949a6d38ca3e2e39f4ce13c1cb498e6d0873d5d0501cae8134d3dcae3debc160

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.6MB
Sample260804-rmzt5ssena
SHA256 949a6d38ca3e2e39f4ce13c1cb498e6d0873d5d0501cae8134d3dcae3debc160
MD5 c022f276fb7c90561888c86714ed78e1
SHA1 6295fcb8a2eb7419b99763bcfa92d8aa28b55419
SHA512 392a793304f5965e7bf6319b93ab2a47fd184e7a2dd71427ff18d4161f4f0c76eacf9a275a496d11f7193c2db3117cfa7733f2c68a3160ea26920c7cb75fead0
SSDEEP 24576:4Lv5qMr1nD7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A5qMHLNiXicJFFRGNzj3
TLSH
T1B575E01077D08036F5B324764A7E8669956DBD715F2181CFB3C02A2E9E70BD1EA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6268	elevation_service.exe
4220	elevation_service.exe
5124	maintenanceservice.exe
3020	PerceptionSimulationService.exe
1908	perfhost.exe
5084	ReFsDedupSvc.exe
1000	SensorDataService.exe
5080	ssh-agent.exe
1136	AgentService.exe
2796	SearchIndexer.exe
4404	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ee75c803957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092eac14a1c24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093f9674c1c24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002745f54b1c24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
800	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
800	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
800	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
800	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
800	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
800	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
800	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
800	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
800	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
800	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
6268	elevation_service.exe
6268	elevation_service.exe
6268	elevation_service.exe
6268	elevation_service.exe
6268	elevation_service.exe
6268	elevation_service.exe
6268	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	800	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	6268	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1136	AgentService.exe
Token: 33	2796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeBackupPrivilege	5084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5084	ReFsDedupSvc.exe
Token: SeDebugPrivilege	6268	elevation_service.exe
Token: SeDebugPrivilege	4220	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3408	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 3408	800	2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe	92
PID 2796 wrote to memory of 904	2796	SearchIndexer.exe	102
PID 2796 wrote to memory of 4348	2796	SearchIndexer.exe	103
PID 2796 wrote to memory of 2128	2796	SearchIndexer.exe	104
PID 2796 wrote to memory of 6944	2796	SearchIndexer.exe	105
PID 3408 wrote to memory of 4404	3408	AdobeARM.exe	106
PID 2796 wrote to memory of 4172	2796	SearchIndexer.exe	108
PID 2796 wrote to memory of 6756	2796	SearchIndexer.exe	109
PID 2796 wrote to memory of 3268	2796	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c022f276fb7c90561888c86714ed78e1_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5124

