1e2e7c60e200ea74679d096024513a347104fc4b386ee3c88e5af944491a8b78

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.6MB
Sample260803-nt7xjsgh36
SHA256 1e2e7c60e200ea74679d096024513a347104fc4b386ee3c88e5af944491a8b78
MD5 6ceed1a8dcb747b7ccee0cccd3e71f6d
SHA1 ebeb8590340f7e9fa90d8af09a5049b307f68e1e
SHA512 1b61ed6320481866def6b7125f509533a1975f26e02cfe0204287690d1f5d5bed41b696d8fa86c458cd084372bac6c932b5186f54416d8e71ec73e5787ebfa24
SSDEEP 24576:RLv5qMr1nDB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l5qMVLNiXicJFFRGNzj3
TLSH
T12175E01077D08036F5B324764A7E8669956DBD715F2181CFB3C02A2E9E70BD1EA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1492	elevation_service.exe
1844	elevation_service.exe
2844	maintenanceservice.exe
52	OSE.EXE
4244	PerceptionSimulationService.exe
5592	perfhost.exe
6088	ReFsDedupSvc.exe
5320	SensorDataService.exe
3104	ssh-agent.exe
5452	AgentService.exe
3344	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6195646e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000905dcf403d23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f69453f3d23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8aa0d823d23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e8ac5403d23dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000926ffb403d23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed39a2813d23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000466a58813d23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000daa7da423d23dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd85ab813d23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095e26d403d23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4680	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
4680	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
4680	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
4680	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
4680	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
4680	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
4680	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
4680	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
4680	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
4680	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
1492	elevation_service.exe
1492	elevation_service.exe
1492	elevation_service.exe
1492	elevation_service.exe
1492	elevation_service.exe
1492	elevation_service.exe
1492	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4680	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	1492	elevation_service.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5452	AgentService.exe
Token: 33	3344	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeDebugPrivilege	1492	elevation_service.exe
Token: SeDebugPrivilege	1844	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5780	AdobeARM.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 5780	4680	2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe	90
PID 3344 wrote to memory of 4756	3344	SearchIndexer.exe	102
PID 3344 wrote to memory of 460	3344	SearchIndexer.exe	103
PID 3344 wrote to memory of 4340	3344	SearchIndexer.exe	104
PID 3344 wrote to memory of 1768	3344	SearchIndexer.exe	105
PID 3344 wrote to memory of 5340	3344	SearchIndexer.exe	107
PID 3344 wrote to memory of 3432	3344	SearchIndexer.exe	108
PID 3344 wrote to memory of 1216	3344	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6ceed1a8dcb747b7ccee0cccd3e71f6d_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2844

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:52

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5592

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5320

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3104

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5452

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 46004773ff0e1a263a1f5ac7135291df78314fb331d8a1be3b83ab3b5aeb77d0
MD5 19be057f17f3edf900983da401d2bacd
SHA1 1c440149f168944d6da7c66b7a47f884ad73f46b
SHA512 f3e92e89274e17ad0341d44eda9b6f3a4ee47e672d976e90dc5621ff9f9aed823c7d58bedc568735191e8e0196117c9c37a4d1cedf5f2fd4204995c4648bcd25
SSDEEP 49152:Zb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnLLNiXicJFFRGNzj3:v3q6mjBI7wRGpj3
TLSH
