901E8D05ED178C7468632EA62BC150B38BAEF0A90B7561E7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5705979f083ae3ca2523039154f87c3eb73717a4eacb92afa8b0871e9849cd4d
MD5 2df65512378fbc2ed3443732fb65d720
SHA1 8f39a387684621161c7810f63f6e5ae89e108202
SHA512 afc9ec43074340bb9395b3cbcd63ed8a9b478719a8106dc2e49130c44266447e10224b543d07c143b59ccbe225bada5ea7c0ebf50502551e797e753208b2ad07
SSDEEP 12288:ukLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:uQf9n1i99k32tY5cz84
TLSH
T1A9452353F94882DAF21722BACCD5CDE4E97C5F0CF9E8A452E329265739FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 01fc477bea86e21eaba28f9e5c83d7b6ba60bf7811cf5c1a8cf7b98059456fc9
MD5 b6ef3306764898546d08d28b1a8fa014
SHA1 bfdb8cb424f36cfb3a9faf7337cf0d14d2e208ae
SHA512 5e583dec7b01ca4ab973633c44d6df61d149d4d353cd2c4d549398b6aa547dab2249350008511a005f655e4c94ed540122f0f2ccbf01a9de8dbbe70357b13d8f
SSDEEP 12288:JrLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:JXf9n1i99k32tY5cz84
TLSH
T14E452353F94882DAF21722BACCD5CDE4E97C5F0DF9E8A462E329654339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 56ec9ad19fd5743a5c485c62663c46d7799f2e2f56eff1ec87c4f60c710c332e
MD5 9af679b9637cad0fb71f244baa7e754b
SHA1 bab3c18de5417c32715ca3afbc2f1e9c3b049921
SHA512 292e15f671425b2094849d53b0080ac1563407e9661847886a229b50fd1b3d42ef59a753d02e0c20bea8689b9f7e883a0267887a2b73def9f28cc1a7114bfed4
SSDEEP 12288:cJLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:cpf9n1i99k32tY5cz84
TLSH
T19E452353F94882DAF21722BACCD6CDE4E97C5E0DFDE8A452E329254639FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 75ab27c551e2f0a7ebc9b0c30a07d0f505a41eed1f4ed44f545b58cd6c44e03d
MD5 9391a02c983de6712131571591dbe3f3
SHA1 2436f09239c2b0759d10c68472e0bbba04ef5920
SHA512 a3280f47fd26cc80f38e938d297f44582c36cddf82e479e8e045fc37bdcd1c9f9ba886044cbef28cbe755e803654dba1f4c76e928bd6ac0ab7c73cf92c897f1c
SSDEEP 12288:LViLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:kf9n1i99k32tY5cz84
TLSH
T1BC452353B65841D9F523A2B9CCE2C9A4E6787E4CEAB4A59BD31019473DFCF782420B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e9594587e756a7670fffb43abaefcd1ccf5af3d8ccda16a94128dfca461030bd
MD5 d98e4e8b2eef497702f59a3012a0649a
SHA1 4e284fc601c62ab3a77db343ccf7eb6cb535d16b
SHA512 3ac8204673a167723c1257ae2c9e90fbd0ee9114a2b079140e0b91b106c94af4aac2497dcfbd6930b85e73c3e87f9f87d6caead8dbb1b2bb51459461899b9f70
SSDEEP 12288:pKLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:pyf9n1i99k32tY5cz84
TLSH
T179452353F94882DAF21622BACCD6CDF4E97C5E0DF9E8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 76d8a95ba3236714b9599ea5a96ae4948cb56bb817f147b03aa91a0a71bf979a
MD5 7a9ffed8575c4691e54c8f03fa7b3388
SHA1 a2c63ef2c79aecf9c969eb89e801a095f8b83730
SHA512 beef6a713cc05bd084d892703f500f65036b6256a41e9fa9a6141f6c6a5569665d6a727c305b6831c95a6e6fc403ff9f50ebf10a44b0d031247f4251cc8c60ee
SSDEEP 12288:APLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Ajf9n1i99k32tY5cz84
TLSH
T1F2452353F94882DAF21722BACCD5CDE4E97C5F0DF9E8A452E329664339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 37d50e80ae74d7eb71f42ccfa5d1ed1f68666bb4c017f84eaa2ce3ae6d92d45f
MD5 28ddba542274d22f1eeb9f9cabee781b
SHA1 8c4be8900af71f06d9398214b3d8fcf734a88448
SHA512 63b4cc216573435e00b371ebcf2fbe4f09e82f1a5391446ec264745cf9f630515f746ef9dbbe2537a5126d34cd8aca8467c90e81effb679d488817dda3077442
SSDEEP 12288:zTLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:zPf9n1i99k32tY5cz84
TLSH
