ad88daaf27f5c84fe98c340892983194d60dd2ae92fddf944e31892202bff474

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
Size 1.6MB
Sample260804-hrpejaeg94
SHA256 ad88daaf27f5c84fe98c340892983194d60dd2ae92fddf944e31892202bff474
MD5 681f38effc5aa35b1ed900c0bac51515
SHA1 500d2feb9e6e57087f9804075704a00655f7b090
SHA512 67802a0cc7fb35df1b89aba1ebcac84e43c69e878af9794b0ff8ef8d483f69bee79b92d6768f05646049f9186ac772fc557f153f4e98ae2fac5584b75c780162
SSDEEP 12288:4a0wIk0BX3RKTemGd70ioGuVWW6oIurGnBM7L0upU+1y+AYXmUbibGqiMIjmYP23:4aqDd70iTWC3BMvjRA+iqMIjmJ8c+hE
TLSH
T1D175E01033D08136F5B329368ABFD724556DB8715F6882CFE388166E5E706E1EA31B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4768	elevation_service.exe
5412	elevation_service.exe
5904	maintenanceservice.exe
4688	OSE.EXE
3684	PerceptionSimulationService.exe
2380	perfhost.exe
1532	ReFsDedupSvc.exe
4840	SensorDataService.exe
5008	ssh-agent.exe
1764	AgentService.exe
4976	SearchIndexer.exe
1736	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\79a6fc8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084ea47cdde23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b7b870adf23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000956144c9de23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c5c36fcade23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c7cd9c9de23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060be97ccde23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c896040adf23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd08cacade23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4652	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
4652	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
4652	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
4652	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
4652	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
4652	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
4652	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
4652	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
4652	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
4652	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4652	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4768	elevation_service.exe
Token: SeBackupPrivilege	1532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1532	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1532	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1532	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1532	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1532	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1532	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1764	AgentService.exe
Token: 33	4976	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeDebugPrivilege	4768	elevation_service.exe
Token: SeDebugPrivilege	5412	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5804	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 5804	4652	2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe	91
PID 4976 wrote to memory of 2260	4976	SearchIndexer.exe	103
PID 4976 wrote to memory of 1740	4976	SearchIndexer.exe	104
PID 4976 wrote to memory of 1176	4976	SearchIndexer.exe	105
PID 4976 wrote to memory of 1644	4976	SearchIndexer.exe	106
PID 5804 wrote to memory of 1736	5804	AdobeARM.exe	107
PID 4976 wrote to memory of 4664	4976	SearchIndexer.exe	109
PID 4976 wrote to memory of 4864	4976	SearchIndexer.exe	110
PID 4976 wrote to memory of 1752	4976	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_681f38effc5aa35b1ed900c0bac51515_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5412