T124D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a8435acda743d58031bce9e213a7c399d3703befb2caa6ef48a1c6fa4798b398
MD5 7c051880ac456618cdb2d56e95a57388
SHA1 570e5bc4adfa7aa11d46b3f768e4a06d436a2a3f
SHA512 e4ca897cb37937103397f689992f321fb14eb6d61f797d67e5b72256ef6d1ca10f602157a3826ee37324714dc1300af56c9e91ff25139ab73703df52fa5668c0
SSDEEP 24576:iXYfDtczA//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ptcSLNiXicJFFRGNzj3
TLSH
T1DD75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 46555eeed42377ad11a98d0372e59ef82a31af1a6c1062a1d94dcefd73b145f4
MD5 e95cc522a67d4b9f231d5aea6b28440c
SHA1 c3310c79ac918fcb15553fd9489f7ec9e9650ba7
SHA512 4cb8ea256ceb2781f832b5f75352af8fbf21eb00960121246e4542b604d0a5ba1fa57609e81a83e9ab9028de92da010ab026df1b2621a68716e7cd1525b82542
SSDEEP 24576:R0Le5ji0hmxhrMs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RPji0AzZLNiXicJFFRGNzj3
TLSH
T1DB859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 eca456c6061465d2989fcd1a381ae3c4e5b772123e6086e430f6bb4b6303e968
MD5 ec820c03e40121569cb973ce9007992b
SHA1 e5bf84fa8b94a1afbc13d7aac4469a043f539316
SHA512 63b97945f0f290ea8f25f417a83a26727b33aab0c65ea37a184aa6148e4e3a5d282bafdaea6bf1bc3eb2f145f45d050a3ddd148df9bf583914fd4060fe855748
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWj6q8wyuC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+/ezSC6vUzPv+HjyVLNiXicJFFRGNzj3
TLSH
T15E756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 702e25c69638733b9c23efb1afa24f7f7649cbd6ec506286f689d29978673941
MD5 86a9aaed059067136ebb36f1df635db8
SHA1 f425d5109992c6b8c1628a0a0f93b64e3fac074e
SHA512 d93908e4c52c5d1c35ce7448d7dcaf6435f9704f373a500be172b2bcf194fdba7a0b0a50203275c8653c5410ce5710e24a1edd48dd8d4bd65241c351be056097
SSDEEP 24576:5VbqPb88hv/l+BT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5VO88hXl+5LNiXicJFFRGNzj3
TLSH
T1AE559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 884b5bc0ff69f1c6b7c427b06fa5efd38d7c1e6082bee2c34ded92264b25c554
MD5 cdc4821b9424f428b1d78c08a3fa793a
SHA1 1f12a4fd84da87fbd721772cf162943033faed08
SHA512 73ee5de90197c6a3e3309b1145976af8cc1c014a8c1e69103812dea5d1761784763870e61f710b8c6c8c3ac3a9ebab1f93a07002df1fe1a7a5078fceb64a638a
SSDEEP 24576:vGw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hLNiXicJFFRGNzj3
TLSH
T14C5523D3468855B1FBFD003A867A5828B5845E2CCA595DE2D2503E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c6d0d675403472aa9aa3dc416d58cbb711846e90fffb50a8576a3d41466c0ea6
MD5 34f50f2cfda6d6f0aa2e2dde05a5c4c2
SHA1 b54c71dcfbfbf1db92493f47ac9afd558cd7ca37
SHA512 bff5761be901b131e4d128f057adf8ce51e03c4c3ff2916234a53c15b85ceb7d006b8deaf632e7c5daaf21170f3e8d8ca01b0e20d9edc50d33907057848cb0e7
SSDEEP 24576:VJIU7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VJIU7LNiXicJFFRGNzj3
TLSH
T18A75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 07f43bf338f24ab3d78a859bb2b1b96965fba5719a5524d792469a07e07d3caf
MD5 0e7e86a33df220a320e5c059a1230663
SHA1 d8d514db3c7d7348326be664c3db3e500889b587
SHA512 0c02abaa46d81acf6a285dd006aa8f60b66562d6a23621096ac623fd4d690ec236a700c9319ce23c6fd1f64fad7202abbe35668679c1774f3fb281fdd6f227cb
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THv:iQvGAdlCEL8c/WRNw5Cy7wRGpj3
TLSH
T1D3266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7c0a6d0ff9a6eae1bcce89c2622d9463317ee2a520d1eac59f25851abd36d998
MD5 4b01e366f6e4282ed16e4663ff3560b3
SHA1 4f184f65343bc19f621aa2b1d56e1ca7d14fd1cb
SHA512 68c3c3dca6ed35a1d6dd98a06cda3f7c4514aa4a1972eff295be15c1ed0dd9d13e5c0ee31c55ecd7da054ad5c64ea968f8d92ef95bea9d8634e895fa4ac7501f
SSDEEP 24576:MfewsAjJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uljJLNiXicJFFRGNzj3
TLSH
T14575E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 20488e330b72526c433db23380ff947495dd19a743efccc95b00a0430be468c9
MD5 aee09b71cadbf50a61d4b5e2a1cc13a1
SHA1 cf75ca8d8f059d1e7bda5a679272123615387754
SHA512 e9828ae99b532d6d70a7c73f1521284e9a09f5422772739849819dd06018c15c110c07d5984d91dbd5890ba3943c66cf0da45f919f661881c357bf3bcd6ad9b1
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHlF9:0UEtQevvqc2W1cpV20I3279
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1c88401bc1127b2951fea8fba5eb44a5bb60f0dd04f49f9b00f2ca28e0a69b3c
MD5 a7a34c1221361e379d4bc280ed73f5a8
SHA1 adca62c6c557ef524ee40c453c93a18042fca82a
SHA512 1b8aff75e73ea17831f7a9e0eb25af1e6bf0479ad122dfd0e012f4822ce4fcca8b62989c03ac079ff8fafadbba5909738007b7121a4c9fe7d73bd7500f35a633