T1C4452353F94882DAF21722BA8CD5CDF4E97C5F0CF9E8A452E329655339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9d03b5c512081b4bde68a68a544aa646a280d030dcba4408771d8cacff00901d
MD5 0121ec308f974a01226c80e9700db4f9
SHA1 33ef3c7b73cbd4acd75975999c16fa0bfcf73148
SHA512 9eeab64fb6738085915f8ebde4f1addfa59b0dc7405f6e8c678a8310e8185a71862fb1e0676697320df113edad28e43823ab5616a3b3a17a6b9060567ab7dc3e
SSDEEP 12288:CiZwbVzzFEoS2cPvyLLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:lZMRzFVSO3f9n1i99k32tY5cz84
TLSH
T167650195B39018F8EC27823ECC658D56E6B27C194BB0C61F43A436672F777A01C2DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ac3b5e8bb745c7b87d00a991018f557a8961941db3e0c2b2642a5100d764d761
MD5 20c0eac5b69e6d3ed4bca8022c064962
SHA1 4e25364fa93a2c68cf6c75712cbcf624a5f0365d
SHA512 5891a9a0a3c5f99ff76f8a86f81b48e7246723e95057d36a6561e1acdb393068bf0cc68be79f48d76a1ef9a17524ddd807884e59b702d0e54e070cd459634a6a
SSDEEP 12288:vwLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:vEf9n1i99k32tY5cz84
TLSH
T14A452353F94882DAF21722BACCD5CDF4E97C5F0DF9E8A452E329264639FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 51cbd2e2dc23d865cf0dc4741899fc1489028466ee8d57b64258a504387be5a7
MD5 f83b8e36210a274d12e4e53623d7f486
SHA1 ef1d40e63f5621c20758ccef52f78790fcb986d9
SHA512 59594809b361d22aa96bac7aa39c1845572e03156f6ec03399d85984c920423a5a1ecaf71547f660b61a1390523f63b65921a05827cb6a601be48b028fc6e74f
SSDEEP 12288:lcLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:lYf9n1i99k32tY5cz84
TLSH
T156452353F94882DAF21722BACCD5CDE4E93C5F0DF9E8A452E329664639FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e04aba33a8a791b4fd0b858e9993ec9737de6ae50618f9e82e10cca79a7d5548
MD5 77f2a9e0f20cce92bc5b1554807c5b1d
SHA1 71280305a38d23d452344eeb2861761a1961cc4d
SHA512 3d604ba7de790cd41de4e6dfd93d5079b565aa322f7c15eac3df14ec531b11482ae13db1ea79ac01143f744443d83f432d083d0e3221634c238e2d4be1254121
SSDEEP 12288:NyPz5L8nLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:kzyLf9n1i99k32tY5cz84
TLSH
T131551207B3A430F9E1279239CCA24E51F77578355B609AAF536007773E7BAA06D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 cfbe76e9467da6ddbc79bcf44c9e4f51f76b427c611c5bf4214dfdd1bbc94f64
MD5 c652a7a2b6f9039ca0b6396b1c0500f3
SHA1 a742eb863faffc54fc6185e9fc1c34c8911cb2b1
SHA512 51446c2440b748510ec8f34c092a417d3af322ea1bbb1794aa4fb5240da6d9d28172f99460397269d314e2ce2088d39208eee76eaddecd6558970f9c7d9abf9b
SSDEEP 12288:hwLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:hEf9n1i99k32tY5cz84
TLSH
T13B452353F94882DAF21722BACCD5CDF4E97C5F0DF9E8A452E329264639FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0e67954b2d6239f0dac110d8d46e9f2f18e55f5cb4b776fbcbdbf33fb464a384
MD5 6543e0fa1d6c214f0edf599af0399df7
SHA1 4953d72965762f6334afd4a9be5308baa85f2e4c
SHA512 68f58391207ce993adb1a94866a6d66b98504c9cdf92a6ce841074481cea0a6c508b0ed9e58f995f07943751d3440c0310d36b50778ae5fc96b90d61e7d5e091
SSDEEP 12288:2wLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:2Ef9n1i99k32tY5cz84
TLSH
T1EF452353F94882D9F21722BACCD5CDF4E97C5F0DF9E8A452E329264639FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f74c8e39ff9cac11ed3c4a5d4e0922661ee09b4a3c992bd76b346e10989637d2
MD5 f1b59cd1b4398a787eed10a1cfe1e932
SHA1 44202ac622b1b3a6123316533399f40da1eef05f
SHA512 84947bfe352f9197d7c98a6a0c7af1edf20c0a5d4ee3f8eb7f750cf80e3117b028416942423974b7a58444f5a44caf3700c5947aad8bec15b60c48ec6da2339c
SSDEEP 12288:nyPz5L8nLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:KzyLf9n1i99k32tY5cz84
TLSH
