4690dd178babc653e87ef4098bf81f54359c144ab2050767c7ce2a5791177bf9

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.6MB
Sample260804-qmapks1gjb
SHA256 4690dd178babc653e87ef4098bf81f54359c144ab2050767c7ce2a5791177bf9
MD5 fdc0016d4037eea08cd5db0d241f7b6f
SHA1 1e8f79de846a5ae47fe35205996ba987d674015e
SHA512 0c71098d38c1c11449bc64cbde45172494eb523591a3f087ffe8e2238693e08393a8724333acb62645569fc8d7826c9cfdadeac78d3a45510c985edfa9dbd57f
SSDEEP 24576:OLv5qMr1nD//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:u5qM7LNiXicJFFRGNzj3
TLSH
T10675E01077D08036F5B324764A7E8669956DBD715F2181CFB3C02A2E9E70BD1EA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5180	elevation_service.exe
5548	elevation_service.exe
2480	maintenanceservice.exe
2080	OSE.EXE
4552	PerceptionSimulationService.exe
6120	perfhost.exe
5768	ReFsDedupSvc.exe
5852	SensorDataService.exe
688	ssh-agent.exe
5908	AgentService.exe
3624	SearchIndexer.exe
4584	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ba635019e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f62fe0511424dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038e2cf521424dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000825fb9521424dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068f0b1521424dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5644	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
5644	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
5644	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
5644	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
5644	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
5644	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
5644	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
5644	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
5644	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
5644	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5548	elevation_service.exe
5548	elevation_service.exe
5548	elevation_service.exe
5548	elevation_service.exe
5548	elevation_service.exe
5548	elevation_service.exe
5548	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5644	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	5180	elevation_service.exe
Token: SeBackupPrivilege	5768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5768	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5908	AgentService.exe
Token: 33	3624	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeDebugPrivilege	5180	elevation_service.exe
Token: SeDebugPrivilege	5548	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1664	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 1664	5644	2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe	93
PID 3624 wrote to memory of 2652	3624	SearchIndexer.exe	103
PID 3624 wrote to memory of 5792	3624	SearchIndexer.exe	104
PID 3624 wrote to memory of 6052	3624	SearchIndexer.exe	105
PID 3624 wrote to memory of 1832	3624	SearchIndexer.exe	106
PID 1664 wrote to memory of 4584	1664	AdobeARM.exe	108
PID 3624 wrote to memory of 4936	3624	SearchIndexer.exe	109
PID 3624 wrote to memory of 3216	3624	SearchIndexer.exe	110
PID 3624 wrote to memory of 5684	3624	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_fdc0016d4037eea08cd5db0d241f7b6f_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5548