SSDEEP 49152:TCbRquA/m2yL5zLfFiV+XenmE3/zpLNiXicJFFRGNzj3:soq2Vjnme7wRGpj3
TLSH
T1F2D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bd40bd8a2ebe939de5e1c483768427648fc885f49d30eb903c415f932a09d2c1
MD5 6e48c478e4b5a5829df9d05abaf86be3
SHA1 7f12d3983a6d3644afe433b0e4e4dffaf33a99f2
SHA512 2a877d25cf3e26b01ce2839ae3eb4a85bcb3a6b8e974232844c3f551775991a017cc9f67f31582f3f244ace981d62826334abd01bd24496e52c475d8fcf93e58
SSDEEP 24576:wAhGL6IFoiwtA5l7S53+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wAM5Foiq5OLNiXicJFFRGNzj3
TLSH
T1DD359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 481f6192ee59ca625835e41b576c2307967925bc809d90231511a98f1b91c11d
MD5 cb4e2bb619f83defd09129d62460f6cf
SHA1 9ef84bdace82886f2f5154d5d129166bd40c8252
SHA512 bc5c24141d1fd5c3c9014470dcf8958acda9d3e225abcc1d17d7daa6f5762e8b10ca9f90ab7af660a9f512302e4e0ad301ac16e4bb0e5f0b1a07f5e0e2c38ec7
SSDEEP 24576:WwuROW1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WwSOqLNiXicJFFRGNzj3
TLSH
T11165F18672940CF9E9BA41398657C035F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 64b3804a6cbfc5d1a6ff134952103295a85bac9b415c1e98ad4381969558fa3c
MD5 e6a87b1b12741c12d435508a485752dc
SHA1 2050e5dbf31b3dfefdab7c940ae501b90ab030b1
SHA512 476cf897267ee1bcf70f4b7283abf98e57b13e9ff9fcd918a98baa1c207d2abf5dfc46f6e702e7511e4b206ab8b0997f102ee091699bf5fd3b852dd79827ed6e
SSDEEP 24576:uZuU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ILNiXicJFFRGNzj3
TLSH
T16D55129622C820F5E2BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2b1e73c28389703df208d006f16e54505f43557c97b2e904998ca1c3d208e210
MD5 8eac2533ff6dca61f563cddfc736c35c
SHA1 b3cab9019857715e2a0599b36c206c4b38f1a9d8
SHA512 c7f905c2aca3137f5796c617ca4ca1d8046ceb33a3c2eb46181a1cda52a93b8fe78f6408785625b0564af984a893beba9a7803226a3df43604a261212b9ef7dc
SSDEEP 98304:PQRQyi36YOcPDLvw2gAf+PN3H7wRGpj3:+QyiKanX+PNLF9
TLSH
T1BA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 417e14c05e5a416afb2927d2661ab08e25cdc17d65f8a7e3365adeb4d054d6b4
MD5 6b77ea8c04f051f8a744e9c4ad3785b5
SHA1 a7e75ecef8c8a756bc522dac34309976bf465e54
SHA512 e58d7bb8276f7d6268fa85e078a551485cc16c4d3b5426a945e7d326895469d2eba1bbee4819052fd84075ea07bf1fbc70529449ec9fefa6d69fb8a84c2bb765
SSDEEP 98304:MQRQyi36YOcPDLvw2gAf+PN3H7wRGpj3:TQyiKanX+PNLF9
TLSH
T122667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ce4cb8b33812f296d813406c4d0f15bd3a7357f87de55a33f971d9f9ae785129
MD5 eb483aa7a7ec468cf4c2acc9972cd763
SHA1 72c67885191647c6fa28edb174e07878a17aa610
SHA512 45a200be46bc9ad99c454176827dc6783173c42649861285f9a5c05dc25f09c912c432d5fc08b9ef05c437f33d5aec1d565708f5a6cffce64009ca02d4d0d940
SSDEEP 49152:768Qg55nhkeWu7PNU3/ZLNiXicJFFRGNzj3:FthTRc/Z7wRGpj3
TLSH
T19DB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 981b6ae0c60c918abe41f47fd018366a41647a97efda84945a87623711c322fd
MD5 30c5276eecaa30b7f89453654710cd84
SHA1 56aafa163b79c2603469b20135d9845b0679bf7c
SHA512 001c3f595c078bfa0451d594edcda5e4b9f059529baada1413b679780f8bbc5271b083ca809ae698fe530f0f7cffa656107941baf85b630e73dd910cff5a204f
SSDEEP 98304:ry5112gYy5azzVvU69nLKnhZw7wRGpj3:GLIHRWhaF9
TLSH
T178167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7a56ed2dbd52fe9644ea9c5525934c2f6d6af8967649b4ad6b62cf3c98659c72
MD5 24202f720e84fb8672b818315fe3864c
SHA1 494c977c1aa5f431e737081a0ef4c506d3ca94a7
SHA512 6c6698a79edb956ecc8b99e4cbeeba38b1deb9801857e1f2ba04c96d028d9f2612d686058403fbfda69f44259d2ac34f32b2b73900a1a5b8da23a26e649ca0ba
SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glsLNiXicJFFRGNzj3:Nu6JmIxd2ds7wRGpj3
TLSH
T1CDD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 790eebb0ac64e9336edfb815808906516cc840df887fad2bfccb2cc8294af690
MD5 e9aa9981ca0871d1b1e0fb729e755347
SHA1 8048787bf8a0178a7fedf541ab428e463ff9f4a4
SHA512 71b590bb7d2cf8dbc050f2c0f2fd2e7481348c64f4c9020a9a33ab9278684d1fd8f3ccbd1718f149533f01a3b33683f1a2b3454324a6a1f5d145f122e7deff86
SSDEEP 49152:D1hpsNoJpF1A67U44CwH7R4xbLNiXicJFFRGNzj3:DmifPqRe7wRGpj3
TLSH
T139B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 19056618a98999a685a9ad7be64e5af951749cf4e9d9653d80449555550627c2
MD5 6f5b3148de9879f491d3d28a018775c3
SHA1 6b578ab3fc2f16e2be3a57a146f60bfb2d8a46ba
SHA512 920c802cb6678012e294718be41a40ca65b13bfc75413a21f0c0ac241cf5d6414b52d97610ab3c1abfd177a2d963a35860b26b9e6048eda5759e9b66caa38239