T17F551207B3A430F9E1279239CCA24E51F77578355B609AAF536007773E7BAA06D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a3f1c418543b22a5f60d3a10fb6996a03da638caf469acca8ebb1a7830edf240
MD5 591f4ecadfa9789694bb8f00d3ca3dbc
SHA1 3384ba9269c43837dcfc5cc7c4be960515af5399
SHA512 3f2190356dbfb23367df838fc42294c1eda96a7899717b07b65172eee8aa286667466767026258f8aecde8cd9f6cff0dc80fe162fa1791200d30b015fa2cad47
SSDEEP 12288:3Cd9CWYoaLHF3z0z04PDvhZLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcL2:yTDaLl3z0zDZf9n1i99k32tY5cz84
TLSH
T1306501A5B35018F8EC27823ECC658956D6B27C1A4BB0C61F03A436672F777A01C3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 bb8c5f2bed267de0c83aaba22749b6b43c0061f835325b9215cd9508349c7fb4
MD5 bdea1cbad30e5f7a4227654a1277d5df
SHA1 a87c6cdf4864aee1a2aef6f6a1d015f3a422f0c9
SHA512 b9683341301c60d129b8281ffce95909e93864828af3e1de4c90b6a90075219983e83ada74b380f6cd8d7496736d3b39a517a72aa296f9f13737de4314a27a36
SSDEEP 12288:4i4e7KRdTfgwCHKy7GLbbdIveLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKJ:43vd9CHKy7GZFf9n1i99k32tY5cz84
TLSH
T1FD75CF91F3E810E8F1779A35CC768511DAB67C595B70DA8F03A4265A1F33AE18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 b1cbc15b0733c0588dcc1f3636b97b7d8f82ddcf060e8add902ceeedb905d24c
MD5 8e178646750d2de1af9fb24bf1625110
SHA1 377f8262ed226636ea4982fd2d6cb6b0da025a40
SHA512 4d53632f81d1d0c9242b3c3244bd1082f02bf5b38a3b90e239f3e20ca41402b405dc292b1a7f1f4e49281ef870ee7fff82187de731ef622ab5776cad83fd368a
SSDEEP 24576:DfwvUk9RX6wkyAIof9n1i99k32tY5cz84:ZMnYIoln1i99ZG5v4
TLSH
T1DE85CF29EBDC44E5E177923C89B7460AF6B178581B31C2CF025A53AE1E37EE46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 613e050bd381c0105c7652a6f05b22da53f52fc0e8ef91ddc03e14b4aa7fef79
MD5 d24dbd8fe9bc03d6a2081d1fc9fa763e
SHA1 da4590caa8cbdf57741d7ddfb14c3292a640d55d
SHA512 0d489c24395584fb0c1a9cbaf1b272ac7297effaae676cb60d12946040bd8779269b6894310b9856e8ea6100f1586b37680a69a3f9a274e3f2e2a6717390627f
SSDEEP 49152:YYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dln1i99ZG5v4:PySzPTEHGt4
TLSH
T1CA066C96A16841D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 347fa83619c4f1bf7fea0e39258d2b2024b500b79ef219dca7e94cc22158956b
MD5 da5d97a9db5366a03f3c35fc68bfae6b
SHA1 a4fed3f0187e04323bededa1e49ca492a6d027c8
SHA512 56134643efc46241e01b6ff85c5ad3c9ea037fec16de73283f5f8cd58569f408bc62f763300696b2f3f5a0bc3e92fcd57b6ba66b93090c62a0b1ae20c76c0c89
SSDEEP 24576:r47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYHf9n1i99k32tY5cz84:r47JUQjTirIhCnDHUPfF/tln1i99ZG5
TLSH
T1FB65AE1EA3EC01E5E17A927889158A5AEA71782D1F31CACF1270837D2F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9dfbfab027aa496bc322b41bfa7669d2da0aac4525d7f1a543f33126c99fab20
MD5 bd7b5d9a01c0ce22a6e260c08acab552
SHA1 8eccb6743723560770a279cd6215cc7dcba23764
SHA512 ddf2e1838e25464dbc1be1c67368545bc5f7543a3d924a54732d5f6b8b474304fe77aa08a1944655093d26c37866e2a1aad2e5af96fdc699778ca805aa27eab5
SSDEEP 12288:bbsfALfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:O0f9n1i99k32tY5cz84
TLSH
T1C355F11AE25802D8D02E6279CB958A50F3373C1897E0D3CB53D0F57E2F79AA45DE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 39ff75c08572d41e0eaff0e269769ce32148e1d60138ac97350339d97e0dd585
MD5 5affe05611e04dfefbd5de19328e9257
SHA1 51cae9b370b0f9518008f0160a48354077269208
SHA512 3ccbe1ed0d02eae2ec64bfb358f8e903b3267969114830f5828cd0e6d5788722d99a5628eddd890d6af49e57ca458a079624ab7f3649264d9946098933f5b3a4
SSDEEP 12288:utWeOU3f7Mg1ALTmxAJJUTo+YQnDx0D0FEcS:utWNUP7MguHmU/XQnt04FE
TLSH