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2480

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2080

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4552

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6120

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5768

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:688

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5908

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6052
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 227daf3eb61aa2ffdb59b910f3fa874bf049930595d6e67fe59a761419edff4b
MD5 3e5db7da6a0ab1af08e60c834c6774ba
SHA1 32a58c8d3bb0a48b1f59f641f6ae54e164e30a9c
SHA512 b9ce8891c63a1427b21c655b8c65f237ba49b7cfe3ae946ba81fefb6f28a9df44b507dad0b30e852210cff8e56d3892add6f191675df0813eae283c3b0574726
SSDEEP 49152:pTfiUEWo6zuEz439S99akTBc4O8b8ITDnlT4NvJtKkgNvvcWf:pTfiG/nzl90ckgNvvz
TLSH
T194E5E426A2C8C1EBE5642070CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.3MB
SHA256 ebe6530223a1543042d6f054cc08a632c8b99b82582a05faf18dfbb0630f7164
MD5 9c3bd46fcd9b9a268b593c1c1c39a383
SHA1 be222008284b2089168bd1b07ac7871124eb889b
SHA512 7fa20560595d5b61e0135dda6ece0e1f4ad07588bfd7ef49d4ec4ecbf84eca9133e60001df674e394abeb6e60da6b98a443d825caa8f520e62bc0b5477cc6c78
SSDEEP 12288:QFQYwKLogCkU2fSFUa8X26cr/1ueywnxa4W89BnTmNlE:+QXKkgCkU2TvcBc4BcE
TLSH
T1AC5523637F5ACF26D462C476089943BDB4F69824BF429ED79395276F8ABC0C0E43211E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 12d41f714e0671186ec725e319777bfc215b28d8019267025edf51c8d60281e5
MD5 a9c7d8aa76df8a616f4743c57c75070d
SHA1 7ebe4db192db7c5a2e06acb51dbd89bec74c970e
SHA512 42bc72e41a8d8ca136e3bef763e2abbffa22d968fc39c21e723a154525078b1a3ea7b7bd40b048a5bc125f2bebcfd9c0305cdd827aac93e21ef6348910f934d4
SSDEEP 12288:j6dVWnxlMnn7nFKbltn+Ch/m6X8wKLogCkU2fSFUa8X26cr/1ueywnxa4W89BnTP:e/TAbD+OmerKkgCkU2TvcBc4BcE
TLSH
T1E875E01037D0C139F1B369768ABF9328656D78B15F6885CFA3C8166E4EB06E0E93171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 71a84843dd4e935a3bf9f53d9d12475b95904d9701f485ba840af18a8bad5e86
MD5 35e5fb0a6d5d846bd416be71f7efeaf9
SHA1 4b8f3bad80b3354744e151e38986dbfd8e66d4a8
SHA512 b3d608fea57a09d2eaf75be83b6a3c31580326a6765e349914c3837f535d175787a023587c97687ebce03478950b80f9c407e4bcd5717fe53999b1bda8e6b0d7
SSDEEP 49152:xb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnULNiXicJFFRGNzj3:33q6mjBL7wRGpj3
TLSH
T1A5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 94d597dae591ee9740ccce4de6a70712c3eaa2b49b39616ca6f5b81079685d37
MD5 d98eff543a3b5623baa199cd11cfb537
SHA1 b2a4c4c924445052a1efc449120121507f9c36a8
SHA512 b2bfbaa299642bcc9f5ed3706f355504cb4d7147425eaf4fb64355f6c517008e5a33ba5cc467ebe8ba3c248c98ded0fc67ed38d9cf8e2985765af8ffe6026fae
SSDEEP 24576:hXYfDtczA//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ktc6LNiXicJFFRGNzj3
TLSH
T1D375012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0b549bd0bb8f059e29029d7e8867d63d8ef9a41216f5142a27b10a2c01a69e58
MD5 984f6e4bdba774815aa19cf331945cb1
SHA1 74850ccc0c393d8565ae18a565c66bb70db62725
SHA512 370805ee351f50392c2d6bf044ac495383df84d9a21f92ccf06541281233d0c3ba860a096879886976bc99fd27ec411e56fc5fc75517afc61d1f195a4571c6e9
SSDEEP 24576:30Le5ji0hmxhrMZm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3Pji0AzamLNiXicJFFRGNzj3
TLSH
T114859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 da68fad45849fdd51f7ab098504a54ad1035e53cb002fca46ee615f4a0f5e50d
MD5 a107d58937d3543c39e0be82ead61f13
SHA1 c6a2c16efe7a45a3836b7737eaccc246fc36ac17
SHA512 dc423b4a0812e71104772838af5977e2cf243e1e664170510622584591a39027e816dca5fb1dd6696707ce884126e051a29a0aa38613d7b6a2fdb14c410c29d7
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWj6q8wyufm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8/ezSC6vUzPv+HjyumLNiXicJFFRGNzb
TLSH
T1CD756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c9cca685bc4bf05d30cb73ded4701cd7a14cc44337b1c97c5ac2c186fbf2f3be