SSDEEP 49152:9SuZQIY0Be2KkRVtOnks6NMHqULNiXicJFFRGNzj3:T5dKqi61U7wRGpj3
TLSH
T188C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b5b8625d9b7b6d8ad6edc66355eef395e1be0e44700276bd4248c83a7d40d287
MD5 3b659a935bc333450e4101260abd2622
SHA1 a86705b0f1e07dc2039f1a43b0e91bfeaec5ed5c
SHA512 5d2050c345676ff1d75d8e834695392cb4fa796c6baadaf7036939c99abc193bd3cf87e887d575319d8b14f2aadd02e4eeb9ba0d4f21d6e2c0cef58256afd97c
SSDEEP 49152:qhtSn8EApI0figjgiDn0AP5w/LNiXicJFFRGNzj3:LX2iWphK7wRGpj3
TLSH
T1CD95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6f6f1f9d00e1025527de2dd308bdf7372cc8961611808fe4e61bc5d7dcfc3298
MD5 f02f6f8870ebf77a44202ab5f1901ab5
SHA1 a9f054c57f06ec99695a65d8ef67e5008e3df995
SHA512 837ac5143e1b369539075b3000af1c5a2f0800d9906e654ca50214efeb880391598ad1c0c27851a3d69a65794ec62852c1cae647cb06efdc1a785532b30686b1
SSDEEP 12288:tOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DC5523D3548955B1F6FC003AC6754428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d224462228ead3456e85e01c978cff0539195cfeb6d19ee930d36ffb2bdebd50
MD5 c68bfc11bb30c864c2fa0f0f3e11785c
SHA1 9d6a53ed31973cd958199b58d14661904046f3f0
SHA512 5586ac4e71431eaa1c1de05c7b97a229c28b6cf45a5a0ed492d11001ac08fa6df22e688691620b67813e43e76d4800e268b9d1cf420cf96ab69af5ac725de16b
SSDEEP 12288:shiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D75523D3548955B1E6BC003AC6754428F5882E2DEB5619E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 63bc793f58723996e647cd95dbabd2d2a25c44277e84018eeb91b4bf3af1fcb8
MD5 0a83517fb4e214fec8b811a26f0b92dc
SHA1 ba6ea9cdcba41c07fec8b25aec481af05e5b5661
SHA512 114f33fe137d9552f0299579fc209cc2aee7c37a3c41abbd27932acacbee3a3b1f8857278a474e950f26d249843217de0ede21afd45a9405582d403a3ab7307f
SSDEEP 12288:6XiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6j/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1475523D3548955B1E6FC003AC6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 419f480fd7ec8c3048c18fc35e73d883ce5a4dba93956da725b9b48f074a8d3e
MD5 476bd610c648b98119052ffb0bf13cbb
SHA1 a9936d2e9adb4a66b3a8a9152f931f1d9242eb53
SHA512 d90b3cf1f9118d87287642e8150ce4c3b06461fe55f59ae9c6b8382de3a3da7610a8debd843126fc954202febc676c59c8f6a1d579d6c1ef5749ecaa445cebec
SSDEEP 12288:dV0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T117552392168900E1E9FD8039C6764424F2E47D6CDB325AEBD3003D1E5674FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 02245f55944216adc3da1e973fbfa5340a662a925a9285b7e9ca8c3bdd1b3872
MD5 72abc9214d2e3bca2c79bb46df7fe9b8
SHA1 aeaf6af6c37a4765f056d4b6921fbf88a2f5ddef
SHA512 8234e7a51ee1d8dbea89d7cce23f861916f00b10300e1cd500ca16550a564e090b62e612eb0ae43b7d5c419d82120961d15dc22a792c992eedaf3e016229309b
SSDEEP 12288:uMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:u2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13E5523D3548955B1E6FC003AC6764428F5881E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5c09915bde648ac6120a8957dac2b01d67ab02a0731e1ed8c93565df04615a4b
MD5 be3a1923a9c4584af459515827e4b41c
SHA1 2d2d26e520ef4822b97edeef0ecdbf3e2dec947b
SHA512 3837e3de3bfd11248d82f98ab9f58078f96c85f170a36c2b07e2d799c102e9a5ed01540da39bcd9a195abb1995fd1c471bc6d76637cc91ce3d1b3691e4095474
SSDEEP 12288:qNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D15523D3548955B1E6BC003AC6754428F5882E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5a8fe1f51289ac35035040d105e3c913a2bc64db4328968e3e9d43207cbc9a9d
MD5 c4be64b8f96d2b781d0940594efd52f9
SHA1 3949b7d64bb27a5f32bea038cb004b1ca4616884
SHA512 14eec14dcd77ab0a52ece70f320e20bb421ce00d4ef02bb653f01846a2690b4289867c24e70e4ee2289fbc6109b070a652eee7fbc495a58eaada1c58943f3ce1
SSDEEP 12288:VZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D25523D3548955B1E7BC003A86754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 55c0f0db3bb94584c287c5167d2e4656ea443e3b0164a6037f1b45e74b375672
MD5 85f598309c0cbec2d21cebc4fe9c89bd
SHA1 c5cb21a2414a89e583843ff925c96ca3365c7795
SHA512 2d56c651256973a1fe33885850034a5af105ea462b1b88102b88a5f24d4ac4ed047b136c1a9cd026e891fbca553297dc26187d74660b4ff99c30f6feebfec9f4
SSDEEP 24576:wZM3zFVSOt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wZM3zfBLNiXicJFFRGNzj3
TLSH
T1C1750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1d33f75617ab37fe3bb8ee64f5399e2ebbb7a6019863876cf2a65c668854901e
