4bf5f7bb064a1305705b08c605f863e6b0439d1af1d08f3db81ffb7b5e5cc72f

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
Size 1.6MB
Sample260804-jax6satgmd
SHA256 4bf5f7bb064a1305705b08c605f863e6b0439d1af1d08f3db81ffb7b5e5cc72f
MD5 4696c2aa55d03284e1f4ed8d5b35db5c
SHA1 a70ee16f3dbd21e17bf217928ea8f8c7b2c4b4a3
SHA512 1cadbd9e890b6a2cdacd3cb757282f36619a8fa56741c0a10b150a7384e6d87aa1da4c68e5825bf4714c709d2188df3e36b79d08baa9cfe0552a9c3a4307db5a
SSDEEP 12288:Ca0wIk0BX3RKTemGd70ioGuVWW6oIbrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP23:CaqDd70iTWC6BMvjRA+iqMIjmJ8c+hE
TLSH
T1D275E01033D08136F5B329368ABFD724552DB8715F6982CFE388166E5E706E1EA31B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4928	elevation_service.exe
1264	elevation_service.exe
5460	maintenanceservice.exe
5960	OSE.EXE
5336	PerceptionSimulationService.exe
1128	perfhost.exe
2984	ReFsDedupSvc.exe
5856	SensorDataService.exe
2384	ssh-agent.exe
3384	AgentService.exe
5740	SearchIndexer.exe
756	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\242c8bf883806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef5911e7e223dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc41c228e323dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab1706e6e223dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000794bf2e7e223dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ed36129e323dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0880b29e323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4236	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
4236	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
4236	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
4236	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
4236	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
4236	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
4236	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
4236	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
4236	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
4236	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
1264	elevation_service.exe
1264	elevation_service.exe
1264	elevation_service.exe
1264	elevation_service.exe
1264	elevation_service.exe
1264	elevation_service.exe
1264	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4236	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4928	elevation_service.exe
Token: SeBackupPrivilege	2984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2984	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3384	AgentService.exe
Token: SeBackupPrivilege	2984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2984	ReFsDedupSvc.exe
Token: 33	5740	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5740	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5740	SearchIndexer.exe
Token: SeDebugPrivilege	4928	elevation_service.exe
Token: SeDebugPrivilege	1264	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2912	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 2912	4236	2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe	93
PID 5740 wrote to memory of 4944	5740	SearchIndexer.exe	103
PID 5740 wrote to memory of 4696	5740	SearchIndexer.exe	104
PID 5740 wrote to memory of 3324	5740	SearchIndexer.exe	105
PID 5740 wrote to memory of 2936	5740	SearchIndexer.exe	106
PID 2912 wrote to memory of 756	2912	AdobeARM.exe	109
PID 5740 wrote to memory of 3032	5740	SearchIndexer.exe	111
PID 5740 wrote to memory of 5144	5740	SearchIndexer.exe	112
PID 5740 wrote to memory of 2364	5740	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_4696c2aa55d03284e1f4ed8d5b35db5c_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1264