T1254527007626D74FC6A940721E36D6CCA770BD42EE44AF0772C8873FD476698BAF5292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.7MB
SHA256 56ddb75523dff1300e5d274405c7696eada56c7b908619114bfc4c8f292ae266
MD5 139daabbf04f60ce0bae0513cb90bf92
SHA1 ed66d59902c2df58fe91f1ced81c925601494f0a
SHA512 869cca3fc5a20e6c02877a053e317019e9c856bccc468381a54f86fe62b256941c2dff290965b8952c32c49f7dacd4c7b791ceb72f28cea997d9844d70bb1dfc
SSDEEP 49152:zWDbDS3q+ISFlSFYSFPSFBSF/SFBSFe2NbOSFc6+b9RMe0zXI:zWD/SFlSFYSFPSFBSF/SFBSFejSFc4z4
TLSH
T166854B416573E34FC9BE80770332968DAB746C06BB853F057388883998B665EB5F63D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 6cd66d72de06f433950d95cc9daa23f8feabd047f5c991e23d7739e56c96400f
MD5 b19be6e93440ad654c0e22b965e569d3
SHA1 a4eefb12000eb272a680c7f3f882bec0b63b302d
SHA512 bb6a9509d15064620a108676bff1e98275a099612b5343fa784c0ebeeb22afed4d901b5bf97f5ff259f5e25cc82bf42f0142a937d392bd39e8309f56d5480545
TLSH
T1C9C08C8791BE509D2B258082F76E3F9690E17114C7694AB033303B06F32080B4C1FC78
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp8543.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp8543.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpA159.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpA159.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 79434a6b4d62321a2bcd46cfb06daa26d41948ed85120dddd790750e3069c37c
MD5 ae48a504b58d9593d35399d16a760ed4
SHA1 086456f771ccbb58db28636fa712a7ea1b8daf56
SHA512 aebe6f79e4fc287a2f805605537853d2e78dc98b43af3d089d27dd215e3e368ef52531c736b1e602086337ac3ec3e344810831410b707a258195248498acd597
SSDEEP 12288:0z7ILfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:ysf9n1i99k32tY5cz84
TLSH
T104452353F64C8599F13722B58CDACDB4A53C6F1CAF94A4D3E315268638BCDF86830A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d01288f556664c3824e20d3c3f4286cc69bd5fefe1c9405b8e598740c7417494
MD5 e469859d198a5f32c46da0d1814b9246
SHA1 9acb3da8d94c38cfb07c6fd055c20067dc1d6b91
SHA512 2db36e04d19a934a46c1d402d2c5d71227f02193914172bf60b5292753de798b740bc595e20d880d5a8776a4ea88bb9c76dbb863685e45a31074faaf35a76505
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bY2f9n1i99k32tY5cz84:agb4mBIBhGFHln1i99ZG5v4
TLSH
T16965AE1E22EC02F5E0F6E2B8CDA64417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 72f69f2c645ce6072859b742a457b8c5c10ce72f793a778a425c99b168f61fa3
MD5 b7242e120f0d3b6a66aaa621b7741753
SHA1 d17a8f90555230e95c46c034cd4504ac88cd7cb3
SHA512 70b7721d6f38f8231c2fa9f5bcc8890f0c1107b5c9979aa208306abd1a8e371cf0cb478e354dc1b993403e7c99a4d5f9bef1c84a8f51cc728dbf75c3109f9efd
SSDEEP 24576:JG88u8FpJqH1bzria7/m3f9n1i99k32tY5cz84:c7ZFPqVea7/uln1i99ZG5v4
TLSH
T12A85F165B7E001F5E477D13889864A63F6B1B8151364EBDF07A88B521F33AE40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c4f7352f68715c63533870963ffd190fbae46b9369b87b12aab7df9eedc2b34f
MD5 417b2ffecd379ecc4c6a348f9c85cdbc
SHA1 5b1a6646e9c27f104fce891c104b44708771d756
SHA512 38a5a009fc8a1a0fefda072f3958b1382fd1c4603ac7905583499d0d6821d512e58c111a84af3d530e07a2128aac0d735f2238d9d0e4d06e74bc84693c82985f
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjln1i99ZG5v4:1G05lO43bmEHGt4
TLSH
T1D0D5CF6E62EC11F9D1BBD17CD9C68A0BEBB23815033456CB02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 417a33ceff25953967cbd991846eb003b84ff4178ab7ce0831ba63f94f066b32
MD5 51f75693904caf5d5bfeb48594556080
SHA1 a247b72ff3ff9d23adcf4424469135083d14140d
SHA512 5871b3586cf5562e3ba13d32eefa117bb59ba114cb2e3dce44347a7c976baef4356890d2d72693881c75d51b6f4327075cf623fe30278d4e7b7622006e8d428f