MD5 4ee3f7ff4cbbced0cee689e913fb318e
SHA1 507d205e5a1257c034f22950756fa5188df50660
SHA512 1bc4d869485bf2398bd548b57f9c4e750185293252cef586a3684adfc569c6532a4346ed7e1d6282f0061c5d246f3ed19337369f3e8de37dd63e8bfa268ce79b
SSDEEP 24576:qVbqPb88hv/l+B0m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qVO88hXl+6mLNiXicJFFRGNzj3
TLSH
T199559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9ea4338be297d0d2b67ad9f30ef3041b753bfee34b68e8371a747a0493dda465
MD5 cac3efc5dfe777177a71693649746e62
SHA1 0997c0212603af91eedc33f97e6c11202d358532
SHA512 b6eb02ce847aed8ea4dc2855492a8ca925a742d3d3676dfb4ffc23f74800542182bacba6931025a6194807da37c5adf2fc3272bf8427b862ac07220f7a30a908
SSDEEP 24576:nGVm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qmLNiXicJFFRGNzj3
TLSH
T1B25523D3468855B1FBFD003A867A5828B5845E2CCA595CE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 1f0e8955438fe118926ab85c67572106b349ceccf73dc7a35464d2733ca878fc
MD5 ae28ebc18e34ee5e4a46f128f5204aa7
SHA1 cbc325e57837f46ab162fdc328199d1d116091ef
SHA512 bab94c822b8a1c41578f58ecd24dffc0a261103eb7a680fd15c61401058565147d647b7c216218201329ff873ca82448a67ece0e61e50c0a811dd68b99ce12fb
SSDEEP 24576:EJIU8m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EJIU8mLNiXicJFFRGNzj3
TLSH
T12375CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ec69f48d221bf2bacfa432d8249df415c3e63cb2977cfe34d4f74159b2971dab
MD5 1aa3d0a348968823fadbfe1f0141557d
SHA1 4ee602815938fda08d65a1494c593cbfe72474ae
SHA512 ae52fc85c1cc14d4147f24ad54fead10bfca2ab7570e20b2fd217cba48ca1f1b8d9e68b8fdb5c45a8a63b366dcaff1d8386ec37e1947c952ff59ec675dd8081c
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THj:KQvGAdlCEL8c/WRNw5Cvm7wRGpj3
TLSH
T152266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 574fa9f3e586841343a92e9e0188a46428749621033a589207e2a6f82b9b1983
MD5 cd6e679faa05b718ca7dd7b7df778517
SHA1 3eea9c808ab7da0988cd5050b09b8e729e502b96
SHA512 abd949127d36363df673fe07e81f7a23e7a65cf26f9532da7c943b8b72d020c24871f6f2fa20bda0587418c5c1c7e5fe43dc84bcdc8eda5c478484bcae6b5e4a
SSDEEP 24576:AfewsAjqm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qljqmLNiXicJFFRGNzj3
TLSH
T1EE75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a3a40b3af9948fb45a026932c19173c67691886bfdbe3b1479d148b37e0da8bf
MD5 d09275f196d6a4bbf4b445196e563dd2
SHA1 1cd326c42e03198f896e4379152a7dca13b99c56
SHA512 dd9b9986c9b2120f289755189b323321932bc6b61efe66bd837471dfc3c0148459c893f3419a10c8f7a2a4d4dde864e353d68a66f27ca1b15b6564deef543105
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHCKF9:JUEtQevvqc2W1cpV20I32Cu9
TLSH
T12C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c02d02249e9d5adcc891e80e60665875cae258924f55559fd49547d9b1140ae8
MD5 f57e7860eecc217acb36f62b51a9e95a
SHA1 166ae23be12c6b4730554e29bb15f08284a928cf
SHA512 69b3974c3bf48a148f24cd488bd8426f2bd1c9149df9828906244077a70bdd4ecec80fd1b4463674f63b3029d85c3277899e21d1eb3856372ed118f9245a345d
SSDEEP 49152:uCbRquA/m2yL5zLfFiV+XenmE3/zKmLNiXicJFFRGNzj3:Doq2VjnmTm7wRGpj3
TLSH
T1F6D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4b87285d83818a311988b558fa6f6d4199be918e28ac14345f44ab55c298a9f0
MD5 6976eee3ee042b122c3260b4cbc1bcb5
SHA1 85ae69a5f1ac3a7ace8417a9471bc290a70242cf
SHA512 b923a25a0302d939e0f6af7168019d7d8e4a28c862bad4e3038df35ca7c1bf93630795bc07188e519a0ecfa6cc08aa3e95e77d0bbb6cb6748e1114af8da5f72b
SSDEEP 24576:LAhGL6IFoiwtA5l7S53zm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LAM5Foiq5jmLNiXicJFFRGNzj3
TLSH
T1CE359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0a80802615a79240f0e20cdb724cb12c9d7a8b49920fe2df129bfc16ccdc94f3
MD5 d62113e6aa71f559091b0b1e1d1d500a
SHA1 d299ef2339625e349df8a8343fcfa35d5655f91a
SHA512 22ecd7e851818e8acfe57da50025e988e5422f942003844e5aa3d6f1d7d4ead0126ae44ca9e60b8e8f5d9ba9fdefc204ba7f892e235991166dacd2ba67fd3785
