ced325c6d58a2c32e5abe2e22b253bb9e6457de076ed82b27b8fef1406ea3d4b

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
Size 1.6MB
Sample260804-fyf1masamd
SHA256 ced325c6d58a2c32e5abe2e22b253bb9e6457de076ed82b27b8fef1406ea3d4b
MD5 d8f2cc120fab0bb62583dbfa230f7b7c
SHA1 38d559e1bfce3fca6a2714d3267f23118ded3e85
SHA512 a372abcd62226a50101725526bf5571fd082e672197503d474d95cf9059ab8798e4ef1a29a76e989c0f6a27cea98567228c96129be3c5e5c6a669b59174dffca
SSDEEP 24576:naFDd70iTWCk0ZqLjqxEG3wuRQZsPeI0mwYR:WDd79WCk+qPgE8wiQZ
TLSH
T14575E01137D0C135F1B329328ABFE724646DB8715F6885CFA3C82A6E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
3384	elevation_service.exe
1212	elevation_service.exe
2304	maintenanceservice.exe
5340	OSE.EXE
4164	PerceptionSimulationService.exe
5468	perfhost.exe
1384	ReFsDedupSvc.exe
2084	SensorDataService.exe
2660	ssh-agent.exe
4540	AgentService.exe
2376	SearchIndexer.exe
5996	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\355694c6763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001eeb037ad023dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004138b47ad023dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b0f85bbd023dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a86e18bcd023dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22000 = "Desktop"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090a05fbbd023dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d2f98079d023dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3684	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
3684	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
3684	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
3684	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
3684	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
3684	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
3684	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
3684	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
3684	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
3684	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
1212	elevation_service.exe
1212	elevation_service.exe
1212	elevation_service.exe
1212	elevation_service.exe
1212	elevation_service.exe
1212	elevation_service.exe
1212	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3684	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	3384	elevation_service.exe
Token: SeBackupPrivilege	1384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1384	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4540	AgentService.exe
Token: 33	2376	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2376	SearchIndexer.exe
Token: SeDebugPrivilege	3384	elevation_service.exe
Token: SeDebugPrivilege	1212	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2020	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 2020	3684	2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe	91
PID 2376 wrote to memory of 3688	2376	SearchIndexer.exe	103
PID 2376 wrote to memory of 5668	2376	SearchIndexer.exe	104
PID 2376 wrote to memory of 1392	2376	SearchIndexer.exe	105
PID 2376 wrote to memory of 3732	2376	SearchIndexer.exe	106
PID 2020 wrote to memory of 5996	2020	AdobeARM.exe	108
PID 2376 wrote to memory of 3092	2376	SearchIndexer.exe	109
PID 2376 wrote to memory of 2808	2376	SearchIndexer.exe	110
PID 2376 wrote to memory of 4264	2376	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_d8f2cc120fab0bb62583dbfa230f7b7c_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2304

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5468

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2084

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2660

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2640 2636 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3732
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2640 2636 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 cff89184b1caaf80c853cac76f364e8443b949d29437a2d641f60263b93f4dd3
MD5 ca50eb6db964b3bfe54767070b2e6b4a
SHA1 d87bea5e567204bdae46d7e06a6e62f2b5d2d137
SHA512 74edd85073bd14c5feb74ab4f193df6372b29afca56a0b9d209c64307890fcdd674ece34cee53b54f57091067ed0255b9d4c3f7ac87b54268119e7576a97bf59
SSDEEP 49152:1TfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJz+qPgE8wiQZ:1TfiG/nzU90usiwi
TLSH
T182E5E526A2C8C1EBE5642070CC69BBF900546D78DBA2CDD7BD447E16B9307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.2MB
SHA256 79114fffa7adc3ad033d57c824960f393af1308eb98c5e9d556b2728ad399836
MD5 1e360baaf96800cecddc4919b27d17f9