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5904

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3684

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2380

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4840

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5008

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1644
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 f1ec3c117979be843793adf6e50517effea75e478a0e1a1a2fc4df4b82b20f6b
MD5 e058b9eb6121c81a285401b033de6007
SHA1 e943115dc26be8f6e30c327e3efa08a0b98b7b24
SHA512 38fd57e1219ce20cf0605b5cad7726e5501231ddcc29731e4d84074854cd79dd10b66e92ca5994bdb7ed37258cb648613a6a9ab0e1e89d96b69dc30ace2048c1
SSDEEP 98304:SrbT5whEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZT0tPiqk9+:wQnfW/JLGMcblLheTwaT9+
TLSH
T172A6BF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 7aebd2a752a913fa7c0af4134a737515c1d051642f94862b42801e036b8a0653
MD5 95b73749ce21daa0b40ecc0fd977628d
SHA1 0e060fd7bc5ae7919f754616d0d9328b9c3ea306
SHA512 b822346973117ba0130beeac943a35188e03c1b7608893a6bc9cb5e60c72c77f2296c434877ef4e2f67c282bbe2f86a9aef4cf0752776b1548a7d46e6ad4cd25
SSDEEP 49152:BTfiUEWo6zuEz439S99akTBc4O8b8ITDnlT4NvJrv1PiqMymJ/+hE:BTfiG/nzl90ntPiqk9+
TLSH
T1B8E5E52662C8C1EBE5642170CC69BBF900546D78DBA2CDD7BD447E06BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.2MB
SHA256 6697d019285ff852561653529ee50eddda7cac3e0e80bfdfeb07fd4e137421d0
MD5 eb1b29773f92f42f266df48a715b3eab
SHA1 de1e429230abc21ffdad87ae908fccbceac567d5
SHA512 cc1187bf1b1e80d950af342a6a60e8648a266df8c7dadc29dde888c97af8552bc790542fb50a98af27b41e0eb2e4484349dedd724cd565ebafdab45c9535abfa
SSDEEP 12288:iFQrrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:AQKBMvjRA+iqMIjmJ8c+hE
TLSH
T1C2552327269A4F53ED211A381CAA57B6C1ADE838FF116343B705329F4A7C1D12C7A61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.3MB
SHA256 cd86e67f2805f01e13869b77665759f5568b9207264175638e6febd5be4e9508
MD5 ace82616f4bcda154714b348617c2c53
SHA1 5c706fc76f379ec84f9b29bc31f73b1e9e7e0242
SHA512 c52e43362d1f7aa04c6dc3d94ae490ff23b42d916073644f3035cb2e5bb72555e4b70fb16905108692e0f0e326a0eda05237288556a66bb454a89b610d9b0643
SSDEEP 12288:45A7rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:4BBMvjRA+iqMIjmJ8c+hE
TLSH
T14A55123170C54AB2EA7202354D6F6B9BC00CF9385B2191D3F3985B7F9A381D35EB6962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 eddfcc678afcbc67c5b1fdab1b0d1c80411f8bbb13ef157dd6fcc026acb99628
MD5 4984e3c52ab4be023097112b29f54845
SHA1 9c891dad736b29d7519eb47bd815194884585981
SHA512 796696c6b389daf8cbaaaf775cee00c9ca4d7a1c0a6ba95b1cc17bc5f8f4bee8cb41fc1cc003c4297bbc3b176da887913f242ae340115d73e4fec41d25fe1a3c
SSDEEP 12288:S6dVWnxlMnn7nFKbltn+Ch/m6XvrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fuc/:p/TAbD+OmeuBMvjRA+iqMIjmJ8c+hE
TLSH
T17B75E11037D0C136F1B329368ABFD724956DB8715F6881CFE388166E5E706E0AA35B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dae631930c4cf514d391e8bde8b8dd35305f9ae90d3df6a5421b28ad51209f2b
MD5 4c96b93e9c4f620bc43c81541fc7db5e
SHA1 14dd5bd16e7197e500384348c1b34ca184f9e3b3
SHA512 08a3aa87980908db03dc5b1728f349aaaac3a75f0f676e58f2522ecade790bfb1fe32551e963ee63e850b4f2f272a24a0fad8adc07e651a412206791a89fe7cd
SSDEEP 49152:Fb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnQv1PiqMymJ/+hE:b3q6mjBZtPiqk9+
TLSH
T140D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3a382c267f00f3120ad7620a711b638e316755efcf91389c2057807b4277dd66
MD5 70040f812671130c840a26b30f9a3e39
SHA1 01d492ee602ba0afbccb177ec2169a7f72e94758
SHA512 2f52daba04e950850d8d87ee60ac86709d567e2ead71d77ca3561c565071c75ef0c6d5b34d52c533115006e5ce93255849ca3ba58dc905787175c253c78dd2e3
SSDEEP 12288:s1XLsswWkxy2lRq2czAIrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzIT:aXYfDtczAxBMvjRA+iqMIjmJ8c+hE
TLSH
T17465013963E409F9ED67823CCCA28512E773B8554760E78B03A4966A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c45c051db31e0f2c5075d6abd3b90f00f89e7a6d824161c3558399bbc3beb694
MD5 2240d8751a5a3fe4ce4827286d176a37