SSDEEP 24576:/wuROWV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/wSOSLNiXicJFFRGNzj3
TLSH
T14665F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 df752f043b1a1699c71466c2e0616022cb0eb0bb384425d49fcea23514bdf066
MD5 b99025d5acd4e67baf77b2d37d93b311
SHA1 e43142f3a2e5ba36a507e550fa223c3508346f16
SHA512 dd7ca2e0fa623cde9842e236bf0a14dd97931c74ad9479b75d7b276095d56a25a01c71bdeb821c04f118302d00e885d0bad42ec8d60b56bc5dd76ea5e2eb955e
SSDEEP 24576:xZuBm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:smLNiXicJFFRGNzj3
TLSH
T1AC55129622C420F5E6BB413DC9F54504E7A17C2A673643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f5e8734a97a24b816456dc7ab120a963aa799323549b54e97e2d0d781e9d0211
MD5 5b86fcde9627a15e426e3b5c22e8614f
SHA1 f06697eff31336662d4803e6892cfd4fe7309710
SHA512 5e866ad91756de8787d97bc65a7cee0af7922fefee8ab0b369fcffbc67bba8c2bdf64294aac3eb2ebf46f5b1b1c8651b208b8e667a278f643fc221f430a69f96
SSDEEP 98304:nQRQyi36YOcPDLvw2gAf+PN3Am7wRGpj3:2QyiKanX+PNwKF9
TLSH
T18A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7d4bbf8965b41b66d24b11ce46fe60c586db66e68b1ab97b491104ecd9e6993c
MD5 36366fa4622aa8b3782b2f3579d76191
SHA1 db1678aabfc3fe34707a7a185bf3c46ab21aff96
SHA512 0e2dff7fabd47489efa8ed66f3ba188eefed9954dab5c05f779ac45d4e5c0085047766d240f36b3babf0f9cf6ccf3cd83efdd0a8e0da45f006209935339f4da9
SSDEEP 98304:hQRQyi36YOcPDLvw2gAf+PN3Am7wRGpj3:4QyiKanX+PNwKF9
TLSH
T1A7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0988a18cdee54db6e4c4ad760b99ae2f035f7d1d4a29da8811b64b09d9ab562a
MD5 8529cb3af7dfd8293d49abf9b2ebdbfa
SHA1 0385d17246c13c1632f8b6da8bf19d3fa9801ee3
SHA512 fd5417a9298004ca6d3da58f2c2efa79833a1511e04077a569a659e80568c66c5aa4e99767251a918d3c92a5e20d2d2cb1b2132f591057d4701c688782795621
SSDEEP 49152:h68Qg55nhkeWu7PNU3/amLNiXicJFFRGNzj3:fthTRc/am7wRGpj3
TLSH
T19CB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 00aaf43f1cf8ae722d2cb544d95de785297c64183beb49588e7a8baf392ebd5c
MD5 c5b0a8b7e7b2dac123a5003846596591
SHA1 51019453fb74670788857b1c7a56db0857258b0e
SHA512 28ced2528d9992a574b53c08d00e9c8f1f919e090fdb56b097195af8a2438e13ae34e6aa191fd8d2556119754982af46df18073894e739ae49fc1a27df0aea4a
SSDEEP 98304:jy5112gYy5azzVvU69nLKnhZVm7wRGpj3:+LIHRWhLKF9
TLSH
T1EE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1d3c921f8786fdeec5d4ee0bd4f71b0e5e3d7402d6ff8ec49371f47a9dae2e29
MD5 2edb09a7a476bb58d97e43dc9672cc1d
SHA1 99e26e96452c96807eec63348303cab798ad31ec
SHA512 edecadc78f9fcd38c81183f448c28528214a71815be0e1c07b5cb04a33525b2b39e777d4224143fa38267bf9bab5eb9048e5283c387a99b4d804768b7c2b4f28
SSDEEP 49152:RB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glPLNiXicJFFRGNzj3:Hu6JmIxd2dP7wRGpj3
TLSH
T154D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9158cc85b79e84de43ad357cde9d1c15883121a9cec1355f8a619f89770105f2
MD5 6840dd2daa42fe58853605eaaad161c1
SHA1 8c3de85217b7e1284470d30420e902fa118a45cb
SHA512 b113593b9336546eba87ba24c146ef9c2aa76d21e6eebd61ac1a27d3fd51340d7a0d7943716871ed58e8e228282b21fe89104adfab7cf26ca15ca29e8a64830d
SSDEEP 49152:Q1hpsNoJpF1A67U44CwH7R4xcmLNiXicJFFRGNzj3:QmifPqRTm7wRGpj3
TLSH
T1A4B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b80060b834b611e05b7e53f21778b3bbf70d864a2d37ea1a80efe89781c97483
MD5 1ac1889611f0f1db89bfd04ab5eb3c44
SHA1 ba3e76dfb64d0ed1f58cbcb13480b347d0c366c3
SHA512 726933dbc6dc591a6c31c25b611e856806090cf1fb0b8bbb3dd6724189a472dfb867121d1a1c35541dbed8fa4459d0c39d15166b34636c3f1497039d9278433c
SSDEEP 49152:RSuZQIY0Be2KkRVtOnks6NMHqBmLNiXicJFFRGNzj3:/5dKqi61Bm7wRGpj3
TLSH
T1C7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 33d03dd2eb2d43ccc3df8e76b701870475700ac88f9541fa96dbb81ccf2f6309
MD5 106c12dcdac13768e37e48a2c45e2a55
SHA1 5ed6ff654938fd9429615b12952b021fd4c63e4b
SHA512 fc7c47036f5d4882b32236d7784edbbbcd584805e7069fbd14ad77f869570d73037863b3323a24611a7f0f79d7213df0e503aaed6ab8064c5a0837fff36059e9