SHA1 0532c556e31233754520c2fed67b0779b16a25df
SHA512 750f9b5db4146478ae5c567a5bb9d1524c32d61406bce0fe6822aa1f9c936d48b83b0b249b05114b8f7c50be19791ccf5b00f91143c1670729c410c171e4591b
SSDEEP 12288:cFYxOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYiu:SYx0ZqLjqxEG3wuRQZsPeI0mwYd
TLSH
T1B65522833FABDB93D524053109E8A7B9E4FFDC605F5085A393917A160CBA9D01C7926F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 ec7b6799a5709883051c6e89fbcf612de79eb76f31d9774ddd26b6fef75e2700
MD5 7971e55a55565c26e5f5d376d58b0790
SHA1 a71cf6e42a52b62dba248880f11245842bb4efc8
SHA512 3c78a545a9219b09c2af5c4450ee05eb14d84e1ceff6624e3c0837b61e3b609318567e172fb7fc0d55835024c595fb0ef8bb077f22268aa866d0d6a5a4543a20
SSDEEP 24576:JATAbD+Ome90ZqLjqxEG3wuRQZsPeI0mwYV:KTAGOme9+qPgE8wiQZ
TLSH
T1AB75E11037D1C135F1B329368ABFA724956DBCB11F6881CFA3C81A6E5D70AE0A93571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 25533e2db72d3cbde01d64284c426a30aba1eaff5f0fa447172a59172ded1e77
MD5 0833c62f2ec1f751a00c4b4d945521b6
SHA1 6bdd5a4046fc3c68946d693c54090c727ec27a2d
SHA512 a3a644ebbd787bfde5114f57b353135067ab08d4674c78ed21281a693ccb7ec2b1584e0306723abc06b93782bb79baded9ab7b1f04ed09fadd5d89f9e4ee712d
SSDEEP 49152:sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnJ+qPgE8wiQZ:W3q6sjB3siwi
TLSH
T1C2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ae3ea645296ee047d8162327b5bd699597cb56839835fa7c0ef3d71d67b02f8b
MD5 d23321a3df6c526424d636e993339faf
SHA1 0ffa4403d48c51e54cbe4d21df42465a16669415
SHA512 02b1d443064cb220f7465105a127f80244e58e80c7369121347dda1be0165ba74ada9313e8a5b97f4e5d3bb0c1d8d356af310f1ad4cc41eef71c0d528745bf0d
SSDEEP 24576:tXYfDtczAg0ZqLjqxEG3wuRQZsPeI0mwYC:4tcJ+qPgE8wiQZ
TLSH
T1CA65022977E509F9ED2B8138CCA18511EA73BC9047A0E6DB03E4A9651F337D81D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 245c0ad563d7d9728dfadf8c71bb6d7f0d30f49895aa2363f51a16955287c832
MD5 ff78eb4edf6926c7cb3e5e2f7747a072
SHA1 569d8c64de9625b92a5ec05954688e83275c0e42
SHA512 d727a449794c0d1d6cf678b308e92b238916612cb3a1fa10e2ad781b513b655498f36c5edcb63933cca9366042c3fd39866bba2724a3649d499b6157e4961db2
SSDEEP 24576:D0Le5ji0hmxxrMn0ZqLjqxEG3wuRQZsPeI0mwYc:DPji0Ajm+qPgE8wiQZ
TLSH
T115859E56F6748331D073C0B9C5D2A69EED7230851B3089CB4286D77C3E67AE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4f5f2c04dd9f1adbb76ea757f64d852b7a2bd2e368bf2b0a1a3064eef8f78d15
MD5 66743e29ab4e76ef5642874290265d7f
SHA1 7a0d229ffe7e1ff6aa54f434aa3fb78886314b43
SHA512 5e394d21fc945acbfc158c12a479b51f4440e47408fd5762a677a7b2ed95432adac46711cef89b878f114edd263dade8447c9cdba01f322d97d4a6564ffefe38
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWn6q8wyu50ZqLjqxEG3wuRQZsPeI0mwYy:8/ezSC6vUzPveHjyq+qPgE8wiQZ
TLSH
T18A756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6456b40ac1247d7bbc25722e58dfafac6410769ad0f5d6da32b5efe9978cdadf
MD5 fbcb38096a9d6a3682464962b470fa43
SHA1 cd877c79adb23b7705c2531f287fa3f7e49140e4
SHA512 603eefbb9a806a18793aa258924ffc5d800376373679229e200ba3074a17b2f0d74c7c64e46af55b439816270363747892c3f3ffbf0b10c0b8ad6d22abdb4292
SSDEEP 24576:4VbqPb88hv/l+Y80ZqLjqxEG3wuRQZsPeI0mwY/:4VO88hXl+h+qPgE8wiQZ
TLSH
T192559E66F5748331D073C0BAC5D2AA9AEE3234415B31CACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 060539fd2aec5561fe799ce92f5b3dbf02794a5540f59fa1ee782d6fbe471e23
MD5 7b2168b518bae2344eb3d498dadd63f1
SHA1 bd9a735881cd04ec0c1c5dfd37af16a967dcf145
SHA512 bf79b5a9942aef97b2e15bdbcd6df416dfa0f6d07987c209560445d0a8e6c43d36021410e2260a0a4738966bfa22bd548294d67503dcf633c3cf1bee2e5c13e4
SSDEEP 12288:VLjOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYiH:VLj0ZqLjqxEG3wuRQZsPeI0mwYI
TLSH
T1014523C27ABE96D1E73D15309AF4B275E9FBCC940C90C85781E27E811C73EA41CA816B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 64835c54ac672952adb5a416364b9692300c76fa265e7d903bf57d73e69ad826
MD5 92653da14284744250ae6dff4f339615
SHA1 d86a0bf0055cdd6bbb90c1165886140b31b0a1dd
SHA512 107621068c1da5ff48bbb270f0d3fbd1b5aaecb00b159e94a40bfc60ae5256d4e53e913ab099ee4184d2e3ffac6edd675f40dace7249606febf417bcd1388064
SSDEEP 12288:ieBNUbTVO86UUOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmm6:iJIUU0ZqLjqxEG3wuRQZsPeI0mwY0
TLSH
T16B65CF7BAE38FCD2C27E5D785A918600E7B278704F61A3CBD165830E9E235E01E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 345a513c24ebb4a99ea5fbb6094ff70b944de0a121768e6860836e81d79886bf
MD5 53d6a6eca022824fdb4921d5f1daa59b
SHA1 a9c7418ff158d96319ebf505c3adb00b44e5fed5
SHA512 0c02ab4d2f79941507d1c33c34580a3f509212fcf2ac32d669cc69a07b0d7a3fddacfc3e811c85186f57f307b555a5c4687e982a0f3b3c65476b5bac45a7ca06