SHA1 9c66d8cd947215970f34d319901f3dc2f7809108
SHA512 25252b54c129df1e833cc98a9ae3b6f7b28fb5ec280bfdd736f312fdf61dc798fdb486891839e06ac6039a90a6b67be70d71658dfb1a334cf4204408dd67ba94
SSDEEP 24576:n0Le5ji0hmxhrMOBMvjRA+iqMIjmJ8c+hE:nPji0Azuv1PiqMymJ/+hE
TLSH
T16485AE26F5748331D073C0B9C5D2A69AE97130865B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 73a3b9ab41931aa05455fd6cdf38f27652370501ce0c27a05c2396f7871849cb
MD5 e323650836e225282225644b4796da98
SHA1 8f63f6b832a4dc0de7eec28e557d32f1ddbd3712
SHA512 4430239d9ab08c2b79963ab8a6604cd8bd9d0862c2ca1dd5639f9715357869534ddb46f16da6e2c3189581e108682079dbe79d7fa287f8e6b0df8a9a79b1ee35
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWj6q8wyucBMvjRA+iqMIjmJ8c+hE:H/ezSC6vUzPv+Hjyav1PiqMymJ/+hE
TLSH
T15A755D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 82a6964a9b749f1da7a78ed8c8e6420d1da4eb48363dfb519fbd54f9ac31d533
MD5 79a94f2538754a03bb61c2520e70eb8e
SHA1 b43322a4000c86eb4f0b6b53af2064b4c5b2b153
SHA512 81fe4d8cd02e64a3179b1f67e0a67fd304ee416d2a76431d8f4374026e370642ab3ef48b0b0c00369446de95c4257a898d166a1a06cc246b8aeb3582ccbce13a
SSDEEP 24576:UVbqPb88hv/l+BVBMvjRA+iqMIjmJ8c+hE:UVO88hXl+Ov1PiqMymJ/+hE
TLSH
T15A559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5466d3f177853f490c0aeb2511534d60fafd46ac6b0feb0762f910adc875b736
MD5 28f7db448884c642fe9d2034f2e18c4e
SHA1 d909cc26af0efef7c7e612b6cd9bd3b2e83dd811
SHA512 84e42fd9ba8e0bc4f2d9f4c09b82d895b58fb62778af745f2256e3ff67764292b7321c3d6d270c08a704055f920f026639814c5e387b3a719472902d76a72c44
SSDEEP 12288:sGTrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:sGiBMvjRA+iqMIjmJ8c+hE
TLSH
T10645233600A80A95FF733F386DEB57A3C285EC7DB550A203B51676DB563C1E0A88A607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 03003dbf4e97d70ad30b17ba05b7d6c25feda8b48e107fa5eb170d98da35b450
MD5 511d0b0127cce9783e0faa3e0ad444e7
SHA1 51112426f2e8aad61e010d920c563f4931be941a
SHA512 42df424e41ae677f375ddf113b30c946fab4d2148bb0da69ffa9f4452d6ac70abad9b5f6c93f9fe5dd2a685068d84cecd9b3e6db48e4b8626802ac219f1e707a
SSDEEP 12288:KeBNUbTVO86UkrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:KJIUdBMvjRA+iqMIjmJ8c+hE
TLSH
T10165DF3BAE28FCD2C67A5D785A918700D77278304F62A3CBE165834EDE235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d50051e812d8accf04b108aac87633ec753274ad25789105993df81cbb047920
MD5 0ff4fa32407b82940762841f0c86adea
SHA1 ae19f6867ff622ee438bbb6381c129ee5d1cdc90
SHA512 99efdbd3b7d0bceb316d2157d785fb6f94642c0bb5cc2d3e378c806a5e8b97b29fdf1c9e2428015b2651856dc9d59d1fb1dc5b02dc8ce17c7b4783ea28274ccb
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THb:RQvGAdlCEL8c/WRNw5C7tPiqk9+
TLSH
T1F3266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 fde35b7892d6c1abf904e00c94cc2983c2860fb4dde04e681200950b616710b5
MD5 05c24214a0f849e9348968d893d132d6
SHA1 d07fbd2afeb5c98ce8c3cd43c13403bc3cd8f429
SHA512 1e36499dd3d7e6d1901d0f909be7fccba5860adf67d6abd5fd4b5e8b3025a3d2a4714f5e2674e862ab387169fc3663d062ed4db44e9a0827c5e93e00289d54bc
SSDEEP 12288:IAwSfxL/2Dc3mDLLmt0LDQewsAj6rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2FuQ:tfewsAjjBMvjRA+iqMIjmJ8c+hE
TLSH
T16175F031FA74D432C7BB0DB61B36C716542CB9204B612AC3F3A89E9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e9e42b0ac68b34482e97bd689b1a2752f023f60dfcaba1d7eb7e28d1648ec3d1
MD5 bfe3f61e055413ca9b2b1fbad1366a81
SHA1 1188b9f3e1d8b8cd1571d6094fbf7cd625d28666
SHA512 ee8b496b9c680483c69dc9e10727b84e3dc9d16bf04a803870d18726577563d711fe9b0be6f30efafd5ded13379777e213ba2f2164bcf5af652a71b1faf43661
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHGaT9+:jUEtQevvqc2W1cpV20I32GaM
TLSH
T199474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4d976341d1cbfb5737a001bebb60d45dd72506b82df96ba015f7a531642cde72
MD5 e8adb76e0a2dc3f13cb0ff03d26720d4
SHA1 655b19b4dda7f9bb5e6d897f32dea64e2b9a9a52
SHA512 231fe022edc68ebbcd10c5a5453906d6d36dcc6e5041165aca33521f8b5cac0a572cb4aa7d810792c689316e72e6f186fb4ca078e84d4431c6414de5ca6692be
SSDEEP 49152:aCbRquA/m2yL5zQfFiV+XenmE3/zev1PiqMymJ/+hE:voqtVjnmXtPiqk9+
TLSH