SSDEEP 49152:1htSn8EApI0figjgiDn0AP5wYmLNiXicJFFRGNzj3:EX2iWphHm7wRGpj3
TLSH
T18595BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 502ff012b0bc55224b5adea30afc65f25ed132413143ef82adf9baba1cd75072
MD5 a3f579fdf50b9b93bd658eafce3b5f36
SHA1 29c3b89f04c46e11eb3fa78af3357ed76f18ee6e
SHA512 52577b966219cf59b80f22b511668c049704b61cbda21f6e41cbd7a7c3c8d0df4fa0ff8f8399755e3172dca5836a2a766557ac01ba08dbce9fe104d0d1c10309
SSDEEP 24576:s9m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WmLNiXicJFFRGNzj3
TLSH
T1495523D2548955B2EAFC0039C6755428F5881E2DEB5618E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8b9a7759cd399c4503ac39f70fc8851139cb74655f5aad3cf4564fc959b2c74a
MD5 5b869d25ecc5cc76c94ab1b36c8c45d4
SHA1 2999af5319bd5846a2f2af8804d6402a0f545838
SHA512 b9e0a0b66178b30b992027c8693f6be777646a25954e1cdd3d92901db4d6b62e9d5c86e69f30494c94f643e72183f9e152bc869beb1e8038fb06cdf449b00f61
SSDEEP 24576:JGm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ImLNiXicJFFRGNzj3
TLSH
T1BB5523D3548955B2E6BC0039C6754428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 30dee1ce00045f4eae27f173c704e19fc30df7e8b818ec62bd7775f6a6453048
MD5 238fb13a12bc607a3d66aa88a204cae1
SHA1 9ce78b2cd1d46ec9ff6b4cb3dc9642a99f22b449
SHA512 820ff51839ed093522d76a0f47fb50e0f2b69344444b4a8d56de73da616872ff7ee4f5abba49b83d8cc32e7282f29c686e0b37820d1379847affc9065f8e4438
SSDEEP 24576:nkm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kmLNiXicJFFRGNzj3
TLSH
T18F5523D2548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA27CFEFCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4058388ae4fa879d268fbd56b715a69485953db62c929f43dd1468bd281a400f
MD5 1f40c2796c1ef3a294e60c66a0479290
SHA1 07a5f98347bc7a91dd45e0115a35792eca4f6b86
SHA512 a671ecf34c39c2a526403e95644b124e37ee5e14d5a3c34d205c46dc9701539c4407cb5454b083124b374a66a68c82bfd693311518f1fef36abc284c133bcd3c
SSDEEP 12288:CVTciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:em/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D5552392168901F1E9FD8039C6764424F2A47D6CD7365AEBD3003D1E5A34FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c9cdb0b14fbd49aef3702f15d058048ae6b22310bd3b5ef167e79fc80c2f9550
MD5 67fc2828cb47f44231e50aeb5ae93248
SHA1 48c167d229ac04fc134bd2181190981866bf4043
SHA512 44474ef851132e0195aabb0a95388ebc5c54c42b109041cf7a6cf3f55ead9538bfa29602dccc15f50ce583497f779a7f807c98615732d440bfcdec2e2511b57a
SSDEEP 24576:8rm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KmLNiXicJFFRGNzj3
TLSH
T1A75523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 02eabb3cdb4267d8acceb405715e74a15753f5d0bdc54db1e7a22d5d2df59796
MD5 406e29410d856e95df27269d6cabe2a0
SHA1 ff5f583fbd0a45c53a0fdab6af003abaa61bbe4d
SHA512 d01af812ea4cbf0ca00db2dca492720f78ca4ad2fe3ed853a9937437136e70884daa2d3dfa491b16d97441b3ee3ab961bd14e4e6d3ecf1b04a6b8747993a6add
SSDEEP 24576:6Sm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tmLNiXicJFFRGNzj3
TLSH
T1385523D3548955B2EAFC0039C6754428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ec3a462fccee07d29b222af69dcbf0c3b7904ca794cb140f4b8606d43050efa4
MD5 2743faba4fc3c4da48ba1248215f8874
SHA1 e8a456c86e36eb511514727c8645f79636b54351
SHA512 34b483dbae9f8f82a4578ad1584e2caee4187ad298e5417dd34525422f5b4d550b8fc0f63de2cf5d61fd9a51be56bd90eec08220e9af8f1a7677cb076c9c02e4
SSDEEP 24576:f+m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2mLNiXicJFFRGNzj3
TLSH
T1475523D2548955B2EABC0039C6754428F5881E2DEB5659E3E3083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 cea8f81d01a60d7f2e77bb04c4d02d778f809e8acbb86b9e60f2cffa9e1dee72
MD5 1864ba218bad6e00c6065e5a1113049f
SHA1 4750c0e5b864869aae296b68ba374dbd79fa14bb
SHA512 b1d9d51b60f18555f7fa4d06d575e90644d9665ed54a67bd7c45a21c46b370d31fd1361bd98c4619a41c3a4b714dc5e0a8828a11eddbd5fd06b2e6da512c613c
SSDEEP 24576:pZM3zFVSOmm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pZM3zfimLNiXicJFFRGNzj3
TLSH