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3020

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1908

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1000

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5080

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4172
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 16b9406719442d409bba1b4d397fb6862d62d7eb18d6e58b347bcd1bf186d6ff
MD5 83a76cfc6611abfdab7b21e4311462d3
SHA1 d317e0e8f528cc3dfbd94a67dfa52c8525fe43b0
SHA512 4f96eb6aa870994e2526a26ad6139be4b4e08c65b9fb282b70002700b75f78d700d2f99394fe38360f6d930512cfe75e4949577c7f84c29b77331b5b0e2ba7cd
SSDEEP 98304:DrbT5whEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTnTDoxj6Ms:3QnfW/JLGMcblLheTTO6
TLSH
T182A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 1ce832139356233816a632af04bd809076fc9bb3d3ae7e0c41ce7c5b435a408e
MD5 e5fdd460937be45981509d5e53edb811
SHA1 5b4bff85e28d9385ee9f3e02d3b5f01bb358b388
SHA512 aea35a3eff406b85f59d19fa4b0b3e0e3968e5f12a1710f42f5fbc0e0d8fbe68c62b99d6cdb6c4d78b55eaf4dc53b6beed7396d134fbd101aea1b8383f43952f
SSDEEP 49152:4TfiUEWo6zuEz439S99akTBc4O8b8ITDnlT4NvJooWDoxjfiMs:4TfiG/nzl90cTDoxj6Ms
TLSH
T1CCE5E426A2C8C0EBE5642071CC59BBF900546D78DBA28DD7BD447F16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.3MB
SHA256 93932a9e81ea9d35975acbd20ac623d3c2aef900fb5e04f607c6ffc37f4559dd
MD5 3c247446a2ceab5dd86479d040765bdd
SHA1 dfe962eb5d558621c4eb5d00cbc760b2ad6f3a15
SHA512 e958a0df7685b47668908bbd8704ec7068f9e5721195f49859cf87373fed2cc7ade623e97d848ce5f0abfa9f6948ce9f03949f6813fa4c6e355265128ebf9c1b
SSDEEP 12288:mFQyt33mWArcNbotub08Rjnhl732z/KEfiLjrA2HN77A:sQytnmWcaotQhlKzjfiMs
TLSH
T1255522633F1F4622E875017308A55BA458BEEE209B560BE71329A71F8EFD5D009B207E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.3MB
SHA256 a922931eea25ff9f851b152453b2294818ec37bcc61bc69b576a32ebac3c42ce
MD5 16531b1dc0966827fdc6d579802b8f2e
SHA1 bf00e16d0bd822b65f7e426f228955a46d63a51d
SHA512 30790609e23fb647e3bb414c0e6a25fa6d4d2d2b01331f0ad8abf5d1d54703783847fcfeada41ac3fc3d428071c1ff2802ed7a3a7a74ebe2659e43f4e2eba5cb
SSDEEP 12288:/5Ait33mWArcNbotub08Rjnhl732z/KEfiLjrA2HN77F:/XtnmWcaotQhlKzjfiMs
TLSH
T1B7551330B9CA0471E67601734D9A6B9A542CFA34472245D7B3EC9F3E9E781D24FB24B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 6e2b7f1a4b6c73ee8b02446ddbab8ad58fbca3e5ebde97a757aaea0d3ac516f2
MD5 c31206a15ae22ba807e60e00d313d598
SHA1 62bb0c31c097f6aa09d1b2e8416439eba7582228
SHA512 03a3bb5423cdae0d490696a264eb1b6320aa2ffb5922a56ea38a65f7a52f9a0ac66d38eb51d8d4d1663156af3c7b2ef01f77622f2df2453ee39fe45c73512b20
SSDEEP 12288:+6dVWnxlMnn7nFKbltn+Ch/m6X+t33mWArcNbotub08Rjnhl732z/KEfiLjrA2HV:t/TAbD+Ome+tnmWcaotQhlKzjfiMs
TLSH
T12675E11037918035F1B329778ABF9724557DBD715F6982CFA388172E4EB06E0AA3172B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 868e2615e3280e91400013e1aca742ca1e83b5083d8a071359e49d87e43f9301
MD5 5bb5d40a3a478ad523597bfdeabf6c6f
SHA1 c9696f165115d06bed1475a694f377b6052ba422
SHA512 6a2e5cb73feabc44cad6eda9cad941634379a4768baafbcfa574bdeb470b21c4414e298377755cef557a33642901962522361d2f856ebdc08a237677d273e3c2
SSDEEP 49152:Tb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnJLNiXicJFFRGNzj3:x3q6mjBW7wRGpj3
TLSH
T14FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 8db9209f2b84b48452b9c0ec852db7a450af74e00e3bb39e49ea4019f5b590fb
MD5 99154ceecd53c2d61887fbc2d9407b5f
SHA1 2d8e30062a195a9c22476ec68856e5049402771b
SHA512 c40cb52effd42d0c9087f1aa0faa36f7dd75cc210f38dddc775fdf132c8be28f80d88f0c14c68cd1a9e33a81b1cfcdda40e15afc37b3b52ce57793ae10338a2d
SSDEEP 24576:oXYfDtczAi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/tcjLNiXicJFFRGNzj3
TLSH
T10B75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f6c0c73a20d554f14b81a9ba9bfb3124e386176b902fc0baf6ae0e9a3713a8ee