T110D58E1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 421729c6bf300504b1145ffdba2024ef3159815d4c49e960d2a9d9f9d409a7dc
MD5 69bb3721c392b52400fd9d57d6dcd51a
SHA1 0314412f55427325838eac0ceb0802a77772eb01
SHA512 4b6842fe9316c76ba3c4a550f823ab5e28a4d00ae6039c9532e373253df18731ecb11b92bd0f84e341aad47a98c52169023cd9e7dac27340adfd29222d9ead45
SSDEEP 24576:AAhGL6IFoiwtA5l7S53YBMvjRA+iqMIjmJ8c+hE:AAM5Foiq5nv1PiqMymJ/+hE
TLSH
T1EC35AD81E7F945D4F5B3AA7899B68171EA76BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f1423b478ab5b1a89b4bf0b065112fbe6c31741d51438bdbaead3a0e4f30590b
MD5 71a768b7a8208879b9c806baff82814d
SHA1 2911f21c8b153a919683164a3fcbd4921cf53ca9
SHA512 4890f98e21fdf734b98a843831831f55ae4c375e12f2829f5191c93413858483d31774c65ac539b5c52fcc4b615c21d9918574879447e47a478c5340fcbd1cc1
SSDEEP 12288:Imw5HEjsChNEBFgl0WDm+ClrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:lwuROW/BMvjRA+iqMIjmJ8c+hE
TLSH
T1C265F11A32A80CF9E96356388597C236E7F2BC163A21D71F1760C65B5F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1013bd2ea6d626deda058423323359fd8260236da497df1c8b2b2ea646ec94ff
MD5 af2394fad42cf7a52db85bff09fedfae
SHA1 977fca67ba620324367c92983f14fc07531c5740
SHA512 ac5a98d0474c446c1aed5f337b47314a49c899049e3a2af0cfc8fee05c226a32174a6a4cb96053a61a0b29244ce59856fa27b13490fd923c0b00c41e82f6f8f5
SSDEEP 12288:gyZ1IyKrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:lZu2BMvjRA+iqMIjmJ8c+hE
TLSH
T12955122A22E811F5E673173CDCE65742D362B866733183CF262552AB1F37AD11D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fd6bffeaba0c297df5ff7c6aadaa5344bd20cd0ba1979564cad6fb092cba9b87
MD5 d498c67d56f62a4bec7e43bdcec7fbe7
SHA1 14f01866b114c53a8c73b793ec8f1a764b7eb3a9
SHA512 705f3dc561bed0692c0a8e21b3ec314dccf32e9cd773c9ae3b1f3d39edb1d105717603fa7b4e09d9e3fe4f36d3f4e71d1fe9969d624bc159dc2ec686047ad1b1
SSDEEP 98304:AQRQyi36YOcPDLvw2gAf+PN3stPiqk9+:XQyiKanX+PNYaT9+
TLSH
T1FC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f54c2b3b90777e2123d3a3d920381e724885ff2215ab110f83df618ba2844af3
MD5 a02f3931541c2eba57a800e28bc4c9eb
SHA1 7dd697cee417d6d08649924f1c54f69709aca9ae
SHA512 5c311e0d8ad4d0498bf116d108249bb44972872f78c491ef005e4a9c1f2b7f54978c7800d9265c3332b7aa17dc2a224d8f578afe066bfdbf33d20e9f5af0da01
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN3stPiqk9+:qQyiKanX+PNYaT9+
TLSH
T136667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cccb5743c9c6fa5c665efd8276973a56ba94b14f53cc464380389ec71053f16e
MD5 5f37fefa085905c139a9b7ce33b69141
SHA1 c5215759cb34eccd6b7ce665021c18f6b01b114a
SHA512 c44bc36985da674df9f22e3d113ea1c025e58294800f1fd97eca03afa090a61cabf8d392ec7dc118cf6ecb985018c81c3177df1ae01351785d529acb0c97fd55
SSDEEP 49152:268Qg55nhkeWu7PNU3/uv1PiqMymJ/+hE:UthTRc/utPiqk9+
TLSH
T1CCB54A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4c66650f544bd9930668a62f8223fff0ff994f5a43852d69c8e113544cb04af0
MD5 4eefcb8c937df2aa14a8b8ca8e1e0eec
SHA1 f2c76ab0edffbb48545effb6833a3ecb3669d2cc
SHA512 27b69120e5390f1248b62d4059167d3202b7c3ed5ce565ec62e324033f60d4e094188b58c31a66321adb40c3a42caa7f2bddaa23c78eee4da14bdd458aef44ed
SSDEEP 98304:Zy5112gYy5azzVvU69nLKnhZptPiqk9+:0LIHRWhFaT9+
TLSH
T14C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9a638ae5b80fe64d0da3d6f61a54858df046a9e268fa0cd8a88bf290db6ea2e0
MD5 141dd82706602c5e61aefeaf90bb9563
SHA1 236e0f83fa11be386db0f55ff0a7c88d7492eab4
SHA512 39c7a52c2f39d68d1974abb1670b2947fdc45e4d1d71738ca8edb80d15e7048e48210867187c17c0d06dc5924aceb760b2de6cd9ae182b5e4a27f1a02f667d36
SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl1v1PiqMymJ/+hE:Nu6JmIxd2d1tPiqk9+
TLSH
T125D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fca2cafb06f7305602361c3c3e3d5d637f3cf2a2dc7191a54e5008afeceee1d6
MD5 ad3ed10502fd50c5adef84fa9189f1e8
SHA1 60765c29f772c2aea5f12ff94eafbc0ab8bc4f1b
SHA512 1e930bcd99e350e632bb1bb242a0c6b292729232d6122cb219e564fd33c86e0bd312e43a47c3064a01a178b8f98ff5bb31a9ca366522ba12a9fe43e4f75c01d9
SSDEEP 49152:p1hpsNoJpF1A67U44CwH7R4xQv1PiqMymJ/+hE:pmifPqRXtPiqk9+
TLSH