T128750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 96a27c28eb08eacdf3a6bba2843bfbe9294fecd2cbcb2fd09f9a4f5323b516e7
MD5 415c230cfd4c33938495bdd3568793e6
SHA1 19b2d81f6282ffcd439eb71bf57bf43d5f566803
SHA512 45ee6dd69977dede90545b7b65273ecb56ee6a9578a08d28cafbc8f90857daff35a48e71da981a46880830cc7080d78946f9fb73409f72c6770ff7bfa21c1da3
SSDEEP 24576:ARm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:omLNiXicJFFRGNzj3
TLSH
T1DE5523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e0af302a5e23ad5cc28e34bf33a83559733689957e5980bde0f2a8369656964c
MD5 a55b5ce5a8d01e6adcf3e965ba82e433
SHA1 3f0407522cacde4a4a0242a9f5d4cf1afabe0559
SHA512 27b622b39d69b0e6fca95e3c06887e4ec86a8f7ee74c561ee6fbe210a774be1ed8056d6098f2d305ae416b7ecb5d36e8a5ff872faaa46cef1340ba8c64877341
SSDEEP 24576:llm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3mLNiXicJFFRGNzj3
TLSH
T1025523D3548955B1EABC003986754428F5885E2DEB5659E3E3083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 96c1134b95737100714dff36ed21cf9389c05f3a5eda8957e18139bd71e85fb2
MD5 754caeb4b728b766a5c5439c6fad518f
SHA1 f2014290401905de94155bc768a583e45986f348
SHA512 61934a5b9be4131916ca31c1bd2e181ef5c4e3b005ce4c7e6c2aff569e19682f7e549d294603e3d965e0c3ac714fbe09065029e49d2647414597d54f0f3678db
SSDEEP 24576:wzy6m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wHmLNiXicJFFRGNzj3
TLSH
T162650247629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 efd7df1fff275c7600b2a48e29056f1b0ac21980e24b7a3c3a214461d7f59ccc
MD5 0e04c2718d13d6775e343500e5885d69
SHA1 634b1882a13163fc74f1d0d1b7310dd784cb43a9
SHA512 7e7c026260229a445f24827c3626455662a1b262d44da3689686bacb47dcc371b8e198889d096739c29d97ef9540505ce661cec476cda549021e3ea15fc652ed
SSDEEP 24576:aRm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mmLNiXicJFFRGNzj3
TLSH
T1EE5523D3548955B1EAFC003AC6754428F5885E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 bb257488d8e636e9c2d9a314723b4fb7e6eb8f2473d0bc43cbb38bbcbef8051b
MD5 211c64a99140f21a6ff4f6879b2f7858
SHA1 ac97668401b90167b7fd3ced448213ef0be40cf5
SHA512 73bada2d1e3bde551e0b2f1e7170d310a78d0db920f126549efa2d894c0ab0760be721fad0f34daebaf37df407887d2f9a6d8e1d892e49b017344faaad90d1cb
SSDEEP 24576:lRm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jmLNiXicJFFRGNzj3
TLSH
T1125523D3548955B1EAFC003A86754428F5885E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a7136c6ea90a5973585846d823f189bab73ef657888496e08971cb4f3e50e9fe
MD5 400add27458cb09ae245c5def219dccf
SHA1 6c8fff5a9f25602091c5e6d4d065b7e9f6abb47c
SHA512 60846d574b8215d8e053c8ad7bf842d6a17ec55e57377200a987feeea136f8aba9f20de2eed95177dd6bc909153f9e7ce3cbede5a31d4e4bfdb6599b90f368fd
SSDEEP 24576:Fzy6m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FHmLNiXicJFFRGNzj3
TLSH
T19C650247629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 e0e69d8208f4a825dbda749a3daac4ae3428cc2445d920188c364a8140756405
MD5 c7e57a2c27c43096ae80358561f5ac04
SHA1 d8c0562c0555cb8967e73d45352461826ae35aad
SHA512 7fc192c7a027433c251d08eb360ec9577cfe02ed67c043946a81461db75852736f86a5eb840b98d5cb27bc2e4357ef2db254ec63db77a9a306b95ad7c7f822a2
SSDEEP 24576:9T8aLl3z0zDUm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9T7LljfmLNiXicJFFRGNzj3
TLSH
T19E7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ab3e210b80feb79237761471541fe3c2067001d053302a05bf64a3e86fb54cf5
MD5 f8bf84e2842031c2ae564df8ed184314
SHA1 a84636a820087e7a6ff9c68470be1a4ae1e598fc
SHA512 09fb337f6619ec5e472e4c5baa01a553fa9ef8d536aba5e9873df1dd704fe727eb204e69813dcaa5ec0f0bcbd6684aff49ec2e844099baf3313ffefcaf334fb1
SSDEEP 24576:A3rd9CHKy7GZgm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Krd9CHKyaimLNiXicJFFRGNzj3
TLSH
T10885CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3a184626fedf357007517950582dd1ed9bf3f171835e45898b05ea5329dfcc9f
MD5 3ecf0f1588a2e9fb72b9f925ceec0ec1
SHA1 65843b74b8e53a0d052202dd3d2f18a4a9d410ff