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5460

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5960

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5336

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1128

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5856

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2384

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3384

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2752 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2752 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 c73c28a3159fb02f6aebe050a4cf5f9ecff33baacf50835b5d282851c5c43351
MD5 ad498a9661658b125302d06e23fab4d8
SHA1 448dea29c229e1bed67204e4056db6bf1cd23a4e
SHA512 3ca30e1e943044f0ae444d4576ef5bb2e7dcb6aa1a064cbb4a3d6765d2aaee39a94562b3f97e90de6104942aec42f046e461a3eaa3e7be41655b1c36e9c2dc9f
SSDEEP 98304:ZrbT5whEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTJtPiqk9+:hQnfW/JLGMcblLheTjaT9+
TLSH
T1C6A6BF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 0d81c4a10cad1671c26b3801425e9fd14b71561974469fb839356ee4d00398be
MD5 3c50247053d2350526432720ece59ddb
SHA1 a289e85cf6cc9ff591e35917558b39efd4195dac
SHA512 59a8f0a467038e315432c2bf54d6dd6a0f9b20532c920c9a699da3b253dffe5fa20df5a5c67150284de722a1166b620f69e2094ee60916940d2a10eafd8898b5
SSDEEP 49152:3TfiUEWo6zuEz439S99akTBc4O8b8ITDnlT4NvJSv1PiqMymJ/+hE:3TfiG/nzl902tPiqk9+
TLSH
T1B5E5E52662C8C1EBE5642170CC69BBF900546D78DBA2CDD7BD447E06BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.2MB
SHA256 4c80b1ee19c13cea21ae4f747c622b454b9b35bcca11297578667787434070d3
MD5 2b07fa010fdc84828b8f4a01aa55445a
SHA1 92f2de046aba5f8fbdc2d7f8ee110423ea067851
SHA512 abb8bd32b7b632f384b89062ffe23c2349a260c05a174b3f38ecd6fc7d3bdd4d0180eda3cd4d609e5210646c96399081997561208acfa8a7e94416ba73a16681
SSDEEP 12288:sFQkrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:iQdBMvjRA+iqMIjmJ8c+hE
TLSH
T1E2552327259A4F53ED211A381CAA5BB6C1ADE838FF1163437706329F4A7C1D12C7A61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.3MB
SHA256 b088043a147993350340800311aed15c8c7e9c6ed0985e2dd4e11b9d256d8a4b
MD5 ed808053fca077d1f7401db690d25079
SHA1 80a13f001ec6665835e3b0f9cca5b756f19b10b5
SHA512 7173c009e21eb8cd432d6468b27ab9d5f55759fdbeb43ae72075f4af6df999e1a762d26e6877a2784332465a629343edccb7710324736666ea40ce98ab78d010
SSDEEP 12288:95A0rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:9SBMvjRA+iqMIjmJ8c+hE
TLSH
T18655123170C54AB2EA7202354D6B6B9BC00CF9385B2191D3F3985B7F9A381D35EB7962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 035147b9ba949cdb955c45be2c1f6a789d0a66981ad305c2ca23007be7edf5cc
MD5 38393a367fd5e3cb024c0ed9b8a74b65
SHA1 ad3b9101d57b8887d6c864a97a0880a9d45a5cc3
SHA512 1940bff458ae9bd30ee5fa46adab54d6f97f6e2196be913fea583cb74d3e20e49498fb0f6002537210d4c0a5e3e5c7a10d44a856c7f53b517a958529547a3f94
SSDEEP 12288:26dVWnxlMnn7nFKbltn+Ch/m6XQrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fuc/:F/TAbD+OmepBMvjRA+iqMIjmJ8c+hE
TLSH
T11575E11037D0C135F1B329368ABFD724956DB8715F6882CFE388166E5E706E0AA35B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d9642a12f30bd9d50e3cf99fb63ee969ecd5ac8a7afd36573c78cf5ddbaa77df
MD5 9bb2889f8a8b84ee891d82329779c0e2
SHA1 8801e1fff22dd7efe490976a3ddc4aed3c5a9667
SHA512 231b054ddd54417b37a23af791ffee0e1785ceb4cd15277ad08ef03f87e2356a380505d5b5a081002c5ade25d92d4e56e86d4198c938acf937d47a22c5ad1007
SSDEEP 49152:0b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnjv1PiqMymJ/+hE:u3q6mjBGtPiqk9+
TLSH
T175D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 97a6c48ba20184062e73f02de786cde147ab5facbd845489d2c8357cdd11fa31
MD5 88bca128196972cf7130cc40d3e96ed9
SHA1 0769dc9a3c4a7625e71c6a4ea0d3bf463055874b
SHA512 44668edc3dbcff700f6bdb49b1f03b1cdcb610615a3da1cc236e139975254937c5680b149e90709fc88e228e1f549fc8f58235a7429b844e753a04b498bdcced
SSDEEP 12288:m1XLsswWkxy2lRq2czAWrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzIT:EXYfDtczAPBMvjRA+iqMIjmJ8c+hE
TLSH