MD5 4feba315d1b5fa059364ade53216cb16
SHA1 45758503bd8c95bab116adb18d30e9c746a09bb0
SHA512 a7a74e49c47aa2536314630be4672d3c421ba4deadfec67c2a8707f4f7843632f7fb02476569f25adeeb04abc0e5591ca939d74d0d5bbbaec8a7544d75376448
SSDEEP 24576:F0Le5ji0hmxhrMjq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FPji0AzrLNiXicJFFRGNzj3
TLSH
T18D85AE16F6748331D073C0B9C5D2A69EE971308657308ACB4286D77C7E67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 49646ff56347985cf7c2b017b5d04b71bb78fd12c5a6948d46612926f8cd8487
MD5 f3d1a655dcc33c07cfc3b3b9971287f4
SHA1 9cc31512f5aea9f36ef50af037049c4fac28fa5e
SHA512 2f211a1f9e5e1f5473f910f6af0f9aa1efcc399fa60a3c49b7e282aedc80de82fc230cf2dabf1a861e98d17c301e3ff7043a0fa933c8da53ae090fb7769ff3eb
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWj6q8wyuFq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:R/ezSC6vUzPv+HjyvLNiXicJFFRGNzj3
TLSH
T195756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0980204521adc2e25007dc146b3ab9c7269215a1b697d0bf978672966bf856fa
MD5 12e86289f26a7c2071e996115ae6e6c8
SHA1 073106fcc0ed085b9cab620849afe27f253669cf
SHA512 f15e435b6835d59f7267b7f2762ab4e1deff5a6cc5d181856a744ca635f3be200ca1e29eef639310a87cb861e8d37f9dd7d034ed70c5969dd950c9666940c688
SSDEEP 24576:5VbqPb88hv/l+BSq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5VO88hXl+LLNiXicJFFRGNzj3
TLSH
T151559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7205b608917c74dfb2a80e047887164e42cef42f65624066cc0f0d3ddc8bd267
MD5 530216c175334a0f42b2eeac599ed8b7
SHA1 d5ca487052f93866dabd838c09dddd438d148551
SHA512 fe1d1d941c6fa8cd889379ebd63034eea8403414b7553254bb9355534574364dfe9da32dd13c5dbb55743b5668d887ac85474ead2514b14953c0e3081eb05eb4
SSDEEP 24576:NGPq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hLNiXicJFFRGNzj3
TLSH
T1055523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 41e8ebbfb32c8c78eb42ca64570d6b394de642f6b2090b20a0620d6d326c5725
MD5 72fc091bad6c03b1671973bd7e997eb3
SHA1 195c974b963155fbd4c31d60dde28d2a3fe05107
SHA512 335807106f93c4caf861613f067f6aec14a74e9d13cbdbde9a9c685b7dcaac2398d61d49343104ed16c0be0d365465fb937d6b8fd30fde78fca3bc1f49afc35c
SSDEEP 24576:xJIUaq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xJIUZLNiXicJFFRGNzj3
TLSH
T1E975CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 056b1b6c62a7fc677f6f5079604f446428a45e1618d19eff8d543f888e550615
MD5 c6c786cb93f006ec5740d4b6e00eeaf1
SHA1 4515215f1f948cb2f29f429bba40420ff8ae25e5
SHA512 3bfbea8e895573a4fb512a5b11cd25d816a433bd2ac1c096aa1cdd0550739cf10994d14755d389764b75ad17a0122331ed9730361e3e65a0d0f89eef956d6475
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THZ:3QvGAdlCEL8c/WRNw5CY7wRGpj3
TLSH
T167266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 30ffb7ce8a9fade6e2b5b1cbed41904709bf65737c559e2f2003c1dd29077720
MD5 3f34b5e7e1cde561e70e332e60f1f88d
SHA1 d9cb66592db5f5b03ed0d964b2bfc6efcf3d55d5
SHA512 2beeb1bfd2cc887de2d6f78bdb95637c3849a1a25081557b7c99306dc43d7ba5a3d1cb69f20bfb1a687f8798dc058a4f8a557f4027b1b84ca1b7f446002b3104
SSDEEP 24576:EfewsAj8q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Wlj7LNiXicJFFRGNzj3
TLSH
T11C75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f3306bda850725fcb9dd49ba6f2d654d756412dcca40a71b189126696d661440
MD5 a81ea88944e3da210295e3b8c18a7044
SHA1 38bab8dcf63aca35e4cb36aa433f719d50bed53d
SHA512 a1864cf75eeefdfcef7a7b9513dd62ee5c02e4c9aac7e1b5ad2d0e6f7bfa8893dbb82e6153ad277c69e1e2924f77c01d0d762c20ae788c10f9d83d67225cd749
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH3F9:BUEtQevvqc2W1cpV20I3219
TLSH
T10D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f6a3b7cd626f318e2f6cbf90cd5e3631a95bf6a3db4ea227a3b483bf8f9bf4d2
MD5 4830ea3aa76034983f7992179c27f796
SHA1 54be12bd3461ab8530c9e29ef136876e65839f5c