SSDEEP 24576:ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidndf9n1i99k32tY5cz84:na5POZ3BJt2pasx2+mrln1i99ZG5v4
TLSH
T1C065BF5EA6FC01D5E179D17DC5838A1AF5B1342553319ACB022182BE3F2BEF89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1235d1722dcdb001736a961302f01790d6d14fa5cf104baa5124a3544cb273be
MD5 d4c9f4e9375d402604d583bc33fa2839
SHA1 475c639c37aa9d63e4c359729692957eb8657ea4
SHA512 95188862a219d79a2e13535bda712f6fd3b89f2a8775f7720705ba3e69aa09b71cc18f061b645b22abc695fede973d7f0678051f2d03cba2aa825e34c0e35f57
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7Fk/f9n1i99k32tY5cz84:9Nc/zEOVHFOln1i99ZG5v4
TLSH
T140858C1623E901E4F1BBE1BE89779946FA717869573086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 65116430a2f462c4522ce98ff0626a5034040cbb54240652f3d50b016195f16f
MD5 9ab0ce763d62a2bdba0fc8a8857f79b1
SHA1 ea5eb7e640c967b0e7b7f7f562be0790841c1b4a
SHA512 b331ecedc29ac0069e7425cbc7016998259a572ef56f5f5564ddfe01c9402101fe7fe9ab5b0227f4be0c064e65de77112adb462470c50d1eac0f64f0df88512d
SSDEEP 24576:WTkNvNnaFeYhJNtmZBmvf9n1i99k32tY5cz84:WTMwBtOmvln1i99ZG5v4
TLSH
T12555AF2EB6B846E4E1BEC6B4CD238512E6727461173293CB9390C13F1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3b8b3e5ac8fe00c7565683ba496178b10e954f6655f839e176a1a3fe715bf924
MD5 ca8f769f554248107dfbfc2d429ed21d
SHA1 a4726a884116f3dc395ef219e5631b6b6e346284
SHA512 e36d4f0b4748b546363925e0a4db02cc93fe4965e3d7e0deacbc8e7ecefbd213cc986a80abadb2415e77c4ab8baa0a9847dce5a0066e5a81bd085483611ccd48
SSDEEP 12288:NHvUrBFrEjwaQ/LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:NPUr+NQzf9n1i99k32tY5cz84
TLSH
T1D065E12F72AC18E5F636A17D89828619F77178661751E2CF02E0817E1E77EE87C39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3249edeb1666720c3644f69682afce7d40f32ed0a8bf89b45f3e94255513dd6c
MD5 0796618e3efff530a8f6c8201c07943b
SHA1 8190a1f593194877ffe590eccd997bb02698b4c7
SHA512 d67926c12b7c17190a31863dcbc05cdf8d68b783217fffcd4b3c63b83c610d7ad0aeddcba0425611e970f595103d97925d93af1d2fe3ba4abc9933c6a86c7709
SSDEEP 12288:0QcMxWDXN1Dp/fshBItT1IQgAELfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5cz8:uD3FHshBIYQgAwf9n1i99k32tY5cz84
TLSH
T14975E17EE65C04E4E57BD1BCDAA38A06E77138AD032165DB029481B61F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-135-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1276-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1276-120-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1276-230-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1392-404-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1392-232-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1392-231-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1392-238-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1720-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1720-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1720-200-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1720-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1720-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3024-403-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3024-189-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3024-188-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3024-399-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3024-195-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3024-402-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3044-544-0x0000018F801E0000-0x0000018F802E0000-memory.dmp