T1BF65013863E409F9ED67823CCCA28512E773B8554760E78B03A4996A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 b12458e52cfbf020e4df5cf2be4eb734d01348fa0c23f660ab371c62e3ec73e6
MD5 d83db2de4fd21ffdd231b89891b601e3
SHA1 17e042120f9c41017f0b2df211d69100c0588114
SHA512 2c4af4d4ef906d2ccbea40f0e7958eaf5dd638655bf27d63176ac58fa504266ccc7212a64936dccc169c858b0fd3483d3ffa3d173522e8263755c14248e9b18c
SSDEEP 24576:30Le5ji0hmxhrMOBMvjRA+iqMIjmJ8c+hE:3Pji0AzGv1PiqMymJ/+hE
TLSH
T1CF85AE26F5748331D073C0B9C5D2A69AE97130865B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b2e3c16bd5e8b3c51958145ccd2938d88a5e1f65817efeae9d933827ad9fdf17
MD5 05d4bf81e284db1de577c7f013ba5110
SHA1 2391604507db4b15df86656c0431b5a2757415cb
SHA512 c4b0405ed78a79a1de5e84cc465f3b18f0360a4da303878d75e8f5a8b617e8095975a7bb3117c42143b91ccd4dcfab1a73802442b5a144f21a9b0d1c003a7a0b
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWj6q8wyusBMvjRA+iqMIjmJ8c+hE:t/ezSC6vUzPv+Hjyyv1PiqMymJ/+hE
TLSH
T13F755D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2c04e7627edb7fbe4e0314ea6844e2ad540b9bb08afad32c6b53d77c1cf87b20
MD5 d6ddcf6fb422480001fb9c967ca87e75
SHA1 b18d92edd981f5c99ffd74f495548486ffa8564d
SHA512 f5bad8bed7999ab488f5b3ddaa49dd9367f9ce502406bfee1f9792c43336a201b94d021f2f4fde6a7c5c9acc879f58dc7f0199863434bfe8121b8c9caf34e1fc
SSDEEP 24576:OVbqPb88hv/l+BdBMvjRA+iqMIjmJ8c+hE:OVO88hXl+mv1PiqMymJ/+hE
TLSH
T160559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e67764365e3a6ea9fdb98124941352d5bacae5f8c0e34e72a7cb8a91ef6b769c
MD5 014f1448c069a795e3a7699c83d6e093
SHA1 bac326aa0c15d22bedaf6d86d80337f3a5016b4d
SHA512 f9a0e9776065ff2886785593cf5d2f5dbb1e8c89cb0b67ae88e3059a045c012902473aa35ca7258f196f66c2ae28fb798a8d65cd60878c378e8d1d62c2f835ce
SSDEEP 12288:JGDrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:JGSBMvjRA+iqMIjmJ8c+hE
TLSH
T1B345233A00680A95FF733F3C6DEB57A3C281EC7DB550A203B51676DB563C1E4A88A607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 531afb093b55a65bea072633d5150f1713ef7721b12da818530eb4616155901e
MD5 0c2ca5f691552bee763ed34a7acd702d
SHA1 bc986aa057510a910af9fd7e27002acd4526412c
SHA512 895ac41387f9e59faeb665ebcba299cf2f094a14ea7b3860e3d20630338c8fc5e7759687b2af76a12cd9259962c7956e2ec60f0011f5ab2537e9dc0f4c11d9ab
SSDEEP 12288:HeBNUbTVO86UsrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:HJIU1BMvjRA+iqMIjmJ8c+hE
TLSH
T10965DF3BAE28FCD2C67A5D785A918700D77278304F62A3CBE165834EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e7c498241166fb48ff7e4944c7a4e1f05e22231c9e5e1ac4e9254450512fea63
MD5 8760569bd507d4cc06e4d3f193dc7dd0
SHA1 88771d91ca8cdf4aeb7ce0e264a9e02b76a4181e
SHA512 45244d2cfc277db1aecdb9281ecbcc7e97cf80c3580341548c0842f58931722c94bc1a8805b2520a41ebd2f1d500513c12d1e9a348a084af10930e6d8d0b13ee
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THj:FQvGAdlCEL8c/WRNw5CLtPiqk9+
TLSH
T17B266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 451ac34436805826ec96fb20cc1769a95633e26631fc5825e0411d21da2c8394
MD5 3354200b689356bbce2bca3c25ce8587
SHA1 4b66f7db73b24dc60af501565eaa63d81409036d
SHA512 647056f316547af428c9688b6af51fd9168fb440d37e38026148000731c42addb4f089b55cb604682abeb6aca3d773407ae6a08352b4314525d5b373fe96d55d
SSDEEP 12288:rAwSfxL/2Dc3mDLLmt0LDQewsAjyrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2FuQ:UfewsAjLBMvjRA+iqMIjmJ8c+hE
TLSH
T11775F031FA74D432C7BB0DB61B36C716542CB9204B612AC3F3A89E9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 aee198b4ce3f20db30dfb7f528b33882cabaac45d23dd6ddf123c7e8b33321bc
MD5 d96213f0e5b8d3f7a8ba4c99a33af110
SHA1 0d112a1c40d305e9e919dac8cc671f8fb378922b
SHA512 875bca12401ea9f11e3601f9139006c867a5783e1b46b956d9060f44fda7906f12972367babe7ac26d53500f67db57e4006ae8d3e66b75764f1fd546fcd64bdb
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHOaT9+:9UEtQevvqc2W1cpV20I32OaM
TLSH
T1FC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0bd30a6d413a27c28de99f7dc540b6129e2d6e3b118322750c9974fbd27d393e
MD5 277cdb2697419ddcc7c69b816114949d
SHA1 231f32cb1c842bf057744c60d8ca049148d5b797
SHA512 1b0a8374d8db614ba01182528e873e5dafdff7359de9329cbc41e10788605468b8f9d894500f3f7dd5514006fbce6c38c54ca749c4d299c6d40aa17b2044ac4c
SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/z2v1PiqMymJ/+hE:UoqtVjnmHtPiqk9+
TLSH
T1E0D58E1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9c2b72355b4b016556b12687acc6cd17c06c04e8bdd84eec1cb825f5eb02bd4b
MD5 23b7168ff30eff02b9e881c1fc87c783
SHA1 6354be35c1e8855114875976846bb8d6de59ca6a
SHA512 5b9435610b5d90725db5a0ed5248defe8a9cb9be3f10a5649bd2c293c70bec0f71ea1bcd50754630bff1c58a9287ff86960cb23cbafd0d321569760f0b43337c
SSDEEP 24576:GAhGL6IFoiwtA5l7S53IBMvjRA+iqMIjmJ8c+hE:GAM5Foiq5Xv1PiqMymJ/+hE
TLSH
T17D35AD81E7F945D4F5B3AA7899B68171EA76BCAA5E31C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 aeb94504630e37faecd52b73a2075ecc1fd782d7fdb43fd975ff1d63aac37740
MD5 6f889778934cc68a5fa07228026ce62a
SHA1 809effaaac86304cda747e17c6656f90bdd61ecb
SHA512 8464da3c5321bd8b4b6d4770e2559ee40c5e072b3181826bf7f00a8fec3a34321627d52eabe107ed54e78190d1f417cf9d8122f0f5e5facc5d2679824c694897
SSDEEP 12288:Xmw5HEjsChNEBFgl0WDm+CvrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:2wuROWBBMvjRA+iqMIjmJ8c+hE
TLSH
T1EF65F15A32A80CF9E96356388597C232E7F2BC163A21D71F1760C65B5F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 245eae167c5bb3d8b1467fd7f90199bf87be3c9d02a714590d97c2939b9fea73
MD5 917996010e89d76830c2e392cd718ae5
SHA1 c94f0976d1b31216ca4318d39d18047f72709628
SHA512 1220bea31c5706913bad6859f4ca30b63a8505cd8876571ea17291691fe30d9c3281d7ba39c5d6366a7ad51c34fcb47b441952ea9a57816de646162382bbce39
SSDEEP 12288:myZ1IyCrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:fZumBMvjRA+iqMIjmJ8c+hE
TLSH
T1E255122A22E811F9E673173CDDE64742D362B866733183CF262552AB1F37AD11D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bed1ad624ad33cccfcaff549ace4fbd2cef659f992b907f8034f4da2f56d52d4
MD5 b5dc373cb37c17be4fa4379ef06889a7
SHA1 c0edc672bcdf177bd64804a88d65635565c000e0
SHA512 1d6206111a2fcb424411988161e055065c4ad6ee7b9ba6a9dd138de1cd00ddab5bbe4b3a3a1dfef6dce4f501ed8c90135fb99247a88286c09ed1916465462570
SSDEEP 98304:8QRQyi36YOcPDLvw2gAf+PN3ktPiqk9+:jQyiKanX+PNQaT9+
TLSH
T160667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a23d7c3fa36f2ebcb972177e3ac3f6712a25640db03577c40e7b11334ce3c0c4
MD5 5d69a555af55a1c32b56339ed69d5e34
SHA1 860e147685daeb3c47b47a643c234713dae94974
SHA512 0d82c938b865a366ff37da16ba296162c052808e64a20cfafd78d42b765d55ef9393771a95e1845112ed3baea6270977239316b6fd1d771919393982ce24d2db
SSDEEP 98304:/QRQyi36YOcPDLvw2gAf+PN3ktPiqk9+:OQyiKanX+PNQaT9+
TLSH
T12E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e859aa2f68bb0b29d565f481c9c150bb80dfb1a3fc9634e95cc47d10f57dde0e
MD5 d948cba5a4a893fe355bdadd9e1c5224
SHA1 141c8ced236956c206f1f55b997a002e7667beea
SHA512 36947ec27cfd59faf0b4c159e679ec47bdc3a33d81333e952fb76fe92b923a8c007eec8e5ea5cd3a707268fb943acff592fffe309edb27f1b3c5d539c1bb0c4d
SSDEEP 49152:r68Qg55nhkeWu7PNU3/Gv1PiqMymJ/+hE:1thTRc/GtPiqk9+
TLSH
T171B54A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f440f3c90bfcc29e4c4793c7939a471f126b1d6272165cbdf0d69d94256732ab
MD5 34f778f24ab2ed31078bc9a2756bc921
SHA1 90ab1530cf2f69d25cb1d88b187f98fd9fb79e32
SHA512 9f01bc85f1d32114e8981ba946f0cceca3580eb800923e557fc482a61ffcaf40797b529d933f4fdca4b12127902cf6148d89eb346c6afb54fb75dfbf770f7be0
SSDEEP 98304:Yy5112gYy5azzVvU69nLKnhZZtPiqk9+:xLIHRWhFaT9+
TLSH
T185167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a593fc959d474275bc8d122ed6408cd6e5978bbc36bfa3820346135e703678a2
MD5 abd9d02a71dec28ac4509a04ccc973d1
SHA1 7bb34629cbe3967ae84439d844e1767a1441a202
SHA512 c4b11667b92a78f858b875e72b7dbc7a21e5ec5e119de5fe8733ce312833bd7f79038cdaa966a8d527f9f9bc11d189a334ddd45fa57a6f075afa88f9b39d41f1
SSDEEP 49152:NB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl6v1PiqMymJ/+hE:Tu6JmIxd2d6tPiqk9+
TLSH
T116D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 38705c514a9a2c8e9685a3a9bc87cc9074a26685b7353b88c6823552d9ca9a7f
MD5 5935531742c38480ed1720f18b085432
SHA1 de79248ccf10882a287588c3d7ecad298f734575
SHA512 6ea92e8fbe9b0cf0fb7853e568a35adea313092a68785ce9e19e1bd08a422bb493b2c3c09f415c85aa222a74e0ad0298e5214eb105a50ddecc2ad34b0a748e51