SHA512 8cf4b517ebe53af2ed412d06b42ff2e21759cfcfe2dbd6b3de31842ef49d6b18cf205e99ae971227a270241267a627c52f5a73ce31f45984784a6d00a582f2bc
SSDEEP 49152:2CbRquA/m2yL5zLfFiV+XenmE3/zbLNiXicJFFRGNzj3:7oq2VjnmM7wRGpj3
TLSH
T1E8D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 093b809fdf2be88b2c90e1fe1ccea60a5fcd27c67eb25a77f1e6abe20c6de484
MD5 7b42e57728f42f9b3744c675f68d9955
SHA1 a404c9c8db9855e34f6fab01b27ddd04d309e53d
SHA512 9689c8b6af15b2a75cd4f3b97ec0d3f80e22b907d8dc1651a1a7dd324d534ce6252ec00d717c63c15eee241427cc6184f789936efc56ad9d1f59fffc315be274
SSDEEP 24576:mAhGL6IFoiwtA5l7S53Jq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mAM5Foiq5cLNiXicJFFRGNzj3
TLSH
T1B4359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d8bd41537333450f61c16aecd123d2d258888a9d7c000b5e33282e638c8ec69f
MD5 a6e6bdc70c3ef769d23e1317f836f3e7
SHA1 4eae84ace5fb9966918b4abb57f6c202f0aed422
SHA512 16edfb1c40aad62508ff2ac14f348de0cc12705ebd3c75f2a899f408ea75ea10e26381c4ac54a5da83bfaaf51967d9c7313b77c041678e72285a54aeb0adb040
SSDEEP 24576:+Zurq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aLNiXicJFFRGNzj3
TLSH
T1F255129622C820F5E6BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e95e8a72a091da2db5dbef9e72e58fa71f859c7e82b0250b8103d3da99392fd2
MD5 8b20ea3219ff3b6010e342dff8a7d63e
SHA1 4f079679b466621aa2ec05127ab1ba66987e3e8f
SHA512 f5aa81d51227209c46321e7b7fc72f7104a5a54754863c094116b46a19848d3ece74b89a11c771d9e13951e7cd1fc586fe4a163b89f2033f9516b296fdee4d4c
SSDEEP 98304:JQRQyi36YOcPDLvw2gAf+PN397wRGpj3:gQyiKanX+PNRF9
TLSH
T114667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 91b9bd475b1d70c3635df1c48bf79c7e2cf3529654081b4a890215400d82227f
MD5 a4dd8e44f2b0952c926b10278e09c730
SHA1 8813aeb6cd064d8661ce7627ae9310af4e503b55
SHA512 8b30166ead9b9fba429b744529fec9cd2a21cb79708468ec7f748e717f75cd822b6c9476ecb125bccd38ea337f8df397c3bd173c296c886c61ee1d952ba3f7b5
SSDEEP 98304:7QRQyi36YOcPDLvw2gAf+PN397wRGpj3:KQyiKanX+PNRF9
TLSH
T1BB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6becafe7449e84328f4f71ba57086649d045ce7e516e7c266d7593d10379dafa
MD5 a8fbcab1b34e8d3f2779d24aa18362b8
SHA1 729f904baf04709d5d66a27227b3c7fd95ed6ca7
SHA512 18a508be387f42cb26571b2726e43cceb3291de0defe4d20daaa336710065b4e208ea1c2814adf5aa4f8c1ae24500e1b6f431d3c58ccfb82bfe8a6cbab00ce91
SSDEEP 49152:X68Qg55nhkeWu7PNU3/rLNiXicJFFRGNzj3:BthTRc/r7wRGpj3
TLSH
T118B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b3ab5e6d47cc68c42acce982458206cd5d35588bc7ab8cead0c00eb3916a9976
MD5 bbcb174ec9bc18c0247e3629652c3a06
SHA1 34ec6abf5be3f8a6198d0d1235192d0dfce1b35c
SHA512 6da7cba5516c653c29601bd8067754494ceeb45506e7b56ae394e03bfa3b284124fac8006bf58699714d6c866c980b881d3f6297387d616784c7ae059ab68219
SSDEEP 98304:Iy5112gYy5azzVvU69nLKnhZi7wRGpj3:hLIHRWhgF9
TLSH
T14F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a8b4f30c0401753f8c20aac894efc9fbf75ffbef087ec42084f71307872e99d8
MD5 52df193b87f88bbec827d9fb470786db
SHA1 4714c6f006cefff671bf22b76afc31ad576baec7
SHA512 99c3cd47e11ffec1c4975cad437f63e30a33362d07ff8eeae68b4bb231196b153f71054052debd82d41cf907aef2a4304277337d94835a73a922bab74fa1f956
SSDEEP 49152:VB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glSLNiXicJFFRGNzj3:bu6JmIxd2dS7wRGpj3
TLSH
T158D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 45d2d2db95942bb5bef78726b648e23784f528705f12fd84435fd06214c5c28a
MD5 62f14c7abad681339c51d482e1c452cf
SHA1 6d3915f77df1ef7160aed7538f44070e87337ac9
SHA512 c031ca87ae6734693b792198a86721d97bbebe0effade3e4b315347dc1321267e8a6c2f9bc6e9d0feb11defca430744151083f6c58d9d7c7a9471b6296fb612d
SSDEEP 49152:a1hpsNoJpF1A67U44CwH7R4x5LNiXicJFFRGNzj3:amifPqRM7wRGpj3
TLSH
T1F0B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fb1ee38f7e3e7038721530a96b41b393398eb84c451a2cd746b2239f13f7367c