T1DDB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0661186cf1f5e38e384a35b75e85d794806147ccf57aa815850cb747050b2fde
MD5 b96202a3eadff5134172ce09bf5a091d
SHA1 e28ae4fb25506246faa933f8c334daeefcd52e8a
SHA512 f2132eb09f6f1b591e8c904a32e57d750960265b1d25383e8b816b61632401c51a7d442c4883428d52b8c12ff6bcaf99910c54de2cc456c66408f5e123727b1a
SSDEEP 49152:kSuZQIY0Be2KkRVtOnks6NMHqtv1PiqMymJ/+hE:25dKqi61ttPiqk9+
TLSH
T1A3C5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 10104f9f388c9b0376c9b99e082b77191e57bada5728bf64801af17148400243
MD5 60f9c630251bd679b714a0f67b8a6262
SHA1 2ef5e6bd432a6e1c922398ea472d1e5e64576055
SHA512 ac8ac57478e92d4bd5480a0fa58bd58f91089c69024f6c755a00ecceb849a4a01c6001bd25942d6ef158b5e949f0d07586e7e34d588e7c5924c978ae498c1edd
SSDEEP 49152:PhtSn8EApI0figjgiDn0AP5w0v1PiqMymJ/+hE:eX2iWphjtPiqk9+
TLSH
T13795BE13F2D901E8D06AD178C7468632EA62BC160B35B6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9aef46e66d66a11e33e4bad02b4394ec2b3f12e42fcae90bc1060da2bae87578
MD5 cef4032d466ff75d9c63c5bf490ea565
SHA1 fbd69d8de8f086e1365ac5e708f95a61d2451d67
SHA512 fafa6938b35d517abcc930ba79e7357cff8e6b4136f51cbafa763f2da15643f10368ca761c96bcf2af94e9132915112d0d9922734e55bc8ae2ec18a35df2e854
SSDEEP 12288:iLrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:iqBMvjRA+iqMIjmJ8c+hE
TLSH
T1EC45233A00AD0F86FF323B3C99D75393C285AC7EF651A203761A729B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 949478be81b4a196610393a10d2bb57f00cc6539143aa2beae054a08e58788ad
MD5 43eebe8351fbaa5642f822cca2aa9bd8
SHA1 05fe8646faf30d4fde71aa6406c1654607c11cdc
SHA512 af25acb922d134762744f730a3da456236794e16cea1f586ccfa9454f3327ba2dde5817ede5e856b0aa45bd98509d6f2292ecef2d805a8f83d9adf64146ee9c7
SSDEEP 12288:4OrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:4XBMvjRA+iqMIjmJ8c+hE
TLSH
T11745233A00A90F86FF323B3C99D75392C245EC7FF651A203761A719B573D1E4284EA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 12f463e953f2ece950da973240337de2621931ae88753c4d97f3ff9d667851b9
MD5 996f0d91d1435565c01e226c0a5c0757
SHA1 7c8554e66d80a77a0f5b9b2e81e65e821c2a214d
SHA512 94e5984721e974281084b84b96d3364c3f5f1e7232f3b54020e4d89497342abbdc49b1341d375bd37d93f5e2990a8869ad49e5a678ed7588303ff70fca719ed5
SSDEEP 12288:58rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:5FBMvjRA+iqMIjmJ8c+hE
TLSH
T17945233A00A90F86FE323B3C99D75392C285EC7EF651A203B61A719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f69a85cf9096506f9628eeb963229e357bab32862b3e70a0dc15028c0954e364
MD5 5602889a6710839739369bbd7b5547f4
SHA1 cf4dc665964a3ace4b6530ed09ba16e71e8c1a68
SHA512 665e87b4627cb9d185a86f989f14d29e4f788df0503b50a2d61181f5fca799411a1de8862f1923d5fedd50d4d86da52584bfd9be2448ecd134efdeac36b1be93
SSDEEP 12288:YVBrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:1BMvjRA+iqMIjmJ8c+hE
TLSH
T1DE45233611A906C5FD32AB3CD9A65352D395FCAEF731A30FB605219B0B392E02C69F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ff25201aa2b664376ec6c9b01824222db6632634efcbc123fad8d222e7593a1c
MD5 32a3bc18967cbc4e138b219d982b6fcd
SHA1 ecb1a0295a3367f619d4763e053fe9d8023a37f7
SHA512 e1e705532c505f8cf0263c9a1334fe63e0bcd3b4b6a8147ee8d50b86a8fb6f274bb71ba6e381074e5004551cf3d2af676c2a6552859718b163c9e4c969ba2d56
SSDEEP 12288:RJrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:RwBMvjRA+iqMIjmJ8c+hE
TLSH
T1AA45233A00AD0B86FF323B3C99D75392C285AC7FF651A207B60E719B573D1E4284EA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bfadba1f39a3c248f97cbc8cb41eafcea1c5c915e0acd9a681cd19d8f90e0222
MD5 98a0addc74ce4510894768bbb994c3c3
SHA1 ec7891c1cd2c46b08b1efa23b5cc596fe5c45ad7
SHA512 b40c51c6706a7ea80c9d077d2d48948a5ef38b79aa93887f3f81e44c3bf0977ff63a6313c8398c8a9a306e6b20c26cb731d14cd87a8c33bdaf93a409ac2b81ca
SSDEEP 12288:HyrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:HLBMvjRA+iqMIjmJ8c+hE
TLSH
T1F745233A00AD0F86FF323B3CADD65392C244EC7EF651A207761A719B533D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6533f4df190940efd9939b4868c6e6e09ca5b30095d29a39f4b63b173ae8671c
MD5 a90ab556b37974341354ba87080a5916