MD5 b4e3af2e33a9104f9183208790258f08
SHA1 69b0fc700a204e6b696650830873eb2b98e0822c
SHA512 e71f41c5fd963d721c515855cdf765e3de138d844c68f72bdf370373838e99ca8c1a796545097d32b83ad3e90718a3a752ffb44183bc7d9df721bf391fa072dc
SSDEEP 12288:OCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F05523D3548955B1FAFC003AC6754428F5881E2DEB5659E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2e3ce36a3f397cd53bda649468f4a97cb3c4bcb8b50a28644719538b13d02442
MD5 45d8d2e79d9aa20bb47189ede7efd704
SHA1 a6f54d2969869bdb3f4f1803a617696b426726cb
SHA512 0d347f4932c0944f4c6f69009cf09a79da25c45edb7e25dccbf09451a8a0469de3e04b4ef7e77fc1403beebbb4349e134ed5d5293f6ac9a54bd98bc498fa4727
SSDEEP 12288:cWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1355523D3548955B1EABC0039C6754428F5882E2DEB5659E3E3083D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 1ac2d69b2b98d370779ee2cee00fe6f4d275b28b307b67f2c0e1735e3b9c031d
MD5 2975ed3df7dd5e19dbf9df6ea8d28213
SHA1 979f9ff5e700144222d7ff28bab549941694943a
SHA512 c75093a88a30d48742e123653b76ae242a087a39f1184a0d3aeecbcf718a841b4986e7900403af49496c3da2ec51ed95a7130921d6c199bad323cbb72f71ddff
SSDEEP 24576:nzy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nKLNiXicJFFRGNzj3
TLSH
T11E650157629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c7a6e18873ecd19eb92653eff369d44f930a5e8419a7976ca38dc7c6c5dfa72e
MD5 9a0cd02815f44a6ca66187732e0e2e71
SHA1 9b3ba213e5e0124034283c2baa2b0e79c90bbc89
SHA512 acdd8d123bd3d7a14ee3dbf5be66c4aeca5d457c341b787da730d6fec0fccdf5382f0ebef5412c8595cdf2adc6fcd8436eaec580554a440aa1658eb89bf29951
SSDEEP 12288:yCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14A5523D3548955B1EAFC0039C6754428F5881E2DEB5659E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 67616b2c72af8661ffe87042c61cdb16a475ea4fc483e8289b6e16bb2d0cb573
MD5 ccefa22100ac8a0b884d867ff69b5852
SHA1 7ab973a773c9e68d4a040c9dff68fc0e1f009796
SHA512 bfdd58fe61682045fcd33c16b159cac95b9bbf05c2946a286f220b7b3c035ac36329add4983bd4bc54179bc9a11ad01c6e442c3cf4815f9adfbfadf7e3895878
SSDEEP 12288:lCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D85523D3548955B1EAFC003A86754428F5881E2DEB5659E3E2483D1EA238FEFCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 9d1bd7713bc2ed531a2e50f0b8311d98c4af9c07524a0a26c26c9c536ffa741a
MD5 bdb7c880e2e02ad34c3b3a68a71b4be9
SHA1 6f90b82d388ddb3a7362b744d91e2f3be94dd5ce
SHA512 1e9282692fbe146c2567151973e7194b07540eea9d23ce0cd89f6e21510da446154f68aa4cd24a598401926d91873137bd047251d464f7ed9f7816e512af2435
SSDEEP 24576:Lzy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LKLNiXicJFFRGNzj3
TLSH
T18E650257629530F9D17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c7bdaa6d4471c39e16f3a8dcaa40708dfdd42701d18d7976a03d6ac360632368
MD5 11af061efa4d5a6795ac913966618082
SHA1 3c41ed919d1f1a932af61298b1fa6237a76ed9ec
SHA512 3a49301797aeac92d11178a45ed0a3bb0e1f2d943671742c733c60e19ca64012e92c592ec3402ab81f532e34ac25766de860a4f77c5ead540b8667364f6b9136
SSDEEP 24576:ET8aLl3z0zDz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ET7LljCLNiXicJFFRGNzj3
TLSH
T1E07502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 5b56a5ee597fbed031aafd43f777dc415fd080c9bd1b0a93f55e6436025b552b
MD5 a507217ec06a8f12d5b99492b191d4a3
SHA1 9c6fb5038542500422ce12d67f5601f034548573
SHA512 e384d0e2e7554eca38dc0f4111a3683b3c865c2b9bcc872e504af743672aeacab027ffc5d2bf030d4f71d5744bd175a4729822ad0ee3c5d212778eadbba98e15
SSDEEP 24576:A3rd9CHKy7GZn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Krd9CHKyaBLNiXicJFFRGNzj3
TLSH
T1EF85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 519b74793307ba17f83f8b132de49292b579b2c8391e29bc44e4fb570620580d
MD5 2c34c3464877d053ba9be6bb26f1fed9
SHA1 164d5ad1e13ac98a8d602c212c4f8f60f8078ff1
SHA512 a0c3924711263361dc99f94b2a1c2efee0248fba831629acb246ed3e09aabf8c9219f9b72a782b15f34ccd5344e93a7ed9148a62e788282030c68ef07d2540ef
SSDEEP 12288:O3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3548955B1F6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 06ff3ba905f37bf1742ed46ad249308f8b27ecf5b35b06e34e598e8b933cfafc
MD5 5d7521bdbf3690d5cbb8181372e7c2fe
SHA1 e41649e9474b8af584e969eeafafccb9045f8a91
SHA512 0114364049c7e4a1a478a1f4f2943374062bbd729a29b1e1f36c96f4e72ba20e46f1917abbb9729a593c3aefdb4d9c007907595d4df1543e5f2a6249f504a573