SSDEEP 49152:k1hpsNoJpF1A67U44CwH7R4xYv1PiqMymJ/+hE:kmifPqRHtPiqk9+
TLSH
T173B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 762f7485027122e66694ad4bf79418842fc3db348aea16dc5fb8841d560dce27
MD5 83e2867bd607b8049757af92fdb388df
SHA1 a1ef5cd8aa58d0cb4d2da449fc55db582a766350
SHA512 ac1e0719e0f179b4d9c62e1ef04f8b78e34cdad4cf2208c4db135d03e27920e9afb9a60648d727451c9547187f55bb17b36a3885988aaf4d34f28bdab4d149e7
SSDEEP 49152:JSuZQIY0Be2KkRVtOnks6NMHqdv1PiqMymJ/+hE:H5dKqi61dtPiqk9+
TLSH
T103C5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5155fb44b0448aadba8e89289b4247ee2f3560b8360fc2032b4536e059261819
MD5 69671c921d5ba25ee6990f89fb854847
SHA1 f6136ecfb440b0615d4f9ca5c3ee74386bfaab26
SHA512 547442d524d50417102b9e6a2c6902843d0a4010a5fc1324f22345acafccfb93baaeda7ccc78da66f991217ed614caea462a04c27e587a9d85f10563a92759fa
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5w8v1PiqMymJ/+hE:FX2iWphDtPiqk9+
TLSH
T1E895BE13F2D901E8D06AD178C7468632EA62BC160B35B6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b7da473cde4e57dd6fa9e352bff5ea7762e8f059de1b796c8fc79580c7989868
MD5 5767d685c4ecf9166b8ff1a3fd10f019
SHA1 7fcf8bba78cd25cac6e3ae51ac8fec257444356a
SHA512 1236df59d0406eb44ca0714c63a4cc9cf0132563860d30712350271709568acb405f1c8516282853176239bbc1881f93b29d30fea55fb60af507807df6111404
SSDEEP 12288:ELrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:EqBMvjRA+iqMIjmJ8c+hE
TLSH
T16D45233A00AD0F86FF323B3899D75393C284AC7EF651A207761A719B573D1E4288DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 de85cdc45190f321f666f9aa30a9a7277a00866959007ad8043c71f99c9cb490
MD5 0638b360bd9a69c1c183cb5b6151ed5d
SHA1 00dbe5636806359676780dde2e50e43dcc9bbfaf
SHA512 fcda29e2ff7fa17f9f76f55c4dde38f33eaa68d89d8c42d28aa058a41d821f330e4dab85a62946ff9e2894359ade60e10c71cf98f4bfa6e7203a627a7bbe4c6e
SSDEEP 12288:n2rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:nvBMvjRA+iqMIjmJ8c+hE
TLSH
T18545233A00A90F86FF323B3C99D75392C284EC7EF651A207761E719B573D1E4284EA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b767c068245118e650f4239b90a74f5847ff8c074da15ad4439d67ab3044346c
MD5 e3c899b0934a0a80503a20b742098495
SHA1 802bc528f33889ab9e1547d04a83c0d250f1614f
SHA512 bfb7c9815e695a05bde292726ca7b05569f65cef8c384b0495b80ac31bbba0fde76a3cfb59e2445cdadcafe6c4804f3d079ab980990049230dd161ef4ac0a0b5
SSDEEP 12288:MUrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:MNBMvjRA+iqMIjmJ8c+hE
TLSH
T18B45233A00AD0F86FE223B3C99D753A2C284EC7EF651A207B61E719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d7df9bf15075effbd403183326c17b84d94d72a6ca169a4e9d1d27bb7e32a924
MD5 5d72911f1ce6cca2583eea57f51cb7ee
SHA1 b808df01564c5a4707efe6d81e21bf1769923ad8
SHA512 faa082b4b6a52ec80cd7430aaf7d8bbfa2d8b881e57592aca20f926ef3a6dc365d20ea0fa3f111b88555761312e3d83ddcc4daa67281ee63ea9cc64f3e190c23
SSDEEP 12288:5VxrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:0BMvjRA+iqMIjmJ8c+hE
TLSH
T15545233611AD06C5FD32AB3CC9A75352C395FCADF732A30FB605259B0B392E42869B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ac491cfc2d6f3484b8b4e7d1f3f2cab6a9b55236d6918c6878fa00477102a69a
MD5 f738e5cdf37252fe6d18d6171eaeaad8
SHA1 fac238e08349dcbb3e4224004d67b2f99f305ddb
SHA512 22611d4641a8dbe80610f5a8960390ae83feeaa3d4527b1e660b89a47336ff2c7d9b17de587e82df7536f0f82b75ea83998dd717d38362d88d7938efa8b3321c
SSDEEP 12288:4JrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:4wBMvjRA+iqMIjmJ8c+hE
TLSH
T1DA45233A00AD0B86FF323B3C99D753A2C284AC7EF651A207761E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1f26f59de0c7b753561e2b39b298221659f971c927ac18ebb925fc4663912fdc
MD5 a04c26fb7a8f199774c156bfeaac0d87
SHA1 1bf67706f1fdb2f4366b0a40d555081b25491cc2
SHA512 6bd100c20240256e1ae398d7c6af418f987ac8b80ebb4936aab8d17233c2dae3c65a5b9d1da1420936e3ef1d1cfe276244cc9e21570e849d3f5db5f08471be44
SSDEEP 12288:harGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:hDBMvjRA+iqMIjmJ8c+hE
TLSH
T1EB45233A00AD0F86FF323B389DD753A2C244EC7EF651A207761A719B573D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 dff3d66f17e3e1a54a6fb49d0c11fd14290b2a56267536a65c95f86295917173