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:wQvGAdlCEL8c/DRNw5Ccsiwi
TLSH
T1BA266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 42854ab84842d8085fef4a405403fc8eaa4164f93014d7af35a810129033f734
MD5 1381d0f30cacdb2fefe1691600cf794d
SHA1 e566548a1fe286fee518f157b71cb6d1c98a798d
SHA512 3a90aed4e77fe3194972af153256e39e2a146fc43bcc2e4685fa8ef0e3d9a3da5338a9e73fb44d28da3085a59d5ff38ae2663872e0a2dc7140069cbc030cf838
SSDEEP 24576:/0ewsAjW0ZqLjqxEG3wuRQZsPeI0mwYF:cljW+qPgE8wiQZ
TLSH
T13475E031FE75E032C27F0DB21B25D716587DA9604FA119C3E3E89E8D59302D22776A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 334e6bcabc04cd76fed279b26bb14867fa6b3277a3da80fa0ec5b450900e168b
MD5 a8b0c81aa1649c4f4b8e3400b24c6d99
SHA1 0c8bce4ab944a866b2dbf1c7c7b7b355190d2ce3
SHA512 e0077171b2900aa431e20660268d08ce50dede1332897aeff8e4f115fca74bcb47d735dc8857686f09c1ad5e9fdc19fd667f8ca4cad347db005060a792594e45
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH/5:QUEtQevvqc2W1cpV2tI32/
TLSH
T133474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7c3523d91be0dbb1429ed4b1d438798982b9eb2c64be638b98700f79c00d1ed9
MD5 fa7a3461aca7bac69bee33bff4ccbc2c
SHA1 62029d9c05a2112e1b6fcfd8fc7f56d88e82daa3
SHA512 b4ef82ebbca7a28c6453eb09700d53f6876410bbf26c58307481106fbcf9595c2dc5e056bde560f48362c593a551377f2f6b638a3b4b18e56ef596bd9d724a08
SSDEEP 49152:dCbRquA/m2yL5zTfFiV+XenmE3/z2+qPgE8wiQZ:aoquVjnmIsiwi
TLSH
T1FBD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d48c4eccf9b19cfe66b97f1a41843173767b064fb4acd52c65841dbd0079a570
MD5 286ab3f498d5efb73af72ab4fe23e61b
SHA1 c15cf04334d3f16f1d22c9f775eff07f8c4d8fa6
SHA512 212edfb771f59a65ccf88c8ed7813efd68a521f53935363c81265c75df48cb53aff68f4991ef472054acb3682b2a83801b32e490285c160f32b9267136bf112f
SSDEEP 24576:2AhGL3IFoiwtA5l7S5390ZqLjqxEG3wuRQZsPeI0mwYf:2AMUFoiq5N+qPgE8wiQZ
TLSH
T18135AD81EBF955D4F5B3AA7899B69171EAB6BCA55E30C20F2160D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b2882835230fb86eef74432814da042ae06cc5859caeaa739801d9f366f07cd2
MD5 018382ce4c03a67ae00201ee5257fffd
SHA1 87a4e58c809cb3f80231949284be483e60e9352d
SHA512 1176fbc4ff6b9a8dd3b97ec5cb339218e81f1ac8f1b0f24b1d4a5d4b575eb079f4ae7a9b7c7f3535e037855a51ead4342f0eb1ac2d871a9d78966014c12bd5f9
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CZOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZT:vwu4OWK0ZqLjqxEG3wuRQZsPeI0mwYc
TLSH
T1E765F18676E91CF9E96742348697D136F7F2BC512A21CB1F03A0C65B6F332616D2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 84a355e9977c5ad2031d4374ec2c8f1ffc92ac1b3207f85ad45606c762e9eb50
MD5 b9b103bcb70e670d16be5cb948635900
SHA1 f2379499a77880cdd8f5a41c96600f11c6079f24
SHA512 ddf6db6decdf04e850a9b3af71f59598d12e74565063d3626d7b1fd9d8422a6d7b4e8d559d5d7c45aeab6f881a54b45bd7a2e5a41063ed1fc617324868570b8a
SSDEEP 12288:leZ1IyGOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYiY:QZu/0ZqLjqxEG3wuRQZsPeI0mwYH
TLSH
T1E055128637E961F9E26B5234CDE06215E7B2BCA12B7183CF02A566951F33ED11D39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6d4fdcd9da36f044986b82de240d15af6c57a35ac2a0bd972a58cd899bb48c51
MD5 1ba0138d0c5cb95818628fb919e92210
SHA1 2007b8b19cc9b9754d6cc57c88d65b61d496b7a3
SHA512 4badd5f05e114223c80db0ee80a7dc688b58f82dd763da3f43e12399873cea0ae9ed54360b0aaaa005fdc52dae4ec8e32d6051194188c4853e4202a2b7327e4e
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uu:LQRQyi36YOcPbLvw2gAf+PN3tsiwi
TLSH
T10B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8be563e5a906faaad620b7bc910710ef10d0b4e2796bcae0c7ef361603ff242c
MD5 64055e2b718752345b1109f7e5a5b579
SHA1 8b4683ee3d8116ba1282f9ec57fb60fe735a5b0a
SHA512 80bcdcb1cb2cf957c4846e47681b7869b82e2f5132b4291872fcae274ab5d9d8cee5e841a212aa383ffb8d8f226443a80867956ab3ad030917a9cf98b0fe078f
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uu:tQRQyi36YOcPbLvw2gAf+PN3tsiwi
TLSH
T17C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b6d44e74412dc23f1593c5694eee3ff69378ae69f4c321e256199b1531cc9d9f
MD5 d9a620e4a304060e6a029bf7ecd4ca8b
SHA1 dd5d1dac16852d4d9f4d2a295218440a2d563947
SHA512 8a973c18bbf9dd6309c0c9f2c2063c7e47b6f0597c8439d117ab9d47f666b26f2f448255c80e1ae0e3947543e0c382e8a48dd6d215284966c6ad9a725debf0f1
SSDEEP 24576:owvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0P0ZqLjqxEG3wuR+:u68Qg55nhceWu7PNU3/m+qPgE8wiQZ
TLSH
T1AEB55933B2F600A9C44DE1769F4A973196D27C758FE0E3DB815172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6d2b8d2a73a3040deecc318c45c98e5b9ee0b16350b25158750ad45455f4e961
MD5 2d919cde7a6951d568d73ea4fe751a66