SSDEEP 12288:/1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CB5523D2558955B1F6BC003A86754428F5882E2DEB6609E3E3443D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 822fa20790b427b272a73ec26d8b1eddc2ace147f4101e68a259933433f1fd2b
MD5 2d573cc5408346ad951edfe33f89cf8f
SHA1 cf2573d1efd360041bb01098a674606e5b2842b8
SHA512 da8f635ed0104670ea593ecf350f402939be40ee7b612fb7887944a1e565939fd65afcce7f7432700ae5204665908c95d023ed50adc3349f1258f28158f8f328
SSDEEP 12288:LIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FC5523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E2483D1EA23CFEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 37916b62f41777c534cd26477bc79e4c67dec1239fbac37d77634a2b5b6b21a4
MD5 58554169c5741bf8924cfae0187b6ece
SHA1 e9e88db02de76608dfe6a78f4bafe918de2cc80c
SHA512 196355765a49814ff647c36031d1aa78ca2e38031f7231b08b195f21046bea6dbd8dc607d1022e848a5b507ba1ac77a241a61afa3881a7d3abcf6c040def7058
SSDEEP 12288:xCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1855523D3548955B1EAFC003A86754428F5881E2DEB5659E3E2483D1EA238FEFCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5ec4a9ff673a6a9781956e7aa58a9f048f1a1e573c2d52829dfeb266d88a5df6
MD5 8536f62e92f266441c5518f454fcf1ae
SHA1 5bfc91c43c8a5b477aee456ef32105a2478878dd
SHA512 9f8746b870de9789e3205c6f89119e90dc292d677a92f0578e46a53eedc63994cee3fca7897097dd65632d74255c01d94e57f45e71b128902d7a7de1fdeb17a8
SSDEEP 12288:+3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B85523D3548955B1E6FC003AC6764428F5881E2DEB5619E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6103495b078c84eddc6cc20a071b9b857021987d9ff10a733643e88846e3a224
MD5 316ff769a11623ba044b76a198d102db
SHA1 80fa221a07eeae907b409f3b5b2e580f201159cf
SHA512 fb3fc341fbf5a89634ad993d4768557da26d6dbe6dd0125683d51a051f503e5a3937ce8fd0c8081ee75681d7601af2d43749c0574d4b293889d9dd6bd18ec668
SSDEEP 12288:3aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:38/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14D5523D3548955B1EABC003AC6754428F5881E2DEB5659E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 6e3e2a1d48073bb30e943c8ea4d1be08b52765616a716e57a985d341e24e5239
MD5 5a119645738e6e5c6f40acfafa975671
SHA1 3cf37534c0ab8fa26ab09735bf98fecddaaa7e72
SHA512 12fa262cd2864ae269887dd43957eac65fc87e29b3f164b02354afc9b63a7179ade86001f23614d2feb81888c445a9ee6e2a2c4d55233d0bdfa505b18b76204f
SSDEEP 24576:Vfwvzk9RX6wkyAIQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sMnYIQLNiXicJFFRGNzj3
TLSH
T18B85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 beaec0d44842e88809ab3c9fc6deddf967b13240e2023f8193e447282cf82fa5
MD5 169f810e40daa9fc6ea88abc7c829662
SHA1 8dfc95c03a3675f70b6b555880a67f1e9b829c50
SHA512 2c4c005045211d7aa3d721cc13bbdb7654a34ce9864a522a441538506ffb82e41c1d95125909c131b3e05522ebfc2ea61ff04379e0815a9c8a07b4138e453407
SSDEEP 49152:kYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fLNiXicJFFRGN:bySzPn7wRGpj3
TLSH
T133066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c1db803f738b011ddfc700996e8537400eac80ffa937f91350c2153d791ac0d7
MD5 cc8dcfa4540940bf2421390a82bc1718
SHA1 0623ce31aeca0e71c6a33d59afc31666dfbc2d56
SHA512 850cb48e50b344630b3dbadb8abf9a52da4169a4357430b1bbcdfe7ba3e2ee7f3625b06223199359a05ca2754ba81d841d5d20cbc80bd0320264a236c8929376
SSDEEP 24576:Y47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Y47JUQjqirIhCnDHUPfF/PLNiXicJFFS
TLSH
T17665AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3f302492bb8946d9f60333c42a7ba8ac86d566292eddeaa3d36a318fb25a2f69
MD5 655c7ede832aaebfad84c88a98336569
SHA1 3c8c8209080ed3c6bc1c364093fb0e0d1a25b7bf
SHA512 5e6fb36f8d50655a267f44df567909462bdbc1011eb785f4668e499c62406d4c9d27d2d22f114fa9466b08db7fd8a4df534d01ee91a5e2a8d824a89c971998b0
SSDEEP 12288:hpsfyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18B65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 e6ada224c94e1bc2aacdb114593e5d6db7ab920b4caec2e4f37a2e73a3143c43
MD5 01f1538e5afd4c40ff45afda2bce766c
SHA1 989d7ef09c625be10bbcccb2cee4bcd0f2203191
SHA512 27e1ed77c6d8df606c9d9b53384e72d11130ce0bcd1cdf484c6bef71646dcdd75d4aa2c58850bef0df7d54f7e7d7b83a433b74fad020a706f7c7e781d7b98afb
SSDEEP 12288:aNQg+zU3fVs+nHLn4r51eFGhg5m5paaCJbx+Jo1:aNj8UPdI51eFGhgypaaCBAJ
TLSH