SHA1 4774ba775005bd677156e8a9f6da77de9111b188
SHA512 5ed50832ca8d78fcd8d3b11d7a50721639f6f68eb3a77eec8ae3aeea005b9552a147cadfc34ee16d4dd45c1281e0b994d91f4690cdb50d7afbb0b1a64ac69c7a
SSDEEP 12288:12rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:1vBMvjRA+iqMIjmJ8c+hE
TLSH
T13845233A00A90F46FF323B3C9DD653A2C285EC7EF651A207B61E719B533D1E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 0857934ddc29ff4912ec2745ac94f58bb285547652afd0b07b5d2005d3629db1
MD5 a95a325c0d60b83ec562da6e222d60fa
SHA1 b429343f99559db4096f458d17f8debc9b595764
SHA512 c6ad76acaf4ded5a4da4e23817e8bed54e5f9f453fa3dddc25708db6c556ffc6f7467a3746c55f65dcd63a5e8573c5a5c5c41659ba2567afdb54acf5631a623f
SSDEEP 12288:ziZwbDzzFEoS2cPvyurGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8ti:eZM3zFVSO3BMvjRA+iqMIjmJ8c+hE
TLSH
T1DB65016573900CF8ED63423ECD558A16D2B2BC6A5770C60F13A8366B5F373A11C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e383fc2e4624d76a54bbab3e66ff441d7fb75c009a733da5d6c87beb3b22c7d6
MD5 81d06953283a26ca9f4d788dd466862c
SHA1 66abce27bf01f0d037f2df112c0381739a68b534
SHA512 f2cc1de09ac0fceb7059f607ca39bcf3c715aa686ee028370e32182e7d8bcd95f6c75a91fd1d99abaf9b2d899e58f2040e8da0c137948ef2b9e6b0abb39e1cb2
SSDEEP 12288:PXrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:PGBMvjRA+iqMIjmJ8c+hE
TLSH
T1E245233A00A90F86FF322B3C99D75792C284EC7EF651A203B61F719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cb36891aa65df827ad55d429ff748a8f576b90b3cc7163a0ac2e03e236d5fd0f
MD5 9dd147fb22fd1bf5fd8ff6c59e953ae8
SHA1 c2a8f1858176069efde0b69140e014723c88deb1
SHA512 02b28704b04a7de7f4b9fdf5758d1ffed6afb4fd1e534b6a8b290826872c44e4417bc5d881585bab57c17cc92e0dbd2ab63d8e2b597ae4d4bcb1c85c2ccec55a
SSDEEP 12288:VjrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:VyBMvjRA+iqMIjmJ8c+hE
TLSH
T1CF45233A00A90F86FF323B3C99D65792C244EC7FF651A203B61E729B573D1E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b8f4a202fa3092c70d1b83dfcc5e445996f6a61e3325063cb93e78dca9dc3f13
MD5 07e1088d14c8218d9221fe5d2670ff85
SHA1 84902760c3ac061d529abe3f3b5d2c92244518db
SHA512 86753cd3822db470ace90380c84d0bb477bbbc64d1cacde577013eb642d80f42d7da1bb9334ce1b1bdde93794a5d60b0b18ccd45e8036f012f6a1e8b6eb16f38
SSDEEP 12288:LyPz5L8KrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:mzyzBMvjRA+iqMIjmJ8c+hE
TLSH
T1B255021722A521F9E5335238CCA21B52F372B83657209A5F676453BB2F372E05D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 cbf4d22138be1a908e0520d7640ca92f0a4841f6d6ff00f7ffa94ed3e86bb6e4
MD5 3310518f6d8006ccfcc4ded6cdf98c75
SHA1 819495516b17a1e645a18835eae18945afaaa232
SHA512 fe6d052f05c621c6d195caedb468d37f1ab651909ff3aa42ea5ce299e481f185eff0d3f364da0b6d18eae17eb488e474f0def4b5a94de68c1222937694ae43bc
SSDEEP 12288:3XrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:3GBMvjRA+iqMIjmJ8c+hE
TLSH
T17045233A00A90F86FF322B3C99D75792C284EC7FF651A203B61E719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 78d0806f108e9300b271db389e6a4d837b3ef90e7c6ed5e7141f0219eec856e1
MD5 38a01b793291fe7d0e96e683c78381d1
SHA1 08f27a4c532fba92d8554b2a88e851b0b6d95b7e
SHA512 2a8f9c0c841d8dfd1c801a1f61ee3bd6751eef1767bf0ff155588e8a53c921e8287e865df1c94c5f7f74c548f553b51d2cc71030b877f3a29a3edbb22089f582
SSDEEP 12288:BXrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:BGBMvjRA+iqMIjmJ8c+hE
TLSH
T12745233A00A90F86FF322B3C99D75792C284EC7EF651A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6f60365ed4faa8c8c94bb06f4f1656f63622149c3046ed37e514adce617a0d30
MD5 bae3c60b5820b1266ec876edfedbe936
SHA1 a109d2358e840c8a6da6eb1a62936d2e9b8d972b
SHA512 a90f4ed9ac39032a36061de0b0164961ac6df04dd66f73cf5fbf17d502123d0504772961e14aa0c86940fa50df985ff310629faeb17e35a3b9c61d9fff242627
SSDEEP 12288:byPz5L8KrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:WzyzBMvjRA+iqMIjmJ8c+hE
TLSH
T1F155021722A521F9E5335238CCA21B52F372B83657209A5F676453BB2F376E05D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d0ef70481417cdb2f6b456b8d5935eff7c6751ea2ba172db838487e529a1f7b2
MD5 5d5e5d3ce108aab266fa6a3734f09ba4
SHA1 4920942618efa7a07f342eb57dec78079604d145