SHA1 86eb5b93ca3d413f0a30d0c38738dc2235085fef
SHA512 e6f5f9cbf911d8185dd152abedc94593bbcfdbf2f8e68db62d7f7ce5885b4d509b55950e69f6613b0a8598c4ea16c1150a467a37b566950f0ebcba69141df877
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99E:8y5112gYy5azzVvt69nLKnhZysiwi
TLSH
T135167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b92055b1244e689cf7d6bf950a1788d4a012fff622801443333c90250c4a41d5
MD5 c6731cb90873b0c806905eccaebe81c9
SHA1 77a34b86ed9626801a2f2c6018434b53fae385bf
SHA512 dd4de85f50cce7df2f9d94850c3233e3f3074bdbd5fb23dcd72d6e740d2229be9881054eb118c4d404d2569dcb9f21cdbfc81d8b82821f7b4d9493b0ca425c4f
SSDEEP 49152:/B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gla+qPgE8wiQZ:Bu6Jmdxd2dzsiwi
TLSH
T12CD59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 69c223cbdab80ae05188953fd0b6643a645ab545611aeaec7d96f04b8534c6bf
MD5 56060f6a78bf1c7453d1cea649cb1e18
SHA1 02a651e8816affa24af25c63801b4606d9ebc4d6
SHA512 d2d9942744f35fd56a143755641c0150460537593532f7a9881862694f0db61960bb3efcef6e24218164b736c8f3c1bf4427f9b0947002c5e7ac8f850dc6e7a2
SSDEEP 49152:e1hpsNoJpF1A63U44CwH7R4x0+qPgE8wiQZ:emifPWRIsiwi
TLSH
T16AB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 80d7cd39a1647603e4ded2f7e26e1f222ff68d99c8cb36171ea87f0625267a8c
MD5 cfe092e60e58c3b4bef24f73339ae17d
SHA1 e0e2a37cacf833b815939c657f0ecb50be493783
SHA512 7e27358d08c33df8f79227bf2ae7652d3b4e6f6620b0c627e102b78c2fff919fdfa6a71c81a81f97aabfb013690858ea78e54b0028a02f4097c4f6e17ad42015
SSDEEP 49152:pSuZQIY0Be2KcRVtOnks6NMHq/+qPgE8wiQZ:n5dKii61msiwi
TLSH
T10CC5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 86090b0e0d01e43dacefbdf12ba87d617a1016667d6f3e5dbeed9223f1d82bb9
MD5 d256cd1a0a9f983ad3139044fc952b56
SHA1 3c7fec5d394c0a143ae27f29011ba1d3ffae097c
SHA512 233680c024e750e76f2927ce8545946515eeed8f575c27c6c0caabc4ba5d0398b6dab8cf03bd8f99c56b181e6c84c81cc8e0bf2fe64dbec1377c7a70940e01b0
SSDEEP 49152:ihtSn8EApI0fig3giDn0AP5wg+qPgE8wiQZ:DX2imph0siwi
TLSH
T16795BE13F2D901E8D06ED174C7568632EA72BC150B34AAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f16f057acf41ffa1c272a62213d563dc768b6a99d1370b688b13f6dc88a44338
MD5 fc71e143105e731f170d1a9a878bc6a3
SHA1 7d6262e5618af7425404b2630001369463b681f2
SHA512 31cfd8992b4cc4f550d6b416c4353c955cc4c8fa57b27c4db715eb633403fb1a8d422b7e97732822a44a7decaf8078a005c82ba4c8e3aca112a2602e3d9d108a
SSDEEP 12288:obOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYiM:ob0ZqLjqxEG3wuRQZsPeI0mwYz
TLSH
T1554523C27DFFC6D6E22D1630CAE47275E8FB9CD46C90805792DA79011C73EA41CA85AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6a571a946d208150863fea21a75ef9c2884f8c33e423328cf0fb6e343038d4e0
MD5 6ecfa6de9f893072ffb6b3ab957cea3a
SHA1 11abb70fa6355e019400088d5c0b654089126e69
SHA512 6f3f92c6479e55741a5499258373629e3ca0105c580e558e010c0aa8773330f25adab93f6e1a54f461a20a7e317ec651355f0218e0883bf1cb7917e1d108fec8
SSDEEP 12288:7yOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYih:7y0ZqLjqxEG3wuRQZsPeI0mwYa
TLSH
T1884523C27DFF86D6E22C1530CAE4B275E8FB9CD46C90845792DA7D012C73EA41C685AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 443b2d3e3ca0b7a9bbbe4198a77bd5300b50fc553b1cbdf9c36289180ecf89cd
MD5 1122d3fbfde150adc5942f9920b19ec6
SHA1 8066fe62a8337c1cd9c217471ed25f3ab9dd97c6
SHA512 9d9e0e01d28f363a797c69a39b877ba275dd7d448fe4f7c47fe2dc51c10c0fa40240aaad321bed4ed504bbfec1323eb6a887343271555e113b2049b965aab272
SSDEEP 12288:rMOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYih:rM0ZqLjqxEG3wuRQZsPeI0mwYa
TLSH
T1484523C27DFFD6C6E22C1530CAE47275E8FB9CD46C90845792DA79012C73EA41CA85AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 15635eb0a2e826b190c48385b0615c2831edb8ea059535dbb266e9c99e98ffa6
MD5 e124c94985b2f81ab6a7b246979cdac0
SHA1 4d9b94b0e5a75dc533b69471961fec3ad8c779d8
SHA512 b8e202f17be13068a812e10121d0bde37b07883b31bd21257cb40f863a777a81d2e5a0a48faa4a83390dae01f3ea546b0655ae55edb830f87735ac6796666c04
SSDEEP 12288:XVdOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYil:70ZqLjqxEG3wuRQZsPeI0mwYi
TLSH
T1E84523823BBF82C1D5399230CAF0A235F6FABCD45970859F92913D451D73BE41C78A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f25c1c302f21c1f39729041547c674d64f5fb7549c7b9df030d953349890ff6f
MD5 0feaa7e7d5293ec2e83106ec8a374718
SHA1 8eda071ad71f66909cf207aafe586a6773a31ea2
SHA512 94c438dfd65720fd1ddb3ab30528de2d3d4e76fea81a4520cac169349321afd575270438cbcf6686cd2adda25b5b2dcc7c26015522bf92c0f8779aa5ffdbef2d
SSDEEP 12288:pFOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYiG:pF0ZqLjqxEG3wuRQZsPeI0mwYR
TLSH