MD5 f383aeb7fe8d813a6ecdfac51a323863
SHA1 fdd7df59e77312be93e9b2ece968f535276491f3
SHA512 10ff65f700a3acb799b88b4521107353abf3c290a090768074c2d5762b0fed7a3d080cef788e8c385425298143b0ec078484199b695bd7fe918cbdb12938b304
SSDEEP 12288:COrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:CXBMvjRA+iqMIjmJ8c+hE
TLSH
T1AA45233A00A90F86FF322B3C9DD657A2C284EC7EF651A207761E719B533D1E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9ec29aca4966de05aa4de5b7b1d81c7da8fa4bbfbe2fef918348b6a6ff1c511d
MD5 cacfd81475c9474cacac728d2fa1beb7
SHA1 ea32886fd360a690d44e08192f7eaa9a61155f50
SHA512 049e10fbb1448adedb2a876a848434b4e3ee0c11e25eee77ebec4d6c1ba13651cbf5eaa7eb43b3f5fdbf0d5750d13ee7cc68812f52de34a13e6292ebb2d7a491
SSDEEP 12288:YiZwbDzzFEoS2cPvyWrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8ti:bZM3zFVSOPBMvjRA+iqMIjmJ8c+hE
TLSH
T16465016573900CF8ED63423ECD558A16D2B2BC6A5770C60F13A8366B5F373A11C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 dbf9b3ae5ed7679f028c4175e828ca0649885d19c0aef8140c270083aa565ae0
MD5 505665ab851fd1f740e92a2890684b32
SHA1 a330ccdd71a5e8207bcfdbd65726ff13a55a9bd9
SHA512 3fea3a5e5baa53d82ade27013fa1a061ab5bd717563ad812742483b542ce8c6e0be7b9b1aaf320e6b1b7007d361853efd65261a1b34946086058d7f7a2327647
SSDEEP 12288:EHrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:E2BMvjRA+iqMIjmJ8c+hE
TLSH
T15F45233A00A90F86FF322B3C99D757A2C284EC7EF651A203B61F719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8b32882cd2107fdf83db32f12c6868429d4dd6aaf8a1c193d0131a8f55ec4e86
MD5 d9ad47a5608f6c4da5e6875f41b750dc
SHA1 d3aafc513b101f00b1cfddc33d9ebc06353bf735
SHA512 57095bacba6c37fbae19b0fb1a310a674817609cc1de51075bd71613190fd2aff251bced6accb1d361a4ad0e5c079782483e0de70ef99d3a20d811ed8908abb3
SSDEEP 12288:5TrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:5iBMvjRA+iqMIjmJ8c+hE
TLSH
T19245233A00A90F86FF323B3C99D757A2C244EC7EF652A203761E719B573D1E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9bb87a766f00805a6bd6a598074abcf78b17d81af8f395d05b14f4733ab186f6
MD5 b0585b076f50b8a1196e6905bf814b97
SHA1 354ce15e31f2a786e5eec5c48789ee9cbba01008
SHA512 100425c54c5c9f5ffeb89162a9e9e03a412706f6d23877390120339ce629dde51dc6e61a684b8db771cc9a77fbfe47f7a56d20bc4b3949f9d88c81d2c4dc2a78
SSDEEP 12288:syPz5L8CrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:1zybBMvjRA+iqMIjmJ8c+hE
TLSH
T1BF55021722A521F9E5335238CCA21B52F372B83657209A5F276417BB2F372E05D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 cf2bad147bb8990a4bbb2983cd5f078c6e5293f030831d57e74a085b19c19bf3
MD5 a6d36c5d43774d26e231e557a18251b8
SHA1 fe508ba9b11ac2ec4a26a67927a42b8cd4368462
SHA512 645cd76b45dacd63c221ea84b620f82f0199a053b5d5a2064ae8e3630f44ab3794c2f74cc8ff17b3cacbf2c3cede1adf8070ebf870b589aa3c7feefd0dcb9f73
SSDEEP 12288:HHrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:H2BMvjRA+iqMIjmJ8c+hE
TLSH
T13E45233A00A90F86FF322B3C99D757A2C284EC7EF651A203B61F719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 29f52e79fca55b2443cec14422a7caae0480df2ebc247719fe736b135df907a2
MD5 0cd1729a512ff2344dbaec6d6f010838
SHA1 85f3da552ce36e1e43a023d0194e9539c06279d7
SHA512 5c905b7e35e7fe558211589cbd2da9eef4a3d51143ae4b19e3e020407f55f6b378b7588ddeaac5d276031cc117cbca2c3c34b7b6791680ce11de9a457dabfbe8
SSDEEP 12288:lHrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:l2BMvjRA+iqMIjmJ8c+hE
TLSH
T1F345233A00A90F86FF322B3C99D757A2C284EC7EF651A203B61F719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a8aa3b0e6c8e8c4ddab8e67d372c4cdb1bfaecdc6042f7bba196ddcdf180285d
MD5 adf3a1a56d47d086f172bdd534b89d80
SHA1 212533e70cc1cba2894fabe8c1fa19e77813a7f2
SHA512 d4d1c6ec90e6e7e64086f4a0d55971b92a04e75e6a6b6f692f178fa8cda2a2bd6982f9f6440f30121e7a954f5fad6910bf94cf75881d3568a1450856aef18532
SSDEEP 12288:eyPz5L8CrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:DzybBMvjRA+iqMIjmJ8c+hE
TLSH
T1FB55021722A521F9E5335238CCA21B52F372B83657209A5F276417BB2F372E05D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 1115b1be866488d16c812c5523dfdf607dea26d2de71de46015ec49188109d2c