T19F353900766AD75FC6AD40325E32C2CCA7707D41EE05AB0772C8872FD57666DBAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b629f1dc05c6dcefdf26ab89adff76649db457e36b0f7f65d487c90419394121
MD5 f727ba64624d1bb8c6f92795e0eb2c10
SHA1 1448b17bac094bfacf5cb8562bc3d4b9d78fb538
SHA512 d4d301a83f087269350cf802fea043ec9f8828b4c83ae38d5594bd6e10da3d8dc2c7b7ac19a732caf7fde62e043babaf4aba25e6c1c79f2d5c161da387958928
SSDEEP 6144:9K39Dp6vkx2GJitmcYfE/AQ5BI1fntYN9/Ii5D27jkOMi26tMxh25Pu5GBiSv9Dx:9K3Wvs/5Xr2NnD27jRaC164wZR3Qy
TLSH
T14E65E8816437A3CFD1FB6032072A9B4CA764EC06B7056F26B3C84579D82A725B1B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 979ab526a722a2e0771476e9f2bca80f3f3ceb43237537489572767d615555c6
MD5 cf7610f06638ecfba56b37db2422ba56
SHA1 adca97e142947f12afde77d2627fde74d077a340
SHA512 4bd10d1201f0b51166ea37a232ad41f22f8723831e919141db5a1e25fc6ce18338b9a7b75a5adcb605b90fb619445b4b4a1b585e89786b0a3221b86802a6e045
TLSH
T1C2C0120B45AE948A0B3A008AB5532EA0988032A28E434BA0B2282B0BB0B84030C1BC18
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 49c4d05a1ba8775112788565fec23427f8900d4f566abf9368736a85d14d8e4e
MD5 61b5643f660d6c5a42c637804c6a5137
SHA1 31db66e8ce00579ecca2cbaf9cda423b4dfc6532
SHA512 ddf4e0b5b3eb2511da8800dd8b34d2e7ac00de0276cad5120b17ad5420e0c1233168890abfc7b118f7046be92106344ed5f43dc6105712da08dc1dc433bb3fcb
SSDEEP 12288:0F7KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523A3568C59A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 824b2047737de5269a8a3709e2f209c765e835347d5145f19987d59637434aef
MD5 a316577f3a593555b545c00a3356cce1
SHA1 b61ce50ec9515df24b52dfb36336204cfa8e79bd
SHA512 6d396cbdf2cb9aa0596fd8aea8a921d991f2aa89fe30aee4fad7c2c31d08317fee588d1d00e8f0ad5b6e63313077ae1644b2eb85ad8af92384497bb7f48322eb
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bYC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ggb4mBIBhGFdLNiXicJFFRGNzj3
TLSH
T11865AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9993956ba12de8126ef543dab1b070e3b64bec1e65a7fe146c822ad0530d0593
MD5 4d4d7779566c33ced3121a6c7580da81
SHA1 a22e4ff200765f33bc96d1a8e3b686987d367cbf
SHA512 2f82fed39d3f54bc846b11b1a7dbc47976868eaa304e511fcd514c64fd127b8841ff8315ea9521457cd352cf4d33da41746c349d0b70659e3c85aba5cce9c4f5
SSDEEP 24576:nG88u8FpJqH1vzria7/mt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:G7ZFPqVya7/aLNiXicJFFRGNzj3
TLSH
T10D85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d14ac5636da2d5ddaed80ea808ed7bb12f79861f64643951fe009831df08a4b7
MD5 355db577e02474865092f731726ab89b
SHA1 1f7cb34dfb518958a9815f093126e984dee90ae5
SHA512 d2d6daf27e7c53205f50f5a4debf513d199644c25658c511c0fea92f4e3af4da565fe0493cc8811eb814c5b5c0b71b5cd8e18e122876175caff3ba8cecaab157
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRLNiXicJFFRGNzj3:WG05lO43bo7wRGpj3
TLSH
T145D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 08a6206811bf480655369b2a257a844fe9fc725fe627395ce06dd7c43d44be60
MD5 f2867238296fa229bba1d25e103c82a7
SHA1 29a98673386cd4419dc7a9c3bd8bf4d1b6d1b24d
SHA512 5df89ae4f68b87741db14acd2cbb3a1cced90d33d9bb295d9b60e9992151e9fe2efa09072960fc10d423f44bc5655c6a48d9962a9e56c2b122451eeaa52da96e
SSDEEP 24576:zfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnf/TwSfVcYG3K/cJHlnFR+IGNe8jg:La5POZ3lJt2pasx2+mZLNiXicJFFRGNf
TLSH
T1B065BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 811efc7d96574f7dbfaa32fe0ef4063e033463339952bd4b62582873ab9c2c2f
MD5 405628ac0c7bd2172f5b03e45de958fd
SHA1 c52133922927ec50ec519d128fd879a640195fba
SHA512 f7c538c8fbec22ad196d37c9993dc74f51c656af9d67fa80760ed31e4c88659f4d14fb64ac70b594aac86edf61c3536a13ece47a9e88ac1e9859840d756e2e5f
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7FkV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8Nc/zEOVHF6LNiXicJFFRGNzj3
TLSH
T1E1858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dce9642b55499d7b91df28cb4e6e7b0818353125eafc3239d9d93c09c5301c90
MD5 d9a2432a2521c9c02ec84558a4025787
SHA1 3bdc682625c11e491e1e720d9f426d1a80bbf0a5
SHA512 0ce9d41dbcdd3f9af57a028d4161588f77b3cad69d1c38db5fb904195bc85b3ecee85dcd3df7881a7dbc2746291cf3fec08a91f46dc6bcf1a1dc67cbc5ba4ed9
SSDEEP 24576:SzkNvNnaFeYhJNtmZBmQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SzMwBtOmQLNiXicJFFRGNzj3
TLSH
T13855AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c83d3be8ec7ece84c79d2959158e122c36f2ddefb68c4a93797c4ac34ad90f8c
MD5 f36d8ba9edf3c25678f4cb6040c641a0