MD5 45a9393ab52ce6921123ab7aca830116
SHA1 978b95a76a5112ae7b22a86db1c5c9503b00767d
SHA512 35e8450ce39a62bf1a0befa53bb6d6f882211a00b0bdb969ec47d2c7ead03e3264618932db02fc5c45231dd0bbce8d79b9ab704aabe81a6c049af71c4cf3e35a
SSDEEP 49152:BSuZQIY0Be2KkRVtOnks6NMHqeLNiXicJFFRGNzj3:P5dKqi61e7wRGpj3
TLSH
T13BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4c70d7959b4448d92e2954092c3a22f27613104090f5470b3744bb6a40f88cec
MD5 c233375bdf491a69d9060d98ea5c1da0
SHA1 de964210d5e24159f6af93ac6e0aefdf6009e0ea
SHA512 81463806d86c9e573d00bad33aea1287d1b9717e6b037494ad48603920044f86dff2761394842150d7bd4b7e39ac0778a82d00af65263a52178507fd4b488e20
SSDEEP 49152:JhtSn8EApI0figjgiDn0AP5wFLNiXicJFFRGNzj3:4X2iWphA7wRGpj3
TLSH
T1D195BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f220781d3bd219b4e4f2526de7794b84d13aad05761f52e9f064c2006dacc29a
MD5 3da9dd35abf8d7768a38f7f15ef72f1d
SHA1 6867962fb076511083a23e6852e43616ddbe803e
SHA512 38c697708e012cdfccd79a952ad3acab1ef371c0c1ff10c0ce26622f9b15253c80dfdabd43f77405297127626f2f969a9b22dd9a282d1ef1536e52db93e591bf
SSDEEP 24576:F3q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sLNiXicJFFRGNzj3
TLSH
T19C5523D3558955B1FAFC003AC6754428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9107cb42e5ec5886c8192c3c2b772c137837e852b34e2c9a21e93117420c919b
MD5 29fb572d58f6c6d178b77e52d10855ba
SHA1 5279560e96b2af89505185144206293ec1369396
SHA512 cfa47967d5c5f6fcfeea7297cf059553f3a00f8476b37c3f997ea55efe2834ef2d64da7442dddecf86111c1c6dd8990c8bf201b703c9e4089cad94feac7f1166
SSDEEP 24576:JIq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1LNiXicJFFRGNzj3
TLSH
T1105523D3548955B1EABC0039C6754428F5886E2DEB5619E3E3483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b00e5812703400514b150f1c0d25828acde1f1db33a17b776145848aafa591cc
MD5 cb2c3f4f2acb2a508bcf9cfb99345b4a
SHA1 6cf943514b3302cee07eb031e875cb325f7d26e1
SHA512 b54ebc98461ad9a2f778c8fa0608a4d948253e15d14cba7866b365ce40477d268a44bd21aad524be5b0eeabbcf2741691eff7d3d7b9589d4ae63d64ac5ed1fc7
SSDEEP 24576:biq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dLNiXicJFFRGNzj3
TLSH
T1345523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5197252844f398c2e53168e0fb1fef4e43b883a5ac8f940d85e16e603ecefa09
MD5 7119ce503a887ba64cf9baf9ef264c90
SHA1 2f32930e7d6308507a8892edc6ea9406631d9f5f
SHA512 5ff70c35cfcb8f8b6c476e2c86f2943d2959a9f35c26829bfbf7b7e2f67e926e1bce06f3c93f3863d039f8ab481e7ae004fb6bbf83f5400e47b11c5b391e5ea3
SSDEEP 12288:SVpYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T153552392168900E1E9FD803DC6764424F2A47D6CD7325AEBD3003D1E5A75FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0d233026556951e611153437ed920f5f66c64d73352101e23ec6cf254c3cbe66
MD5 b5d782c9075ffd290d92d5e42c81c367
SHA1 d4e217a1f4f972a9424899218f4949b5a5887a64
SHA512 d3fb7436bcc2a09d8f700e245e1549882921437634f09787401a0ebb187ae2aa7c9c2794412a126174ce42d265338bf96f59280bb603aaef943a3a80a9c2fb3d
SSDEEP 24576:wBq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PLNiXicJFFRGNzj3
TLSH
T1F65523D3558955B1EABC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3d368dfc506261d9aa7044ba748158a6873272e4794009bc54e67f3e9ecefcdc
MD5 f544d571c47aa331435bb81cab463f74
SHA1 1a373554b3eb4ecfac8f508ecdeeb2e87e21f346
SHA512 5444623b29bb8e0e62b183fd909fffe9941a901d4788eeab6fbc8458045b016b28431e6e06b295e94297a2a5efa8350d4d9b2e6b4e840948c57caacff25dd266
SSDEEP 24576:8Eq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8LNiXicJFFRGNzj3
TLSH
T1DF5523D3548955B1EABC0039C6754428F5882E2DEB5619E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 91040da7eb999784ecdb5a43c3c339c90b57e3a45c1f5a8b0a69f9d0e00fb5ba
MD5 51620a24faaf26bdc3d56e0882efa5ec
SHA1 b9e4cdad346cba7f1e19ea9e034ee1078ee85962
SHA512 e39c3c0d065a41367c6f5b303829bcefa0c7110e98adc748779ae93490bf5ec8fbc28d61ed6350f3fbc4432dd14465e428a562a17c1aa26845a2f8b3d4e99295