SHA512 97fd56a84b9ce1e62b21ea5044e2ad20fda94f1007b022bf4677308da5b8a13282f2189769d223ef9063e4a5b7a1466605d4f1d4bd1445088bdcd7a142aa3a53
SSDEEP 24576:qEm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BmLNiXicJFFRGNzj3
TLSH
T1605523D2548955B1EAFC0039C6764428F5881E2DEB5658E3E3483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 56bded5fe5dd697d5f48f2b76babe63df2f4213947a7d15cd204a080314a0d8a
MD5 4b22680ab973005b7f4c2ff1c31e77ea
SHA1 820486fb6ee2566e7316be49a1fea65bd770f694
SHA512 cdc81d1004c999518c425f24821b01e3af9c7783040e0878f861ea2153ecae6a9b960f10009aa0a77bd7ac677feeb0a72d8094b4628b4eb7cad6532216e93785
SSDEEP 24576:Gfwvzk9RX6wkyAI1m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VMnYI1mLNiXicJFFRGNzj3
TLSH
T1FB85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 82c3e05b7aa64e0317c919d5f725013cf65de0ffcb500ce4c55ba9d56c044f8a
MD5 64fac6621db3cd41b9cd60e5f467226a
SHA1 f812b7ccbe088f6ad4428ad5d969f956ef43cf17
SHA512 d584c95e9cdc97391f1ed9ab0eba5cad3b109b1eda602aae2bd9229ff53f4c253f27a2f90af6bfeb807c147706785e4980dbc2f8fd0746ca0eb30688d24b7f2e
SSDEEP 49152:8YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04mLNiXicJFFRI:zySzPgm7wRGpj3
TLSH
T118066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3a846044d1afd8c91101e0d7a1231d30f436dfd7092959f45878c84457d9109e
MD5 0061af267fe2f833db2b351333aee7f0
SHA1 30188ef4e8546ed8ad988ddc75334580bdd69aef
SHA512 054e4ad043871e4db8189a10ed5f5eb90bdcadcb999671cabb1538a826fce2d66894e75e1719d6810da5929843266d8a40def2df7af3b5d1a5a7ff7ea43fd220
SSDEEP 24576:A47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY2m/TwSfVcYG3K/cJHlnFR+IGNe8j3w:A47JUQjqirIhCnDHUPfF/ImLNiXicJFc
TLSH
T15565AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5ee33c117dba650be60340258d55e3b23c4f80b3e27a2c2e8a0bd7f680af69f3
MD5 5d14d77257559a13955a0828d30955c0
SHA1 50dbca0ca9b136361a484c3bbba083c9be663310
SHA512 65af416ce5b8f57fd94c6cf2d0aedb9ca0bbb5d8edfd738cc15bc40e8425c79479a8f90397e013096db9c1be8a2fdb7d0b4dff7dcfcae57ed6b1d324990aa63f
SSDEEP 24576:hBm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XmLNiXicJFFRGNzj3
TLSH
T1E365F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92D0F93E1F39AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 4a1c4efb215bfaab1f03dd19dcc341883a2bcc4c3e22e4864c5c53e63478bf0f
MD5 d31b4ce695f16b621a5d252946569668
SHA1 c31596620284f1b326554ca747f0c309f29edfea
SHA512 1679b17d76422eabc24267d4dd62141520dbc54654b8f0399051a04a6661993a7a212c6a193b3641333ee427dbc6de54b4b19ee8e71d2f2d4a3668afaa4a1b9c
SSDEEP 12288:Otrd9U3fjahH98fN58c+WhXmEfLOp0Roq4DYI5PXp:OtrbUPcH2fjrLD40RoNDYIZp
TLSH
T1FC451741762AD79BC6A940321E36D6CCA770BD01FE059F0773C8873F9476668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 796523fb1de4f4955b95a6d635ed8ac0f1e0e997ee0730aaeb9df7c55a12226e
MD5 1fe262f3d10c2bb79274bcb687ea59f5
SHA1 601e11ea14c30cd1c7d70e04fe4183972cf2a914
SHA512 5ee602a2a489b6d8663840b397f00010fe0c040cc88e2dbb854101528cc723c69f511d27e5ff9450bb7f24fa940a62716855c8dd2b10927cfd08d900ffce0eea
SSDEEP 12288:evcl1ykRGQ6jbHLndfui7PoHaB1Ef/RW9cZ0dwYxggSbSCMSLi9C3:ev2qx/bx/LIyCFiE2o
TLSH
T188552B01A9A7E35FC8FE50374732868DBB749C03BB452B0573448A2C987767EB5E26D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 1586f850488e5ca54d92fba73306799dc65d36ac3a722b32b6cfc8d13e3af9a9
MD5 435833eb7b33a2999bd33349195f27a8
SHA1 ac80ee8397f7a0dc21e574f055336bb46a1fb445
SHA512 2e00ac2caf75d5d5775edfd4e52dae1819e11f4e235929385494639e633e16cf35f1a53803d27cfe110be4b026b4b96a35f98299f383181abd4469d16761b3d7
TLSH
T1E5C08CCA51BF51892F27028CA70ABF9210827192CF8D4AA0B6347B06B9A04020C6BC1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpCAE7.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpCAE7.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpEF1B.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpEF1B.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

