4530a6adb0da2f3fa5d80a8c8b355db2c22ae04f4053ad20eb98ee68fd643275

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.6MB
Sample260804-rvffgacc78
SHA256 4530a6adb0da2f3fa5d80a8c8b355db2c22ae04f4053ad20eb98ee68fd643275
MD5 b4836a01038d9d181fa0d579403f91b9
SHA1 a5714a04ba5892aae2107e2ab8cbe276ff1483af
SHA512 d63468a9fd12021ed498167ebb922d893215abdfdb1cbe5b0e4c49bf1a6e93a67a2db861bb879170212a6a90befff1e04070cca80aa60c09f9eb3b2d55dadd51
SSDEEP 24576:QLv5qMr1nDE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:I5qMILNiXicJFFRGNzj3
TLSH
T12E75E01077D08036F5B324764A7E8669956DBD715F2181CFB3C02A2E9E70BD1EA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4816	elevation_service.exe
3476	elevation_service.exe
4884	maintenanceservice.exe
4612	OSE.EXE
5340	PerceptionSimulationService.exe
4640	perfhost.exe
3516	ReFsDedupSvc.exe
688	SensorDataService.exe
2412	ssh-agent.exe
984	AgentService.exe
1076	SearchIndexer.exe
1080	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a1d59555e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001352aa121e24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050ca78121e24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091aa7e141e24dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000dd1986141e24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b4ef65d1e24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009092d9121e24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1008	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
1008	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
1008	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
1008	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
1008	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
1008	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
1008	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
1008	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
1008	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
1008	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
4816	elevation_service.exe
4816	elevation_service.exe
4816	elevation_service.exe
4816	elevation_service.exe
4816	elevation_service.exe
4816	elevation_service.exe
4816	elevation_service.exe
3476	elevation_service.exe
3476	elevation_service.exe
3476	elevation_service.exe
3476	elevation_service.exe
3476	elevation_service.exe
3476	elevation_service.exe
3476	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1008	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	4816	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	984	AgentService.exe
Token: 33	1076	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1076	SearchIndexer.exe
Token: SeBackupPrivilege	3516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3516	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4816	elevation_service.exe
Token: SeDebugPrivilege	3476	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1996	1008	2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe	92
PID 1076 wrote to memory of 472	1076	SearchIndexer.exe	103
PID 1076 wrote to memory of 1004	1076	SearchIndexer.exe	104
PID 1076 wrote to memory of 1764	1076	SearchIndexer.exe	105
PID 1076 wrote to memory of 380	1076	SearchIndexer.exe	106
PID 1996 wrote to memory of 1080	1996	AdobeARM.exe	107
PID 1076 wrote to memory of 5976	1076	SearchIndexer.exe	109
PID 1076 wrote to memory of 2840	1076	SearchIndexer.exe	110
PID 1076 wrote to memory of 4988	1076	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b4836a01038d9d181fa0d579403f91b9_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4884