MD5 ed5bde50f2077e636d68c2a312302015
SHA1 884b55a0c37d05c6cbc226cb6a9154c6a24c118b
SHA512 4cd059aac2a14663009c236d164b4b73ce5274cc7e81f3e6fc4e22316934b9118a5f0bf9bb75ade52d9c3174b34dc0e01c838399d543c6a024ab8375690f6da0
SSDEEP 12288:qCd91WYoaLHF3z0z04PDvhErGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:bT8aLl3z0zD9BMvjRA+iqMIjmJ8c+hE
TLSH
T1CE65026573900CF8ED63423ECD568A16D2B2BC6A1770C61F13A8366B5F373A11C2EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 538314fe7deec97142bab6ffa7db221f7de972dfb212fc9545ae31c2cd40b158
MD5 11c4c07d8365d6ee5a1e0e4373909199
SHA1 9f7fbdd9e0c2003e32626e6a7388362b9fec5b6f
SHA512 2e80b93fd0901cc32ffcbf85b5ddeb262e4f0c4ca7c5512728addc73391183768cb02618364b29499165fa57bba636501a790bc14fc0d5cb4b029b86e7b6dcea
SSDEEP 24576:lfwvzk9RX6wkyAIyBMvjRA+iqMIjmJ8c+hE:cMnYI5v1PiqMymJ/+hE
TLSH
T1F885CF29EBDC04E5E177923C99B7460AF2B178691B31C2CF125A53AE0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f6514f83b64fe2ca932e4ec5f35d60942b152f68b03a54bf97c823484cb5a5bb
MD5 bcebe919a1e37cc13ceb97a382744a9c
SHA1 4a27337dab37a0d0bcf923252c02856cfb2415fa
SHA512 d896e9e15bae2b4f5eb2dc5055dd2dd08471e3db1ae0f54f04b0bfcd04183beca7d9444f77a3938a64ee125f18732d129f0b5b5a9169ff574971eb435d9ab616
SSDEEP 49152:VYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cv1PiqMymJ/+q:EySzPEtPiqk9+
TLSH
T1BA066C56A1A801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f2b442f0f98a3036f8360c5e9db56fa8e1c074dd851828cc9d8378efaf1c4a7d
MD5 8bad311fec2e210ebe6ff7200c4be217
SHA1 9dbf92f1722e7868641a3ae99a89d4fd22f3eb4e
SHA512 0b359a242a403d338a26942751ee1a4d5780cd97299ca981b291e1c5c04390a29406dceb1c3d651f0254bcca0565cfc338f2dbe5cf06dfe7d3b6e05d476c5423
SSDEEP 24576:w47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYfBMvjRA+iqMIjmJ8c+hE:w47JUQjqirIhCnDHUPfF/sv1PiqMymJJ
TLSH
T1F965AE1EA3EC01E5E1BA927885154A5AEA71742E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a631acb16fc19bcba0c45496ea76f291587369d239a801c993ec8f2eae9ff8e0
MD5 f0df58abd2b71d8515dd7449a133e656
SHA1 b0367ff64a2157eab32d31fbb7f14727fb4b4778
SHA512 4ffbdd1ae7154ea61c4e46253d95df303c5ed22a86a08ee7b2cb8314c8411d3a01d1379b37559393b2781e77ff18872fb04833aa613ac0ad9319be2b0e8a814a
SSDEEP 12288:Vpsf3rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:2mBMvjRA+iqMIjmJ8c+hE
TLSH
T1FC55F11AC29802D8D56E6239CB964641F3637C2993E1D3CB62D0F57E1F3A6D05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 35d8ae9c9c9d5f5f58443eaaa2ce310f1b9c968ee5db6d131206596c5027b9f8
MD5 b9f649221b693b6380e5f0435c9219c7
SHA1 f187b74082135073065c867695375e9d19a5a6aa
SHA512 4d150c00e87889daadc67368bb142c6c083660cf2f6dd3b4bbaa80e9cbb9febb8497c8928d5f7f1d43e8d22fd1850d12472662cfd9129e3c8a547ba68b052223
SSDEEP 12288:N0qcU3fNsxF3RptMQSeX0bx3YCaLPXkHZO:N0PUPNKBtsP9FaTUHZO
TLSH
T1B0251750766AD75FC6AD40325E72D1CCAB707D01FE05AB0372C8872FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b7f5b835af895d3c2f2552bb71faf00f9f1a4b1ac746a080bad83b71c70d0b25
MD5 4cdaefe6cd372dce9317e9c13ac2ffbd
SHA1 84cab27bdd2938eec66fe45ca7623a002049b387
SHA512 493af696595742cd8e96e60286360a42af4205c5e1e9cce02636edb74f70fb79d94b06e7746227b1728e7e569ea64f542449e39ab94ea79c95a8213f5738df4a
SSDEEP 6144:hpF0qAK9jp2qACAmI415hblzut2sRcCtDAcbVtMxCwF5p1YhSFNc59fgcbVtMxdb:iH29VDWC1l7icOgc59fmVDWvt/q
TLSH
T1B765F9415437A3CFD1FB6032072A9B4DAB64EC47B3055F26B3C4093AD86BA65A1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 178B
SHA256 d7901cd5dd8feb0561de7ecfbcf8a747dde8533e1e315a49a52eb78c6e276653
MD5 f9609d2ee47f5e6c17490408692e5760
SHA1 a5e7d86d60b1ebda20407b4b04e4b5e9b1c4fc44
SHA512 91b69ecca06090a2340413a0291d519d7a053ccd76035468642ff72ccc7f1e62fed4c62d4e36e7b8b2fca657ae45a61064366cfbe6d6e54bb91cb74a07082ba2
TLSH
T123C01205156E60551F37104DA5013F50108271209B41D972A2242A4B76A24110817C1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp8F36.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp8F36.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpAD30.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpAD30.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