SSDEEP 24576:SAq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ELNiXicJFFRGNzj3
TLSH
T1035523D3548955B1EABC003986354428F5882E2DEB5659E3E3483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6dcafc6ee884d034849488c41e6f6f89188935d3e1a8282954ebb1f95cdf77f0
MD5 790570eeba98ea26f8754a84cb64877e
SHA1 c8195e5786311d0f66072fffa36652cbb5dbb899
SHA512 42df49a1a4d6b47335b8c562fcd08da293dc4ea59b08654958f9602be57335cd82bbb91b9d6f392c16da850317594e1c31825880ecb56cc52a701f906fec433a
SSDEEP 24576:0ZM3zFVSOoq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0ZM3zfjLNiXicJFFRGNzj3
TLSH
T151750295B39018F4ECB7813EC9258815E2B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 24192a9973c046761dfd729a414f3f43d0784a53e7a11894e49d6f4dfbf93eed
MD5 d49b2fff2b9f8d1dda0cb48cf1f8b457
SHA1 abaf1ea7372239cffb8a23513148007f8463acfb
SHA512 80a7438384fc8d1a2f4fe40b64ac11d666978d5b74a7bd5e1878c82e224660048dbefd918b58570defc53a40ee577780855224e7e1e20fbac0f3185d1f515251
SSDEEP 24576:tbq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ULNiXicJFFRGNzj3
TLSH
T1A05523D3548955B1EABC003DC6764428F5885E2DEB5619E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ed5604b7f858a74edb508f2938b30df5e298677c305488e0a37481f16c6ab27e
MD5 b7c83d62a772bed76a6d5e011eb9f7f1
SHA1 6acdfade8772833750d85fe2c608577011a58117
SHA512 e89c3e6d9e788f8abeadc9fb5e62891e7c657eb9be09775130d106093bb1dac5690529c94dafabc78e8ee5ccc2548a4f60fe374bdf9ee6873d223d42093ee588
SSDEEP 24576:f/q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6LNiXicJFFRGNzj3
TLSH
T1935523D3548955B1EABC003986754428F5886E2DEB5619E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c7d0b21e28eaadf06eec5dbad369b50f232a2c7fa4285787ae9b7aca7d9cfb1f
MD5 29ecd22f45e08e51ae2a30b07d8230b8
SHA1 e118b254ee1b5bb9a5337336e5791fe341de7e66
SHA512 b66ab8c30491602ad224a11eabc0b846a1d1fe679b02f4fb0cd921cbce79823efda7cedbbed6236b841a5cda44da847acd430a0bd8b61cba8fa4da299fb6c19b
SSDEEP 24576:Hzysq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HALNiXicJFFRGNzj3
TLSH
T1C5650247629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d75650f78478a387890766ff1eb67d8bd4c0c463fe4b0fa5c6a1d68d0e897f3a
MD5 510ba4cef9ba4a2067e255f7796d2b14
SHA1 b1a07731c921f81fdfb242c6bfeaaac1e081c5c6
SHA512 06015832ba7fe9a240a15ad24af30f09b90a89c25eb04ca7df276be1da73594e3891030f821b74105fbbab317f2915fbaf014171a928d4c7467142a7ba0b2f2a
SSDEEP 24576:Vbq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MLNiXicJFFRGNzj3
TLSH
T1EA5523D3548955B1EABC003986754428F5886E2DEB5619E3E2483D1EE23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d20f840ecd00dfd422fe536eb4157ee29224ce549631b4740e1c1f9a4f4a35bc
MD5 e036f3931fedd0081583c287e0d22559
SHA1 ae924b8e17fc3d0ea7a5dc8809940fb6eaa25e08
SHA512 fe37be33b3b8afdacf5ca8660aa0c8ffcd0ffa68eb0d63f41bbf5730127b84185f5e8ab046962f551bc40fce0ab9190bac328afa7d00bac679d81314edd91646
SSDEEP 24576:Lbq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CLNiXicJFFRGNzj3
TLSH
T1805523D3548955B1EABC003D86754428F5886E2DEB5619E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 3a757acc9d63c6b395060f794c0e3ce5fb9ef2c300ad8ece9e9c7a00ad084a3a
MD5 07157302c791a23085685c0e5b377648
SHA1 c0cfd4a49ce91ca0300d2c27ef47123c6d49957d
SHA512 e414e144d9e95dc169770d9bf62efee404fc22f74124674b66526efe4099773195108f48beb5b9add6882dafe453ab3cb4a9e4b8e967fa5a01216073a3c0e423
SSDEEP 24576:Hzysq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HALNiXicJFFRGNzj3
TLSH
T1D9650247629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 38df8c671357b07d1001051d944aa8e910fd1b54758c86b1c5ac4fec5108e36b
MD5 53cd1c4aa8491d2d858fd9533e39bb6c
SHA1 2b898a95a4cf09bab8350fba0059b67918dd3157