ba635019e62f061e.bin

Path C:\Users\Admin\AppData\Roaming\ba635019e62f061e.bin
Size 12KB
SHA256 2d140296ac9a52ef5b73437b8d9820cfc044257166e55f70cb100f00fc09daf2
MD5 fc4d520807cffcb02382e6fd9219154b
SHA1 dea12a15072e1fd508c7a50f6370878071f336ca
SHA512 44d8a95469da2767553e4d6158fbd2a76d569d977f3d5e19e2ad8907c580830d55a5d4f65711be5f4fb8e8964f4246fea5960e0ba92c022ba737221c0f559bf2
SSDEEP 384:AWfWfapibSWvheITuuCVpCbfv00zk74zl2mCEtropm:7WypezvZMibn00zk7mmm
TLSH
T1DA42CFB312EC753671172C03C1EC805D706AE955B865016F63937E91FBCBEAE68CE809
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 be2eff21aed4035884dfb8bc5956dc4954dc5ae9d525b8aa6fa59f6cc5e11d49
MD5 b983bf957afa31950dd3f5198c633bd7
SHA1 30b6150f2130df955fd6e60cb3eae2a3d39c7f35
SHA512 7670626de98cdd82fcf7dfb3677ec52078c92635f86b36241a93b19552ec97d5de084227aabd3fa54c990ae02f1fe6944da95c08972dd7560b6b7d10ad47ec9a
SSDEEP 24576:J5m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:J5mLNiXicJFFRGNzj3
TLSH
T1395523A3528959B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 aff2e656c16565063e3628e9dbbfd00d96202a3dd3b528d741ce09723b11ba7a
MD5 d66ea9e5a6fd1a8e2340b0348ed5b6d2
SHA1 fd3f64a9489a7511ef07840d820348b83dc60540
SHA512 0594fc8aa627211ac342fe4d04817339ae2b8c3a46eecab1b715d1019eec14599c21900a29b0500de14a136ac4225336acb78ccd893e1cb0a0e3bc584e45b6b2
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYfm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sgb4mBIBhGF2mLNiXicJFFRGNzj3
TLSH
T12565AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e954c991fadf89a9f8b472af0c63b4eda55f22acc7e71a319002227cc4e9c8ec
MD5 73fc51abb087ffdf67b81ab1a8133b2b
SHA1 64ee67631d2d82e8967b51b8dbffd5a03ca68cf3
SHA512 4465d1f5ff7d7366ad970635c6186e2e1cd581f49dfdc43094b7da8b8d727df0143d044a8f7ca89a1fa2e86dddb688130beb50187a9eb104533df39b7c2e1676
SSDEEP 24576:PG88u8FpJqH1vzria7/mmm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+7ZFPqVya7/3mLNiXicJFFRGNzj3
TLSH
T1FF85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cdb9241f2657726679490ac36d708f4ac38494e00a3f41af7c2fe0061abcd70d
MD5 8a309384c7c85fdfca09b6af8b5a9d51
SHA1 594dba30ce7f1727c724359e487e9049efcdb49c
SHA512 a29c95ef9a6a40547877b47f272824546d86ff3db32e5b3f85e2919642d6fb14cb3bb9f6dfab70cbda93385b750180850a6dffc6071ee3847fe882a383812d11
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSmLNiXicJFFRGNzj3:rG05lO43bNm7wRGpj3
TLSH
T158D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3930c25d38a8ad7e809cbc25c5bdc6ae98024b99a1ebef9d663eae41c61d53ba
MD5 2ffc086176656758a4552d4e46a43cc9
SHA1 42d81166955ad5cbf5cfc4f1c4c353c518939a0f
SHA512 6a80cf0b5244687670a22686aa6177385be9d8bde77a07f2527ebff4b7fafc3d16bd1e6adcbd928197c406fba1ae4058deeba29d611948f32194f40c0eebf15a
SSDEEP 24576:Zfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn4m/TwSfVcYG3K/cJHlnFR+IGNe8c:Ja5POZ3lJt2pasx2+mamLNiXicJFFRGN
TLSH
T1DA65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b3dfef8a016549450a5153540e2d195e5d8f58ab1b4b5086f0ddd5f0516411c3
MD5 cfe7180137c7b71055dd584c78b94b09
SHA1 1e4fe3865ad608eee3757a48913ab73b5ba82086
SHA512 750f04aeb902f8a2dd07f4a64719d9975c317800065268dd953edd875242c44bf4ab97cfe57e42527b34ade37398f6d0a8ecbf2b9863235e6bbd0c96eb92111c
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7Fkum/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bNc/zEOVHFXmLNiXicJFFRGNzj3
TLSH
T13E858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2db65fa32555c393ff8c975a1317a7d3c92e64b456381002067543e915ee1410
MD5 ed01f703093283120a6ed283b560a4b8
SHA1 3cb1d5dd9d3771f77b1c46d15d3e95276dc72e9e
SHA512 eb24fd8de1ac9491356748651e4e7b18485f9e1d9734ac35a2ed7239722cc1c6ffa36216cd5c4bb2d678dfa47dfd15810b69a175aa6c37a760e7967de644d822
SSDEEP 24576:bzkNvNnaFeYhJNtmZBmT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bzMwBtOmTLNiXicJFFRGNzj3
TLSH
T10E55AF6EA6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 5a3ea96163b74747c79e187d8283fb6d1c495f50ecc5bde8668c7d3fd9a502a0
MD5 be803ea5fc6cd368724675d394849418
SHA1 e0ee8eaaf901b9c1e9513e01c793e4beb5faa624
SHA512 df384104e595f3b0ec777f9a6ac5e04895b90553b0a74467c89874fc7d903d3dcd10f01032837253ea49b3308e0513365465a862a02bd6a9221091c3029eea62
SSDEEP 24576:LPUr+NQim/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LJQimLNiXicJFFRGNzj3
TLSH
T13565F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 42d887f205c5060074497bb60f24f44823631d5a504f5ea9df64b37d45e0d08e
MD5 91dc02b08df035b672e1c274cb551738
SHA1 8043599a253bc537d7c81645f2810b55898fb34a
SHA512 cf1bb3a64da63557eb26c390512e2f415a318d2d605e5749d302ff486a1a538147477d5d56648362c866d300ade39fc2462ee840c904f9152b4337bd58ecf5c2
SSDEEP 24576:nD3FHshBIYQgAdm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nDVHeBIAAdmLNiXicJFFRGNzj3
TLSH
T18E75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-203-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/688-403-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/688-211-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/688-210-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2080-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2080-368-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2080-54-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2080-61-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2480-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2480-46-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2480-39-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2480-49-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2480-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3216-675-0x0000024AFD410000-0x0000024AFD63D000-memory.dmp

Download

memory/3624-405-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3624-233-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3624-239-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3624-232-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4552-158-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4552-164-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4552-380-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4552-156-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4584-544-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/4584-661-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/4584-607-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/4584-545-0x0000000002450000-0x00000000024B6000-memory.dmp

Download

memory/4584-550-0x0000000002450000-0x00000000024B6000-memory.dmp

Download

memory/5180-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5180-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5180-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5180-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5180-209-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5548-231-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5548-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5548-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5548-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5548-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5644-153-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/5644-2-0x0000000002500000-0x0000000002566000-memory.dmp

Download

memory/5644-6-0x0000000002500000-0x0000000002566000-memory.dmp

Download

memory/5644-7-0x0000000002500000-0x0000000002566000-memory.dmp

Download

memory/5644-0-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/5768-411-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5768-409-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5768-179-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5768-185-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5768-399-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5768-178-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5852-190-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5852-191-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5852-197-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5852-404-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5852-401-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5852-400-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5908-222-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5908-224-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5908-226-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5908-216-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5908-215-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6052-445-0x00000225B0CF0000-0x00000225B0ECB000-memory.dmp

Download

memory/6052-408-0x00000225B0CF0000-0x00000225B0ECB000-memory.dmp

Download

memory/6120-386-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/6120-169-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/6120-174-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/6120-168-0x0000000000400000-0x00000000005EE000-memory.dmp

Download