Download

memory/3044-551-0x0000018F82ED0000-0x0000018F82FD0000-memory.dmp

Download

memory/3044-550-0x0000018F82A00000-0x0000018F82A20000-memory.dmp

Download

memory/3044-589-0x0000018F94320000-0x0000018F94340000-memory.dmp

Download

memory/3044-575-0x0000018F82DE0000-0x0000018F82E00000-memory.dmp

Download

memory/3044-546-0x0000018F801E0000-0x0000018F802E0000-memory.dmp

Download

memory/3044-545-0x0000018F801E0000-0x0000018F802E0000-memory.dmp

Download

memory/3096-176-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3096-177-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3096-183-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3096-770-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3096-768-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3096-398-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3932-166-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3932-172-0x0000000000A70000-0x0000000000AD7000-memory.dmp

Download

memory/3932-384-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3932-167-0x0000000000A70000-0x0000000000AD7000-memory.dmp

Download

memory/4256-162-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4256-156-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4256-368-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4256-154-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4568-144-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4568-315-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4568-143-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4568-150-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4760-139-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4760-127-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4760-126-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4760-141-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4760-133-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4904-696-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/4904-772-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/4904-778-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/4976-30-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/4976-0-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/4976-1-0x0000000002570000-0x00000000025D7000-memory.dmp

Download

memory/4976-6-0x0000000002570000-0x00000000025D7000-memory.dmp

Download

memory/4976-7-0x0000000002570000-0x00000000025D7000-memory.dmp

Download

memory/5748-203-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5748-201-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5748-209-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5748-400-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5980-228-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5980-223-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5980-214-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5980-221-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download