SHA512 f0fd190ccd5c0d3fd740a5e7a37d3d65c37570c8e07b5a3044cb90a9c6390c9d928674ff3043b3afc1cd960af8d8aa7c4db13ead0d0e25d20e4e6c142e39e535
SSDEEP 24576:RT8aLl3z0zDyq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RT7LljILNiXicJFFRGNzj3
TLSH
T1787502A5B39018F4EDB7813EC9258815E2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7d6e8c3d2ab7427b8d9ad0097fbf12b7c1a6691c1aa708125be644d5062a7b36
MD5 17b4b1f52495bdcba3ea9b4118890ee9
SHA1 79e45d099b516f33cabf0dc2b302aeace84a7153
SHA512 c808337fa8ecfe51e7749974832478b48890d9361f67c3a5dda5bdc3b944c5de4a160e71e9836827e8b4b429b00f39f0db37717c050ce74fff1f1c456d14796b
SSDEEP 24576:vfwvzk9RX6wkyAIvq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qMnYICLNiXicJFFRGNzj3
TLSH
T13285D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 708b406b47c8861249f39460c2e0630ecbfa44fc17930227f2be29ce8faa502e
MD5 384f7d7b24a3010f7b4a9c2338a14ff1
SHA1 bbec1472557440aeb5db39256486b3a2fa09fdff
SHA512 330faf6ef582dd0a5c5071bc6f9906a3ea5726a03a3f4017927fff5a2ae029ca3812c98fbd5dfca91d1e890c612448e92f4f2824d8c969db8ec159e6eb58b239
SSDEEP 49152:8YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lLNiXicJFFRGN:zySzPd7wRGpj3
TLSH
T1FF066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7cadd823b449f6b30d3e3f171a4a13069d560e856e872e33e8c49f210cac25dd
MD5 0d919d5d07f4c4cc16d57809c9d8cca5
SHA1 b45d54eefdf16eb51c91c62ee6b97af3388539b9
SHA512 5f9d71f9992ef0b49ec852190e4b2e15d7bc641f1da91fc79a3602ae86911ad3123fb5077bb979da1cdc03ea8465efd707163416a7a8855bab17d0ddc2b2d00c
SSDEEP 24576:w47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYYq/TwSfVcYG3K/cJHlnFR+IGNe8j3w:w47JUQjqirIhCnDHUPfF/1LNiXicJFFS
TLSH
T1B965AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 6d12100628295eabeee865590c2df55bb82097c7e722a64d849ab8ead83ce884
MD5 381f7239a8131be61217c7044e3462e8
SHA1 c90b786f668ca85f7571d5af7a80897af79d9bda
SHA512 430cfac178be1b59733bfdc71cd9033706471f1c4bbff87612d4b096559dad360eda2129127214dbf2b29e6860a9453b9bec972218354ce509f6b5ff6951c0dc
SSDEEP 24576:orq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1LNiXicJFFRGNzj3
TLSH
T1D065F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52D0F93E1F39AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4e5c3d1a15c9ce58f3b01cbe51f7172e79a22fce8d35178ad5f01316f124f579
MD5 c8e6c08e2bf3a5522426bc3039a65f62
SHA1 397050747a3ac7e6afa484ee0d87142f14b378f6
SHA512 eaf20fc848c5ac4e0a2e50c00b46520e25798b8896aa0511b31255987001416fa92cec90ba42347e804ae70698ae0aebb1c7cabe07e7d676426bdef5a1da6abe
SSDEEP 12288:pwkBCWU3fK/oYJTzOoiXzRCRsK463nfdENewZXl:pfQWUPlQ2zRRqnfGECl
TLSH
T140350740766AC74FC6A940325E32D2CCA7707D11EE056F0773C99B3FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 11e5971a980ce91c9e9cad9cc705253b52a28aa8b2d53fb6450232758844544e
MD5 0294fee11d063f4f0299a6e4bd2266d6
SHA1 4b0a7431733b3cb9d3c6b3d636f700bc01661e17
SHA512 5a7c2cf16649303c44f6220f8a46770578bda6916960f64a7c641092e08945485f7700bda987f5a99a6e738b1f51b95221368ff702a353ea9a598dd72a488478
SSDEEP 12288:gYqRXTivCGiH/xXucWy59ZIajCzX1EpbIO2zNxTPz8m:/CGiH/xXJlUPz8m
TLSH
T1C475F9815537E2CFC1F76032072A6B8CB7A4EC1677495F2673C8457AD86BB25A0B83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 eaf7195d9d05467950ed741858b943aafcd93cc7be0e1580ac591d813658da0c
MD5 617ac7e7f9cd1697fd30983b11d3101c
SHA1 64b46a023015a801d21c11f5a4f93af5b45d909f
SHA512 4ce07974a611e543c71ff33d419497c4c7f7c6a5f909bb4d6655385e9713c1c1997be466c2a49cd39aa453572e0f5b5ae7ba04b96de3b4a474ac478cc6b3d55e
TLSH
T124C08081057F54771F37004A97C52F5011927591CB415910B2707BC6B5A24020957E1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp1706.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp1706.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpFBAC.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpFBAC.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