SHA1 5251dd401cbd85073bf64c58594bebd7da973a85
SHA512 66f12437cab6955c2cf5f50550a54e3a06345133dab1f950aee566544367a71149be0c1155ab998a8702e5748816fc18fc5619b93d7b03e628482c1d3a35e087
SSDEEP 24576:VPUr+NQB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VJQBLNiXicJFFRGNzj3
TLSH
T1B565F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a5d4ecf67617998955483cdfbef5b3e97aa32119bf97021bc9534024b34cffeb
MD5 df23f95d7749a3f7d9326c743bac2322
SHA1 c564d4ed7287ec2837c7f01848a8174c824dae7b
SHA512 4c77eb14352a5812671c526343f2abd0e48e36f116a3c3d91263376a49d91574070bc39c17664017c75b1da7f5b803b6242e73acdd0445963ae753b3e7fba49f
SSDEEP 24576:2D3FHshBIYQgAY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2DVHeBIAAYLNiXicJFFRGNzj3
TLSH
T1FD75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-59-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/52-65-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/52-368-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/52-58-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1492-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1492-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1492-14-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1492-20-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1492-22-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1844-214-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1844-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1844-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1844-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1844-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2844-56-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2844-44-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2844-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2844-50-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2844-54-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3104-204-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3104-116-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3104-403-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3104-210-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3344-232-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3344-404-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3344-238-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3344-231-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4244-383-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4244-71-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4244-77-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4244-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4680-0-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/4680-7-0x0000000002540000-0x00000000025A6000-memory.dmp

Download

memory/4680-40-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/4680-6-0x0000000002540000-0x00000000025A6000-memory.dmp

Download

memory/4680-1-0x0000000002540000-0x00000000025A6000-memory.dmp

Download

memory/5320-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5320-400-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5320-110-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5320-402-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5320-104-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5320-399-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5452-216-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5452-215-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5452-225-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5452-229-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5452-222-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5592-82-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/5592-87-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/5592-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5592-397-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/6088-98-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/6088-417-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6088-415-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/6088-92-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/6088-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6088-398-0x0000000140000000-0x00000001402C9000-memory.dmp

Download