T1DA4523C27DFFC6D6E22C1530CAE47275E8FB9CD46C90845792DA79012C73EA41CA85AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1ca7b7dfbee5dab7f90a39189196598edaf9acc216e6222563822e82c0686539
MD5 0c5bb8922371847f374f9da371cf889a
SHA1 8b77651f311ddc97e3b8dc200620ae765a9ccfc4
SHA512 f3fbd7ae094e8f043e39e0649c072383c76bdf3e1a0d5e79c49c7f2d0bc4a4dbcf0faacfc29a9e63a6532afd1dbc958fcb94fa0cc497eaa460960df254b82982
SSDEEP 12288:eOOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYil:eO0ZqLjqxEG3wuRQZsPeI0mwYu
TLSH
T1C74523C27DFF87D6E22D1530CAE47275E8FB9CD46C90805792DA79012C73EA41CA85AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 df0df1e0ba79410899d6db10e086f98eba34d38e140fea23501f842fbd22960d
MD5 d056878d9712a17325a989bb34244519
SHA1 a6a71c3072d71f26c3c1a4868dc04761b1af4ec9
SHA512 fe6103ef49ac4679f231099745913ee88eb5d13b0f6c44a021716d3bb056dd36ee6a1f6ce4d7fb259dc488345ec56b4f40fe8ca93e57990873889d4b585a4ac2
SSDEEP 12288:raOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYiH:ra0ZqLjqxEG3wuRQZsPeI0mwYw
TLSH
T1004523C27DFF86C6E22D1530CAE47275E8FB9CD46C90C05792DAB9412C73EA41C685AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4d19477b8e4ae7331a58b184e7cf14765b4d7e0280650e46ea9ab4773d11e69b
MD5 78612f4cf8d961205e75d9f0412b8714
SHA1 da92db18d8c6fd5287940ff89f8f6ef009fed7cb
SHA512 ddca50ab5c3493746a56268bb265ea8bbe5b3fa6cf907bc66d2cb5f936db952df14d05aa2f6b509701ae5c9185f7eea8529395297c34f16ceb113eace6e09c3e
SSDEEP 24576:LZMRzFVSOS0ZqLjqxEG3wuRQZsPeI0mwYC:LZMRzf++qPgE8wiQZ
TLSH
T1F7650195B3A018F8ED67813ACD659916D6F2BC590A70C61F03E436671F337A01C3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c37bc45b46809f43fafad2dbcb167d517555c5341fd8a7f62000527ea02bda4f
MD5 7246a20eb886e8caf5dbd30ad3c8b167
SHA1 5e2ae303ea9d01377a1360ea1e31236845fbca1a
SHA512 32411b1efec557041a6abc850c0718242f0e401f336da841c27dc1cdc90d4b5ab819f6aa7d27c8b3b253bf119ef16d3ead78d747933c5137b4075f3aa84dd395
SSDEEP 12288:9vOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYin:9v0ZqLjqxEG3wuRQZsPeI0mwYA
TLSH
T1B94523C279FF96D6E22C1630CAE47275E8FB9CD42C90845792DA7D012C73EA41C685AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e02999e091f3a612cd775e04b4400a6b61d7acb04864c36ca3c7770242bf53a6
MD5 02e4130c783261c714470b1a71b96525
SHA1 791dec87de6eebd314a0eab0ced20e903221dcee
SHA512 f410be33162a3a23c82104133305bc1aff13fa38f295174461562c372e70764324e852a0c55ea31da5372736c59a3fec6f9e6b8100cbe92e2036dc707394edef
SSDEEP 12288:0TOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYin:0T0ZqLjqxEG3wuRQZsPeI0mwYA
TLSH
T10B4523C279FF86D6E22D1530CAE47275E8FB9CD46C90C05792DA7D012C73EA41CA85AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 bf3f3aa3190e63e01aeef09727c9981859e71099ea3d891f47c0b20004748ff6
MD5 4a7e8a209b741eaacc39ff5ddace58f3
SHA1 1b10bc5d0ceac875d0d60654f774ab00a49ab2c2
SHA512 03da509601e0936b3a6d9da84bf00c4665ee8894e45880df7cea37b8f8b8318857942fe28b910baba1802c3b92d9a32fda03ba1f15c0e2a0ebe9ca6eb8739ffc
SSDEEP 12288:syPz5L8GOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYie:1zyG0ZqLjqxEG3wuRQZsPeI0mwYJ
TLSH
T15C55024377A631F9D13A9234C9A11612F7B6BC710B608AAF53A417762E336E01D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 48c0e75dac1ac04dc5656b803ca31921fe6479d6399ccb50c79d38cbcebee61a
MD5 81de4065583b877a5243b16982771e82
SHA1 c810dd33a14eea6133193d28954f6451f3c5513d
SHA512 80d3176246ac7150e0a5da058b5f127cbe4c8c9778732f8423d363bb0f8a144b36a351fb580579ce79573fbeeb6225488de576e45c9de480ef6f1e4ea67aa680
SSDEEP 12288:qvOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYiq:qv0ZqLjqxEG3wuRQZsPeI0mwY5
TLSH
T1294523C27DFF96D6E22C1530CAE47275E8FB9CD42C90809792DA7D012C73EA41C685AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 44f1bf19e9851e65bed3726801c9e9f374ccf432819666c8f8bacfaee8eac8fa
MD5 e752f941a6370b417691755b61e9cfab
SHA1 9f8dc8e5bed8da589e03c2a605fa0517c695d804
SHA512 6b2b574f4a812bb30a822886067a3e2ded2d74ea74af18769424fc20b66ea28bcf4365628126db64b1c5401f5957ac64a146ca92f36a869fca21759658752b9c
SSDEEP 12288:rvOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYiq:rv0ZqLjqxEG3wuRQZsPeI0mwY5
TLSH
T1EB4523C27DFF96D6E22C1530CAE47275E8FB9CD42C90849792DA7D012C73EA41C685AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 9305feddd8966370e67f268292c6193702bf49caa371ebb7e399529ca2e3368e
MD5 245b438844011e249bf52be885cd89fb
SHA1 797f8ed97fc8e71bb7b9decd5f7c81325b5df0b2
SHA512 99278c8c75f204c2649633f7b3003e418b05e970f79e97515b440a661f3cb878c5408941a401c2af8f2b73cab506f24106b5613f6a9e79210e274dd7079d3f93
SSDEEP 12288:ZyPz5L8GOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYiJ:YzyG0ZqLjqxEG3wuRQZsPeI0mwYK