SHA512 294fa62bd0af45b75d310ddbbe74e21707ad2d4c31d04d5bc41ac268f4c8cae5881275eb8b6683c0cace82e60e7d8fffc33ec1755093a1bf5e1f660a7e07899b
SSDEEP 12288:XCd91WYoaLHF3z0z04PDvhsrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:ST8aLl3z0zD1BMvjRA+iqMIjmJ8c+hE
TLSH
T11B65026573900CF8ED63423ECD568A16D2B2BC6A5770C61F13A8366B5F373A01C2EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 540e18e863e6e5e93889661c6d40a282be30bbabb685a17d06888ef3b18f43dd
MD5 72318d8bd091bd0fbf89fec23b4c12b6
SHA1 29dcf90592f7bf545ba1c8c0fcaea9e5d06a1cee
SHA512 7bac581a3da1752831fb51a8e4dbf58f9a27b8beb4851fee7547f7e4e4e009e3ccfdfa88b1d3721950c3c9fd66b377dbb7cc4b33d226e10087a8ddf3b23d8c48
SSDEEP 24576:5fwvzk9RX6wkyAICBMvjRA+iqMIjmJ8c+hE:4MnYIJv1PiqMymJ/+hE
TLSH
T15185CF29EBDC04E5E177923C99B7460AF2B178691B31C2CF125A53AE0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 793acac7b54a90648ec5a82895f070a7717f0674d781dbf70d76e49584d5dc09
MD5 da83ac6134383fc6492a130744ad75eb
SHA1 1b924f8b562f85ddb50eb9e71729494d6c6a672b
SHA512 7a7017867d8e7225e44b23e0d86a81f6d515ece389a6a82172b8bff5e00535aa78b5ae511661b7ea0c30dd0cab25c829cd4a8b267fbff99e7eded4a012a3bdab
SSDEEP 49152:hYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Uv1PiqMymJ/+q:4ySzPMtPiqk9+
TLSH
T154066C56A1A801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4abee5a853f9bbdb1d7ef89ca98d74c2d8abf86ef567081d4e812cd0b49c8041
MD5 280bb5367db9468e378ce121fe99cb16
SHA1 1c597d5dd8ec9cdee6700aa380026743746cf5b8
SHA512 89b457c2d476aad7b40d0c10d2046fb00d0232bc46caad9aeedad971e4a92db92f7e001a72bccfa6b42abc0fdab98585635c7af9acb8e00fb1f789b9c70294fa
SSDEEP 24576:B47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYHBMvjRA+iqMIjmJ8c+hE:B47JUQjqirIhCnDHUPfF/kv1PiqMymJJ
TLSH
T11165AE1EA3EC01E5E1BA927885154A5AEA71742E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6858ab8a0b6d63a9b65372e47ba822ce30f41e3e95bf0a693174e83e1af99139
MD5 d186a2f3a9664349c9fdd444758f4920
SHA1 867caddb2e49e21ed3f7643f12d333a0e2df6aa1
SHA512 be2d2d7e180a361d06dc98def38cfca80ed5726fd98fa2c63bf592adb8b0840ce0f1df721ac2d651e5c7d79a59e1baa14b71fef3aa8894b090372d21ca48fd37
SSDEEP 12288:ZpsfHrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV7:a2BMvjRA+iqMIjmJ8c+hEd
TLSH
T16D55F11AC29802D8D56E6239CB964641F3637C2993E1D3CB62D0F57E1F3A6D05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 1a191ad96e46f7027c6f8009b73a291a62aa55643b41133de07975c4f6b6c8ec
MD5 0abeae6ee688159379d990ccffacd094
SHA1 6352ac69cf1dccd6cf41bcd76ef7306f27913aa3
SHA512 292faa1cb578ce85e8ad85327e7aae70c2d3a96fe26ecfd9184db065ac3699f1d21dba238adf5d6897e8741a194dff3f5038ac738c8bdc1bb343e225179e64d8
SSDEEP 12288:rOS0lU3fd4x20lfCSyU8cflNz9vo+BLwM8xcv1q9ZzY:rOSQUP2/6SyU3Bo+BLwMecv1q9i
TLSH
T1B63539007666C74FC66980365E32D2CCA7B07D41FE456F0773C88B3F9576A58BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 55a40722834d247524afc65d9245adbd3f10336396b71bcadf0467378f7bb1b2
MD5 526bb98f16ec360b13751bdedf50c4d0
SHA1 d7d3d0d02d6d4fe22fc868c8868eb87079f6bdc9
SHA512 d292efde3703394bab5c5ffa860688afee674055be94f6b611e4ee400b9bee34da9fe92ab32aadccc32be061da29c640de20183d86b92527e79f593971eb4f17
SSDEEP 6144:M9Ih8EkumoWYHfSVfSVcSVmFGuwr/DsolGSqtMxVSqtMxg3v3FAGRrxByldak:MwWYHyyJmGr/Dsol9dxByldak
TLSH
T19465C6416137E28FD1BB6072472A5B4C77A8EC06BB056F27B388453AD46AA15B0FD3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 178B
SHA256 6a6b59597ce84da06c492db0425eae46930ad171631a7af87c04e30c2c897662
MD5 0bea5a7d8995d18793fa4aae2c29e922
SHA1 46e35c6e952e1a5509981656f35728ac962fa5b5
SHA512 dab961299fa50cde73f19315e6d734e05bffda6472e814077303cb9036796eeb1c2104a71dd8adf328adf2eb1c526b757cfcdd9d46ea02b91d60b5d64e98c018
TLSH
T1F2C0128305AE51D96B36114D95053F521142B5118A414E31B3643BC678A0803081BC1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp913A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp913A.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpAA32.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpAA32.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