ee75c803957eebe4.bin

Path C:\Users\Admin\AppData\Roaming\ee75c803957eebe4.bin
Size 12KB
SHA256 f05058986ff3e821fce195eba43267c7d26aa53e2f051dd0853e9222317489cf
MD5 ecd39331b70baf197f52dcbccdc4f4bd
SHA1 1ce15d5f4c520c54cf45c2378e65a36c8fb8e832
SHA512 34866a03e2dff025045bd9e6d47df6b78688e927428150b24f31b906371e24f45e50be28906c90344e15e255b90f6e5681a4a09e571dad39d0a60add3f554122
SSDEEP 384:8lW9iHJ/XGcd/FPreeKme5HbTqXvkiBJO5:84cp83HbTSK
TLSH
T1E742C0A14908467D1034C7E2651475FD2B1360CB2EE96F72C888CA3E440E7EDB3D617D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9c638004c58c9cd6b9662e5f5658d64c4422c44b5b53a0629eed94f86569d15d
MD5 ac4f0ef2446b7567de4c9169a884fdd6
SHA1 314f6e91b4db2296426e79fb69fb79b039080520
SHA512 3ebfb7c67f7898fe2becaba4fcac85775856ae638648a5fc8bf9cea115a8c23132971f39ae41d15fb8d93c8db3cbb67bfe890abb823d8147df2922b3e0e22259
SSDEEP 24576:LDq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LGLNiXicJFFRGNzj3
TLSH
T13C5523A3568C59A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ad6ec010a72e23ad125fdde19ad676d3d5d7ef6efafcf34d5481a59430476d50
MD5 83a02df097954b2f4571d89a100d849f
SHA1 5dd7518b50e5c7f15ab87db966735a327937930c
SHA512 361058a96e103165d078e5a03c980fe2830f7f288b12046eeb828a0b88076580cf954dbe292261ca9f35bc4159f7e3f34ac3f796a3891240cd72520ec7834a74
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYFq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cgb4mBIBhGFnLNiXicJFFRGNzj3
TLSH
T18465AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 f0cd86b041c5835af8bff747521ec217baf372b2c47a86e9f131d42f0d3658f0
MD5 cada195d7654b22e4a8766b268311f55
SHA1 801055aac817b9e3781a95ded485a3cc6517cf5e
SHA512 508f4d41dc125784a01a94e5990a53e68718b194cff343168f61acdb2e7ba13bcfe60c41fe8b4b245872d83f1c4880afac13838ea326fb309bed0f1ecde9b9e9
SSDEEP 24576:IG88u8FpJqH1vzria7/moq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:r7ZFPqVya7/wLNiXicJFFRGNzj3
TLSH
T19785F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f0dcc21682f8bb21ead0321f54ea68ab247540b3c8d98b2a0c5486c9cab8e567
MD5 cc12f2286e4411930046c953e53827f5
SHA1 69d918b7add1e5d63405ae8ab1e581d91d49ff48
SHA512 8230e686ce388e4df5c94fcec26d6b5d6df161145104ee78c0d460641e28e4cc0b7007c6fa37998ac3bd62bb76538680d2ff49626354207b07b87a56da89e9c5
SSDEEP 24576:FPUr+NQ0q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FJQjLNiXicJFFRGNzj3
TLSH
T1B465F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 168bc32005195dfb6178bbfe11e40a2d85a541f9d7c45e9a74240a94d0fd12c8
MD5 70400822d4bc10cbaf84d82986690a06
SHA1 86814b127b55a73fbcbe620c7202d40535a4f003
SHA512 a156484a4e954a78a16f0c9a7ffe3d4429f2ebafe18c24436950a214c60d8feeb04941ea25cdf57cd24799a753b392fd91b183204caaa616688e980fdc0a0e86
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTLNiXicJFFRGNzj3:jG05lO43bq7wRGpj3
TLSH
T182D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1a1809b07b87a87806513ee271d8f638b4debb27d0665df60f5dfeed58a1b115
MD5 2272975d11db84a1d1a35bcc6a372d27
SHA1 e27528fd683d4a436ee6010b353c2b07fbac7582
SHA512 d2ae2b7a53494ccee7ce00e52b08d44443388bc58507872bd163b95bb780552ba69f59e953e9b25b368dd8f4bd88d1a54ed62bd12abe3eb9f0dd437ea34c753b
SSDEEP 24576:4fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnmq/TwSfVcYG3K/cJHlnFR+IGNe8c:Aa5POZ3lJt2pasx2+mrLNiXicJFFRGNf
TLSH
T12665BF5EA2FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 190f1d472687717e351361a7723e22c2e6d617b4e4107b04bab3973bb347a49e
MD5 999cc86e10f25cf194b1aa7e54aca22f
SHA1 68fa7adafc58e60f953049a5e3d74e5c3969e567
SHA512 f0836d8dacb563d4462101cebc5d1198fd8461d1ea7ae4dd644d2dbde66cc02844c877fd1ea91a83b29ab6984179ee33cac3ff2be352176bb2178a5b61d8537a
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7FkQq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CNc/zEOVHFQLNiXicJFFRGNzj3
TLSH
T1CC858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 039a2257e3265ad0c2514e7926c8852483d21b76d8f6b56fccccc0b371d9d396
MD5 6c4f31abb95728b9af7c7959df0d6c25
SHA1 faa32151b8e3d85c104a31f7b9bfe6954d2fd014
SHA512 7653c9023f3cd62b9b8a7df39279e542911dd6b6646c32428bc03afc13707ad476b6778bc03bb6eb9d51e524549a6ec97bb972c6f88f7cdc4c8d8e4b0cc5806d
SSDEEP 24576:/zkNvNnaFeYhJNtmZBmu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/zMwBtOmuLNiXicJFFRGNzj3
TLSH
T14355AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 399c6ff0138da2d1e431e60ad36eefd892bc75da36ec2f1dfffc4db985952996
MD5 7c4eff4829d2bdca9c3b4f2c081b4787
SHA1 b854ff04b46eec27bbbe7fb423b24b277ec73ccb
SHA512 bb4e0034c0f10698825650791278cfd59ce76a5d33f380f0a8264ce697c6095bb665f57c4b230066f40341dafc706fc7e33927ca33ddcbef1040f3275a5f63f6
SSDEEP 24576:XD3FHshBIYQgAXq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XDVHeBIAA6LNiXicJFFRGNzj3
TLSH
T19675E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ef3272bfafa7a08413a74281fe67a2f1d7e0a9b9333ebe4cd0f35013d3eea99f
MD5 0817958848a8a0f3e2c8c9dc154da993
SHA1 3ff2f9d00cb2d60ab125d38bd4be18867bfa359d
SHA512 6b3d8ea06e800d5e1cfd7796c6355fe62823e65c12e2bc3da0fbd64cf56e07e8f429b64d6b0e08bd2ac151267494da772bcabd7037ed22a8284914979cea8c0d
SSDEEP 24576:KwuROWc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KwSOrLNiXicJFFRGNzj3
TLSH
T11B65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-79-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/800-7-0x0000000000DA0000-0x0000000000E06000-memory.dmp

Download

memory/800-6-0x0000000000DA0000-0x0000000000E06000-memory.dmp

Download

memory/800-1-0x0000000000DA0000-0x0000000000E06000-memory.dmp

Download

memory/800-0-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/1000-178-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1000-185-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1000-179-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1000-390-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1000-388-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1000-387-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1136-215-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1136-204-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1136-205-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1136-213-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1136-211-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1908-381-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1908-162-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1908-157-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1908-156-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2796-222-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2796-392-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2796-228-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2796-221-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3020-152-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3020-362-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3020-144-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3020-146-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4220-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4220-220-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4220-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4220-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4404-539-0x0000000002370000-0x00000000023D6000-memory.dmp

Download

memory/4404-613-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/4404-593-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/4404-534-0x0000000002370000-0x00000000023D6000-memory.dmp

Download

memory/4404-533-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/5080-391-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5080-191-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5080-199-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5080-193-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5084-166-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5084-590-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5084-173-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5084-592-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5084-386-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5084-167-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5124-37-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5124-96-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5124-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5124-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5124-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6268-190-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6268-21-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/6268-13-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/6268-20-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/6268-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6944-555-0x000001449CE70000-0x000001449D03A000-memory.dmp

Download

memory/6944-554-0x000001449CBE0000-0x000001449CD63000-memory.dmp

Download

memory/6944-665-0x000001449CBE0000-0x000001449CD63000-memory.dmp

Download