TLSH
T12D55024377B631F9D13A9234C9A11612F7B6BC710B608AAF53A417762E336E01D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b831c2236a4383c198489cdf25b7c60570c496e29d54299761145dd5afc564e3
MD5 3b992a30bd52c0f4f84e418e6f9818e6
SHA1 2d2703135f851cb400ae2d621744932076685598
SHA512 9f91a594789bee71de0e8fdf15200df273e12ab403d78fcbc9a430adc0c743cb6977f26d491a890ce59f2b2e911109be31c62f1b1d18c61476c6ed244b052006
SSDEEP 24576:dTDaLl3z0zDc0ZqLjqxEG3wuRQZsPeI0mwY2:dTuLlj5+qPgE8wiQZ
TLSH
T1D4650195B3A058F8EC67813ACD659916D6F2BC590B70C61F03E436661F337A01C3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 385384f43a5a1edd6c3364b8ef93bc323c61cc08d5cc012f7107c6e0372d5913
MD5 b2294ad521eb21840af851179f79839a
SHA1 ae73cdf4e7cde6a1688858b47066f41720f894d1
SHA512 6b44a79ad14100b912d882f6bd2b743052ab5fa47ea8a4f264613d5526e60df1bb9addfe5a5080c41e57272bebaa027937f68dfaa12c63b6a9fe1e21798943fb
SSDEEP 24576:I3vd9CHKy7GZY0ZqLjqxEG3wuRQZsPeI0mwYH:Svd9CHKya++qPgE8wiQZ
TLSH
T10975CF90F3E814E8F1B79A35C9765511DAB67C991B71CA8F03A4261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0608e249574aac3153e5b40a82db5b35af46378d4838b55614f3005fa83cb00e
MD5 8b2f09625666a7740df9ac57d6342b28
SHA1 a6af022f23f9d6dc7f63e2cd1fd311d1693b723a
SHA512 1fedad6be4752ea4abb3371dcc0e1cd07aadf94510484a326ff4ea9fa3ed296a84c367520ac24b1bf1dbd819a3c7ec05fb80b91aad50a23c1a55b3082d721bb6
SSDEEP 12288:osOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYiN:os0ZqLjqxEG3wuRQZsPeI0mwYa
TLSH
T1934523C27DFFD6C6E22C1530CAE47275E8FB9CD46C90845792DA79011C73EA41CA85AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7256862fb7da89a893c0cc55b4752de1bf36edb8b5ee02fe1af48ebbb603852d
MD5 4ca815f6ba30bdf50efa1b5e932dd618
SHA1 850c15f141eed5b9a313788bce380d32a7f771b9
SHA512 9347e6459fb74e25c4a67c07dc706b187fe8f12cc96ee868f56305cf741b2ab15c0b4c78751c79664c95827188d2f363273d9f168f06aea4ac29d94168abc684
SSDEEP 12288:xmOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYiE:xm0ZqLjqxEG3wuRQZsPeI0mwYr
TLSH
T13E4523C27EFF86D6E22C15308AE4B275E9FB9CD46C90845792DA7D011C73EA41C681AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 53ece48eea9db48553afeb9ef71fb89ced73b2d371cfc28ff1ebc7cfd46d1195
MD5 41e647d40f333e37a79d9b65f46d2ddb
SHA1 d997ada56280bfe91579c19b74c272e1b8398e62
SHA512 af73ab460125e8a59864b9626d6f29bd09db398ce7836f5fd56fccf0bb46f077e2157957cec8fa1f7307c223525777fb8b936c25af6295362190f15809903963
SSDEEP 24576:rfwvUk9RX6wkyAID0ZqLjqxEG3wuRQZsPeI0mwY/:hMnYID+qPgE8wiQZ
TLSH
T1BC85DF29EBDC44E5E177923C89B7460AF6B278681B31C6CF029A53AD0E33ED45D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 317f42d3dcb62c44984ca80749c28d0ac45a3bc2122d2be364373e3d277ac8c0
MD5 6e5bc4232c8b68451c1241e5800f2fdb
SHA1 7372e5e496a656d98ec985d7a95d29b2c6def4d7
SHA512 38879b7c890c7adba738e0e7b9f8d5c598fce0858accd4ca06a89c3208207d03bd3b64a1b1454841b6ad15003e1d3738f5290102ef5b88225cfdb091ea7ca7d8
SSDEEP 49152:aYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0A+qPgE8wiQZ:hySzPNsiwi
TLSH
T188066C96A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d69ebf0ef3101ea2788ab8ff002771a44521a802f7764bc2ff82c9d9b6922aa6
MD5 90e736c05f2ec2c0aef57fe89df7f9a7
SHA1 5bec503b205964d7dc98c8b807dc44df347f92fe
SHA512 f25828f4473d0d01b21bba8e0e2e8c69e2fbc2a4125ba6b3a55d929b57f201700b499c00fe6af0d7f1af454b36ffa3fb7589efd1ab64752e308bf9fd587c43fa
SSDEEP 24576:p47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYC0ZqLjqxEG3wuRQZsPeI0mwYt:p47JUQjTirIhCnDHUPfF/w+qPgE8wiQZ
TLSH
T15965AE1EA3EC01E5E17A927885554A1AEA71782D1F31CACF12B0837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 d4765934b07e08e4ca1e28665afb807c579e7aeeef1ebd3cb3c0d629b17e58cf
MD5 c1890dc5b04d73651dc58f0cb7b2e06d
SHA1 8e9a90d2002cd3fa433ea1cf4673876a0c1efc00
SHA512 f8ab6468d28283d0ce1b8e1bf475867e94c7de1d7cac2289345e2b6d488b2c8ba58615af1f604d74ae2664c3eb73592c86a8467cd473a18be28858c54f23fc8c
SSDEEP 12288:qbsf/OxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYie:B/0ZqLjqxEG3wuRQZsPeI0mwYB
TLSH
T16E55014AE2A842E8C02E6231CB959651F7777C6487E1D3CB52D0F93E1F36A901DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 8edcf9c89a1be390a95fef008b9d53a7d158d1e98819cbb030bcaba39f4a759b
MD5 1725715d74c6131849b131da37092dd3
SHA1 90918d24ca7842b0783c294314400b6d00efcdaa
SHA512 1a8f31a11f452bbf185d19b683b8ef6eb03621d686517aa52dfb41e7d6c7430ccc401f0e96699e63bde25fa5cad47564d4e32278cfc98ce97b4305810643cf0c
SSDEEP 12288:q/WRLU3fi/T1S1wMvW0m3yGXZAHHgzxg5weP+hd:q+9UPy13cm3yMZAHAtw+
TLSH
T19F252850766BD75FC6A940325E33D2CCAB707D01EE45AB0372C8473FC576668BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 329KB