79a6fc8f8562d1.bin

Path C:\Users\Admin\AppData\Roaming\79a6fc8f8562d1.bin
Size 12KB
SHA256 c0cdbe63587bfd94b3a09aace32c5c13a98794405b69fc417140fba63b63be7b
MD5 27c163d3088e7fe291ab990f982efcc1
SHA1 92d8039a61fb5f2714ea524a86eaded55c72e68e
SHA512 f97f9dbb69e7760520725bea03b6e7c9ebd208f1443f9f8fd552d8e287a3272c7c9fdfcbb6dc1e74e63389665b00bf7e270c1e4d6edafe024d2d8a2e7ba2e2e5
SSDEEP 192:ihzqC2YQ2ihhquJbw2zfCE4Ki6uGDwBl3JP5Z6tDbBUKIchVBDXgfN9VHoQhx:1v2aqj2uvK63Hc5UKTZD09BoQhx
TLSH
T1FF42B0638844CFF19BC00AD29A66195D21D3507B9F7FA4BB3E0A02CAB59F06C4CC16B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 fc6b8af825a0ff5c45b995e789607e8c0df1dbfbd3f85da3f2dc534e787b94ad
MD5 dc9ad8cb5ad0b29e6841d408437664e8
SHA1 e8185019f3de86102b844f7627959629e54726b8
SHA512 dbc2129e4337ffd7f7bb848679a31d12167d9c664fd56da9ef39e742c1251cce29c48ba1eb01cc1b4685f4e536ce3e309b5795791db848a482612bdf54102ec0
SSDEEP 12288:VM7vrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:uuBMvjRA+iqMIjmJ8c+hE
TLSH
T11045233601AC0E46FE723B38599B9332D249FD7DBB10E183B50A72DB563D5D06C69B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 63f5773cbb81283c075961bf79e3e60f6d182fd187f97039103d822cf345720f
MD5 583036cbea39bd4c92c230eaebac0223
SHA1 9c9307558600f9c71093e71cc14d0375de3c64c8
SHA512 af72f05f51ce1a1baa3d74b2be0ae43cef53fb246468ccf088f6f667123f31558934a13cf08119ad02c921f634e8b71cbb820eaa8f565bc3850f89add7bb4769
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYcBMvjRA+iqMIjmJ8c+hE:igb4mBIBhGFyv1PiqMymJ/+hE
TLSH
T17565AE1E22EC02F5E0F6E2B8DDAA4417D6B278161731D2CF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b7cb82625b0cd1d52842daebce5e0424b631e16b93eef0217726283c0a973487
MD5 59f20aa15dc31eeca644353323d27cce
SHA1 2e47fcba8eae696260ed105a7325b116d4371204
SHA512 6bf57c5863523f444abd57edadaf1fef7d4215c9d4e3191274e2229696fa306b86cc88af2ec44e0a167974540a138b06a6a105043680f9e5300873ceea5ddafe
SSDEEP 24576:IG88u8FpJqH1vzria7/m3BMvjRA+iqMIjmJ8c+hE:r7ZFPqVya7/Tv1PiqMymJ/+hE
TLSH
T12B85F12566E102F1D477D13889864663F6B2B8251360FBDF07AC8B561F23AE50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a1c88adf3b39db4add6c67fd5734eb9342c5cd08e05776df1338117c8bb7675a
MD5 ec0b796b4113c5798a71e669f9c396f3
SHA1 0c54ad692094f9b04da23d3108adc11af1c011ff
SHA512 2cee1027b5a7c2abad0bc7aa25cc6d3acc9a4e2ca2c0960436b15001a4fdd6418e02e4953aa476423e6eab364702f3345e917bf7f5eafde755c8df1c364ef2f7
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWv1PiqMymJ/+hE:/G05lO43bxtPiqk9+
TLSH
T1E6D5CF6E62EC01F9D1BBD17CD9C6460BEBB23825033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1323d26b19d4d0a5e3c5cb2492a9363062dc4ae380f23492e29d5bd628223e33
MD5 4c32fdc945c4a7d7dcb088650b8d9b39
SHA1 89d59ae779e19c426fe4a8d9076f1b275961ba35
SHA512 1b96def900cbb8969f80f1c91cd54a11c6cf0777240aa6935bbef9f508949da2547a344f81aefd0fefe410f7bad2cb2c0e89ee7d0ed2fa7895c5eb17835b7d82
SSDEEP 24576:Vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnRBMvjRA+iqMIjmJ8c+hE:1a5POZ3lJt2pasx2+muv1PiqMymJ/+hE
TLSH
T11C65BF5EA2FC01D5E579D17CC583461AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a1b15be80f226f0773c2666ca9bff3d9e5c1456cd573a20f0c88982452444809
MD5 8f5aefcf0f87b9883ecdf3abb86e0ec8
SHA1 d017c18ef5bf4fbb1b6a11309570e7a6e611e41f
SHA512 d5e90202962de4bb56f112134b5e038ece2e018d7d0152f06199fe37f2a640bb06386d68f343af62389c281731e6a8c131820e7a3324fefc8579251f13ac860e
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7FkfBMvjRA+iqMIjmJ8c+hE:7Nc/zEOVHFzv1PiqMymJ/+hE
TLSH
T12C857C2622E901E4F5B7E1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8dcdfe04b2da3f09339afb5d966572c2df524ef0573de1fde7d67bca289b4289
MD5 47728866adb9faca495ad6a596c25d6a
SHA1 7b41c73058be3f0d528f469222767b759594eb89
SHA512 5ced3282a7b4539583c514bb7d0bdf7d1278f45a3ebf0675c82d4e612c3555d832ac37460e6376821d569465ac17e52242a74c424d4c66ad93dc8dc093e55628
SSDEEP 24576:QzkNvNnaFeYhJNtmZBmaBMvjRA+iqMIjmJ8c+hE:QzMwBtOmRv1PiqMymJ/+hE
TLSH
T1E955AF2EB6F806E4E1FAC6B4CD238512E6727461173293CB5290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 53ad4f153cc8f860e8b0fcf78df7bd632600199cce83c610df6991b4774cb88e
MD5 e33dbf9f6ca20cbed56b15d32de88bff
SHA1 bd5c83b457b965553da29bf103590e1adec45566
SHA512 00a9f28b890171c06364e5d44c5b37d135dddd922f199169af560982f0b2eca8b865be39508f6123de211cc18e92b87aec5f3b76fcb149a8a0f110ac22c4eb39
SSDEEP 12288:MHvUrBFrEjwaQCrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:MPUr+NQbBMvjRA+iqMIjmJ8c+hE
TLSH
T11865E12F21AC1CE5E676A17C89868719E771B8661712D2CF0291817F4F27AE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6ed3cf48c02821cd3a72efde31a750b507b0a5055e2e9938b22dd8fd9ac4df24
MD5 bee58bf477f9f434e3a543a4a4417c2c
SHA1 2368d6c47eba4062b653ea27d7a4232b03f2900e
SHA512 52f120f7e5c5dd7056467c469b0d8b8b6b34cdf07a43c2c7bc2bfdce4a7e2d0c0c2cbcc4b3e9117543797d193ea993fd7851458500850261578c8c3162b41d72
SSDEEP 24576:dD3FHshBIYQgAKBMvjRA+iqMIjmJ8c+hE:dDVHeBIAABv1PiqMymJ/+hE
TLSH
T13175E13EE69C04E4E577D17CDA638606E77178AD032266CB129491BA1F2BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1532-183-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1532-185-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1532-599-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1532-177-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1532-601-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1532-397-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1644-561-0x00000214F5230000-0x00000214F53FA000-memory.dmp

Download

memory/1736-545-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/1736-550-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/1736-544-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/1736-603-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/1736-616-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/1764-226-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1764-222-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1764-224-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1764-216-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1764-215-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2380-167-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2380-173-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2380-168-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2380-396-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3684-382-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3684-163-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3684-157-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3684-155-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4652-1-0x00000000026A0000-0x0000000002707000-memory.dmp

Download

memory/4652-0-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/4652-40-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/4652-6-0x00000000026A0000-0x0000000002707000-memory.dmp

Download

memory/4652-7-0x00000000026A0000-0x0000000002707000-memory.dmp

Download

memory/4688-145-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4688-144-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4688-151-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4688-366-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4768-189-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4768-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4768-13-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4768-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4768-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4840-197-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4840-190-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4840-398-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4840-400-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4840-402-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4976-403-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4976-232-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4976-238-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4976-231-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5008-204-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/5008-210-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/5008-202-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5008-399-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5412-214-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5412-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5412-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5412-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5412-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5904-129-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5904-130-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5904-136-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5904-142-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5904-140-0x00000000015B0000-0x0000000001610000-memory.dmp

Download