242c8bf883806d8d.bin

Path C:\Users\Admin\AppData\Roaming\242c8bf883806d8d.bin
Size 12KB
SHA256 314204dc0e13dc378f8f98dc9b4ec4554608209bb2f08a8c46cff0854fea48a7
MD5 642fb1b1517bff64f493ce1a96683e23
SHA1 bca0efa628927ee02418de00e12b97a9c81e4be0
SHA512 9130c5054b4e847194c6b9f6a4b54d1225e31db9c8c7edfd68ff1123e179eae1fbedb5a4153600977467b1b2dd9c8a52f6a08fb511f33f6b8d0293c61c49844b
SSDEEP 384:mWoFfTkYfKXF/v0tWWK+mblUGEhuM9xzuY86m:/2wXRi1vGHF
TLSH
T14F42CF482662F134CFB17BB04212F4E10764C22F69278B934877E91A157EC3E82D8FA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c1376d1fce4f7817f2bf4a20598d54dd88c8968bcbf98b183c4f46f2ef86ba54
MD5 83a52097d6adce55f8bb898f4aa40821
SHA1 7293f6be99bc3a75b3454fa48f41e2b0ac4781b0
SHA512 8f8469e270617754d80779f9b6b3675eb52a70be13fb2cd96c81a9d7c5fc8f5fef8cb3ee993c6913f4645d29041084b0637fdca16bdd5df8b2cf1cb7b02a7f1e
SSDEEP 12288:IM7vrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:JuBMvjRA+iqMIjmJ8c+hE
TLSH
T11A45233601AC0E46FE323B38599B9332D249FD7DBB10E187B50A72DB563C5D46C69B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6f543c52295f6493e4c2d5fbc225fdd6d8f22d4b7dedfbc9b0074fb1aad184a0
MD5 9ef33bedfd1c479bd918de67c6ca9219
SHA1 3dab8d25c7d60ace49abf4e3afaee59c271a5725
SHA512 58a7ee3b9207092ccd6ce3601396c219c25ab8f38c8d09c8c8c073213f4fcb6afef5d5f4e43b252e3d206e70ed0889d48f60dd99ba187843e874c3d0bda9f435
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYsBMvjRA+iqMIjmJ8c+hE:Igb4mBIBhGFav1PiqMymJ/+hE
TLSH
T19F65AE1E22EC02F5E0F6E2B8DDAA4417D6B278161731D2CF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 573587aa5c5d3f43c3b1124ce1cdeadb133022daec61ccc6148a7d9f9c104982
MD5 83321b1a0a0172c95dd89f8ffa998a25
SHA1 7919da5b406d6f799542e36d2aac475b125eaf47
SHA512 3196ffe786460ddb6d7356c341a06176545c47e974d305523736be7950bd78ba34a3b8047f9dea8b892be0c0886a94229951ec86e20f09c4ad7ed0c60ff8eaf5
SSDEEP 24576:RG88u8FpJqH1vzria7/mPBMvjRA+iqMIjmJ8c+hE:07ZFPqVya7/zv1PiqMymJ/+hE
TLSH
T18885F12566E102F1D477D13889864663F6B2B8251360FBDF07AC8B561F23AE50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 403436965284a08cd4644be5ac462c29a745c426e8da13cdaa75c7d4513be99a
MD5 ce2a3e3ee4982bf4fc40820fff5ca353
SHA1 5b215b8a4ce5dd2654a0b3c5e244f5790912d866
SHA512 7d798202eaa691f022724ce1a44d6658e8195d484ca2420a46b4ea891d773872baa55c69c4f961a0ab24fb0c3bf85182e01809cc2fe452de2eea1e08df344606
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjev1PiqMymJ/+hE:UG05lO43bxtPiqk9+
TLSH
T1BFD5CF6E62EC01F9D1BBD17CDAC6460BEBB23825033556CB02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0169e4245e56ed0a0b18fd98b477e850861db2e5c542b80fa9e3937b8543427d
MD5 a93be9a267eb56724307bcaef02b7360
SHA1 5582d1be7f45d4c7efe7ad8a3260314de733d5a7
SHA512 183390bbd29ef99cde9641463580931a1c7b77e85c25a47f994041e7af13b97842189b4090cd1560a80eaa3286b5bb4c39a99a1aa690a3200bc50be1273beed6
SSDEEP 24576:wfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnJBMvjRA+iqMIjmJ8c+hE:Ia5POZ3lJt2pasx2+mGv1PiqMymJ/+hE
TLSH
T19665BF5EA2FC01D5E579D17CC583461AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8360a95f0cef20688650dde7a35cc7089fbe268d69622ba05294e6628de44a94
MD5 2c9d6413691ed2ae46bfc7fb8cf8a6d7
SHA1 5df9f69ee45bef26ba8b3b446f3e8a2693711f34
SHA512 f3887aee05986ddb5e142548005fc41d68d13cff61ff2cfb99f46512584405fd9937fadb3b225e9bfbf0238378bcd5e33c058aa62ea9375e9f40012b4a5806c6
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7FkHBMvjRA+iqMIjmJ8c+hE:bNc/zEOVHFTv1PiqMymJ/+hE
TLSH
T17D858C2622E901E4F5B7E1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 94068c77f2572a597b29417b81a12eee7020f89982302ef39d052575073d26d9
MD5 1b283f07d790ba7ce1a977523409d5d2
SHA1 667fd93350c14c5049b8866504cf3431065fddd0
SHA512 94a63566e95cdbc7574b9c65dee65cde09576da103eb0e30dc59fae152ed9b7b8b174d1de330fe75007eb1db04a9c10ee3ccfeb3b111de39f4b7f58604fd1e18
SSDEEP 24576:EzkNvNnaFeYhJNtmZBmDBMvjRA+iqMIjmJ8c+hE:EzMwBtOmev1PiqMymJ/+hE
TLSH
T11E55AF2EB6F806E4E1FAC6B4CD238512E6727461173293CB5290C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a50e669e3ef5162b2a8081c5da2a9b52ba0e2b5f6812540f0b2bb97fb44027f4
MD5 edcf085480b2be5135d261984b0057e0
SHA1 c320ca0501a8485cefcd0774aba409321574bb45
SHA512 3f43f097957adcd31aca598fa93f82e7e8cb97021921c933d4c0e84e65747a9e9c28d95238a8d24b64a77720f7a253eee027ecd6edd473819f352f653c1a4c0e
SSDEEP 12288:ZHvUrBFrEjwaQqrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:ZPUr+NQTBMvjRA+iqMIjmJ8c+hE
TLSH
T16965E12F21AC1CE5E676A17C89868719E771B8661712D2CF0291817F4F37AE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0214c56ca965a786672dd177c29f83cab86f74007590648afe616ffdc823a3a3
MD5 d6c2cae1e61339cf425b7dd5c41f9be8
SHA1 d9b153e2545a68a0069df365b07079f209c8706e
SHA512 ff4e90efb9acd90b20b01cb7708a2773079e7b61a3908e53b03b103f2e9d35d8c6b9edb808c541e7c5b26057cb4079a0554f28e8d67fe5a14b1528783827f4c0
SSDEEP 24576:sD3FHshBIYQgAKBMvjRA+iqMIjmJ8c+hE:sDVHeBIAABv1PiqMymJ/+hE
TLSH
T13275E13DE69C04E4E57BD17CDA638606E77178AD032266CB129491BA1F2BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-610-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/756-603-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/756-551-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/756-546-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/756-545-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/1128-167-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1128-168-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/1128-173-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/1128-397-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1264-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1264-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1264-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1264-231-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1264-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2384-400-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2384-205-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2384-211-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2384-202-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2984-398-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2984-601-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2984-178-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2984-177-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2984-184-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2984-602-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3384-216-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3384-222-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3384-215-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3384-229-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3384-225-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4236-8-0x0000000000C60000-0x0000000000CC7000-memory.dmp

Download

memory/4236-200-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/4236-0-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/4236-6-0x0000000000C60000-0x0000000000CC7000-memory.dmp

Download

memory/4236-1-0x0000000000C60000-0x0000000000CC7000-memory.dmp

Download

memory/4928-22-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4928-14-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4928-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4928-203-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5336-384-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5336-157-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5336-155-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5336-163-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5460-49-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5460-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5460-39-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5460-45-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5460-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5740-233-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5740-232-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5740-404-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5740-239-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5856-399-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5856-190-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5856-189-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5856-401-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5856-403-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5856-196-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5960-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5960-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5960-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5960-367-0x0000000140000000-0x000000014020E000-memory.dmp

Download