SHA256 4aa03b24a2f165167ba6cf052c35a39e619bcba8c85fb171e5263e3aef89b93f
MD5 99a9a41390635ac4dbb8468ed6f5e776
SHA1 2d870dee4ccb9f2648cb0232fcd5f8f652f5fc92
SHA512 966bd60510cc4044caf90a8ff4fbb18abd0213bc5611ee0a2a9fa936c8012866a895e9866165036b9cceaff9fc92cdd345c85d9aeeb622163e3c1a127d0e4af1
SSDEEP 768:lvlTZJlTPBlTz2+EQMvX/TAVWvlTZJlTPBlTz2+EQMRXRw/T8aKfvlTZJlTPBlTX:40gKaLuVBgxQnlvZYSQAT
TLSH
T13C74A511B714B329C4B681B69871D6AFEB38B512DF1343023BC82A89DCF32967776B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 178B
SHA256 eefd5704361175a7033f87557396712d1e7a7116360efc0750064249810f085d
MD5 8c670a5a830ca9c6d8397e37ee82dd04
SHA1 8ccd881caf19567d3fb7b43988834a9ef14ac607
SHA512 7adecef4e336415b557357a12a0585e22bd07fc302818232e10ff1814e7edf0235eb33cc199eb4fe73b00ca44708ed8b493b0e1ddc962dd093d24f7f63fddda9
TLSH
T118C0120201BF90090BB600CDAA622FE01086B220CA618A21A3302B87E8A08070B1BC1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpC828.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpC828.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpE037.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpE037.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 186c62209ac3fe6962c1103368d57412604f5d61b837be2790958fd6b320e98a
MD5 49afc0aa081e7fb483b31c81a0efad40
SHA1 78e099dadfc19bb6f6cef8d942ca7f9c8b6d501d
SHA512 e6c3949c732d7d6488ea371252c14599d644490ae5ffd89a10e4acddb557c561b57cedcb8790a6a1e98048336255086231f654d543cf84122d175a28f2175cda
SSDEEP 12288:k07HOxZt0LyinTMhLfq/UuZGvs0EcuAjpiGRJwuZzLQZsA9keItrmmFyYiK:ZH0ZqLjqxEG3wuRQZsPeI0mwYl
TLSH
T12F4523927BFE9A85E53D163089E8A235F5BFACA40F50C0D7E1957A412833ED01C7865F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dd0469bf88fdb01807e8b4d19be004c8b02d2b9d7ce251a9ee5fac6242a93df7
MD5 d393e48780b01f9a4fe00e38c349a158
SHA1 ed02745f16c009ea1312040aee07558be7dcb184
SHA512 66457418ebda76142576ae0c2fa055838f9f5cce59d12ffa45f251166578cd9205eb5da57aefb57c3f6e893e949c45beeecede5f9d04ff1db44bff842c7929cf
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bY50ZqLjqxEG3wuRQZsPeI0mwYS:sgb4mBIBhGFC+qPgE8wiQZ
TLSH
T10365AE1E22EC02F5E0F9E2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c00d7f3d037e099e0fec328db15681e9353631f3fc88b8098b523260ae0660a4
MD5 58baa262aa7db15b7b1f6211bf1a58a6
SHA1 7a9d078b8da432b96947f643420932358b5fe09c
SHA512 c965ebca83d1486ad65666c1f210821362af44a0c6b7f2c828b4fd858ae0075618ca70adf76d5de62278b187d2192d3caa2c85de638bd00d35a4d7e8eff8950f
SSDEEP 24576:6G88u8FpJqH1bzria7/mS0ZqLjqxEG3wuRQZsPeI0mwYM:B7ZFPqVea7/h+qPgE8wiQZ
TLSH
T14085F16577E501F1D47BD13889864663F6B2B8250364EBDF07A88B511F23AE40F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9ec1aa1992896904edd28ea8915db90800e47b40169c81766b66b60d6f539462
MD5 ce2f9ae56e0dc6df610a012556e1e3f5
SHA1 13cb2169c7e7a729128a797343fcd38e2e68b5ca
SHA512 9003201059fa06867139d12e2bf0abaad97b34c0060f128e9d0a7fbcf8a9db1e277e26050a306f2feef53f49e00875c986833965a7233f1dd4e3dd8de6641903
SSDEEP 24576:VPUr+NQ+0ZqLjqxEG3wuRQZsPeI0mwY7:VJQ++qPgE8wiQZ
TLSH
T14465E15F26ED18E5E67AA13889828719F772B8610711D2CF02E1917E0E73EE87C3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c1728894e424b4d2d5fa4a2288943cefca2b514dbfd9ee6d486e719772fde76d
MD5 a74a518858b2106e1aa57e2feddad342
SHA1 92d7a869c52311647ad67147f7096222a8cfefca
SHA512 49ebdebbc0807dc56637c31d22c18a72fe8e470c335b85b09289d4609ffd8ab9e2c781e30ef9b63276f132a9acbf14466f0c665072accce8948532fba9a2ef36
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjO+qPgE8wiQZ:MG05lO43bqsiwi
TLSH
T1D7D5CF6A62EC11F9D1BBD17CCAC6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5ceb6d7fd15d4ce794fbc292984c898f03ad28559df899b2e2c0dabe6530b09a
MD5 df6852d243274bbe76c7b9751b6fdbea
SHA1 65b0c75199c55a7ee1e7f466a767123393dc9b77
SHA512 d925167ad82e4f5bbb7667d19414372c7670921ba37c206b34d0f8631f47dceb78675c78202203de69511fdee9362f43594e3a7e1bbf12a0839f667584893ebd
SSDEEP 24576:2fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnA0ZqLjqxEG3wuRQZsPeI0mwYt:ua5POZ3BJt2pasx2+mm+qPgE8wiQZ
TLSH
T1E665BF5EA7FC01D5D579D17DC583861AF5B2342153329ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4d7652d90bba94a51b42c389525bcb136952f9d3523560823874f262468266fe
MD5 0a03d1551ab38d8a51e689b7b649a8d0
SHA1 2566bb8b1c6f06e53f9fe17e7d0fcdb0368c631e
SHA512 d29d6c21afd4f813e5bf3e192eeff023dcac4f35d63a1d24eaad2d0b4dd5341850a42d0c206801ec9d252f775075281229f07ca4f877a70c87c1f2d910a8d347
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7Fkq0ZqLjqxEG3wuRQZsPeI0mwYI:QNc/zEOVHFB+qPgE8wiQZ
TLSH
T1C9858B1623E901E4F1BBE1BE89779546FAB1786517308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 840a3e6bd8522e1efe11222f3f2b9f35bd011f9b1d77ffe1af5342fef17b4249
MD5 d2f94bfa1df11f940bb2524d47c28e3e
SHA1 8243c3e6f5caeef0b477495e5279b4697af431d3
SHA512 9f5115b515dbd0915c1650d3ecb6dde77dce028258561878e80e2153138355595b88870864f296fe11358902206a749d8691d3197b4a1512fe30351f4934fe2a
SSDEEP 24576:NTkNvNnaFeYhJNtmZBme0ZqLjqxEG3wuRQZsPeI0mwYd:NTMwBtOme+qPgE8wiQZ
TLSH
T18955AF6EBAF846E4D1FEC674CD238512EA727861073292CB5290C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 14a36c6364580a28611e24cc4b37df478e6ea32c2f23ac580f72ed70bbc490c8
MD5 0859fa9c66e88c2bea340cda317905ca
SHA1 a52c992e6e6d6795c2a84e68b69b39c7529079d3
SHA512 83d0f5e0965333cc5596fdbf10ca79b9181cef58ccff8da3813c8559b1c2d65e3ddeebb124114b45ee4ed88b94f0e272e7c9488cfa8d4f18b9d2b5371f504a48
SSDEEP 24576:MD3FHshBIYQgA70ZqLjqxEG3wuRQZsPeI0mwYW:MDVHeBIAA7+qPgE8wiQZ
TLSH
T12C75E17EEAAD04E4E57BD17CCAA38606E7B238A8072155CB02D491B51F67EE42D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1212-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1212-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1212-221-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1212-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1384-171-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1384-435-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1384-170-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1384-440-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1384-177-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1384-391-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2084-392-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2084-393-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2084-183-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2084-190-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2084-184-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2084-395-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2304-44-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2304-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2304-140-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2304-142-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2304-121-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2376-397-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2376-222-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2376-223-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2376-229-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2660-197-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2660-203-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2660-195-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2660-396-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3384-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3384-13-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3384-182-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3384-22-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3684-6-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/3684-37-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/3684-7-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/3684-0-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/3684-1-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/4164-157-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4164-155-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4164-376-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4164-163-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4540-209-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4540-243-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4540-208-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4540-215-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4540-241-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5340-359-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5340-151-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5340-145-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5340-144-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5468-167-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5468-390-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5996-558-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/5996-607-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/5996-656-0x0000000000400000-0x00000000005DB000-memory.dmp

Download