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4640

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:380
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 997601bd1665808f1d286e60f8d7a7d2fc154491e6f0c8403da5f20310896644
MD5 e6956d45288a8c39e220538813f70c44
SHA1 90b69a6519b27bae5148c0dbc48fff0108ad350c
SHA512 2c2723c8149c8cf3609eeccda2474d7564ce116c4e5e233bf77252df7fa98bd5eceb6b54371eb8b62908dd798a881c54c7add80c71b9acf1d6c0f31087870a87
SSDEEP 98304:NrbT5whEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZT67wRGpj3:9QnfW/JLGMcblLheTuF9
TLSH
T1C9A6BF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 462533a2252fd9f4f53e562c9c8576edf20301038b24f4ca6f71571f787f6bce
MD5 7ef9b427aa87d948186331878a33d1a0
SHA1 21567ff26dc4ec5d3c355a380cbfba789f9652fa
SHA512 0e7b518f9102b4d0d44acec8bd1dda68d05b4b14eb956ab79568089c51593d52a35c9afddbe389130da92413a26b8a4945af971f540fbd54c70ed92353916ca0
SSDEEP 49152:HTfiUEWo6zuEz439S99akTBc4O8b8ITDnlT4NvJTLNiXicJFFRGNzj3:HTfiG/nzl90/7wRGpj3
TLSH
T102E5E52662C8C1EBE5642070CC69BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.3MB
SHA256 063dde4d2d9c22e31d7e95bda4c30159fbfab30c8510cea2c5b3030ce3943b92
MD5 d63ae70d0a5ae7bb85bea33940ceac44
SHA1 196d26e9e15cb97d26e2dbea8569e0993d1d7eae
SHA512 a783cf93e66f2d4bbbba8f8a57735f52eb25825a34e4602eb45e50fd6d5be86effab57c8c198d2f0805c26d87c094636910889b2cc16387dc4541da07759f2d0
SSDEEP 24576:UQx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZxLNiXicJFFRGNzj3
TLSH
T15B5523532A869B72E9B8003509795A78F0ADDD38DF161AE393003A1F957CBD78E3512F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.3MB
SHA256 420b92dafce992e8463236075479dcb5ac1aa46bb6b453500633246044dd9332
MD5 59d59a451684f5ebb0c72a8794c839ac
SHA1 18652656a477ef11998bfbdcdf9b31a52ed8be63
SHA512 96f07e96600d51d864ffa7b3f0121e2731c186aea475970aa351f80f4112f18174d3884aefa8b04d73ca3dd808f13593ec13a715696f81e1304cad67ae48366b
SSDEEP 12288:X5A9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T166551261B1C555B1E6B900324E2A6A5EA04CFD384B2254E3F3D82F3E95386D3CF76563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 0305e3ec9b483db92956480a895c5a2b6627b598815992376126ce271bb0f271
MD5 07071f94e22363acae03981fa4670c18
SHA1 7746ae2cbc17a61ddb9084382704487459a296c0
SHA512 0a3b2e25d1f0d7ee21718557dca8659e0571e957863fafc537c060a6d2f489765034bcfebf88e62491818ba4ea4a48f17b34b270549930c465050aa923234123
SSDEEP 24576:S/TAbD+Ome1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+TAGOme1LNiXicJFFRGNzj3
TLSH
T19275E01137C0C135F1B318368A7F9728656DBD715F6881CFE3882A2E5E70AE1AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 56f946592cb008975cb877986bd7e376fed51f88351cb8c745d0e38dfc1f5fbb
MD5 9e359145022b4bb328d12254268d84c0
SHA1 403f77a243be9ff032f609b803a66f576bf83bda
SHA512 5575f5f58625389cedeee02ee836925101d0630d83de193f23c22226bfe85ff1c7e5e9adb0a8ec150c04085f97c5c2ea74a80c813bbd4d3998149fe388310abf
SSDEEP 49152:Tb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnALNiXicJFFRGNzj3:x3q6mjBP7wRGpj3
TLSH
T19ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6fae08910f1b38519a449a3906dc97fa09135c05f70e24db50d9b6796d8e0053
MD5 14addbe1c2624cf9348d9c6fe98189bb
SHA1 1127ea81edc43937d9d0aedf1f56730050b32c7b
SHA512 3e9936579649620ca53e3cfaba667191c826716d26527e1db69c110a2072026ea0f7a553cf936663dd538394ffc139575152ca6cff8f9b837db9c210a5ed9554
SSDEEP 24576:pXYfDtczAr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MtceLNiXicJFFRGNzj3
TLSH
T16175012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 13265e81513d9024398b4b37b1b704ee6a0cd045ef3811c47269bfdccee8546f
MD5 8775fd91229235ae4834f0d24d145f74
SHA1 c34a7aef4f6a23d00d4951513dcb9db39874997d
SHA512 f4590705e8fc4812257185f8fe4f091afcfd0fe1ff7521d282af56a7dbbfdd536ab718cbafef80685ac7e98826443bf60bcc4dc6d756ad3711d18959eeac951d
SSDEEP 24576:V0Le5ji0hmxhrMV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VPji0AzgLNiXicJFFRGNzj3
TLSH
T19A859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9ffa399115c688524e024b4c8fa9fd15ba54057cc741e3bf8bcc74f6d8998664
MD5 27507f3ffd7213af596549a6b77df56b
SHA1 8ad43637ab528667f1a5308205df3d8dfa621df9
SHA512 472becdf5cc639fc0bf60659a9d70603f26b075b2d7989b8c76942084517b0524f9e8e3560e351b14ef68bd5f6522b106c045f8bb7d80801e52aaa7e7bbe813b
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWj6q8wyun/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A/ezSC6vUzPv+HjyELNiXicJFFRGNzj3
TLSH
T14F756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6d91034e95caccd9077eea756a1cb075ac43297f73069e7082d25930da5996fd
MD5 bb35f700db68e8f0c17e075a81bf80ea
SHA1 f453aad5628f684552857214155f6a4690fb70fd
SHA512 998c700490bedb5d8606439a45e6536ad29ccd2f7bbece5502696804f669271ea548810d013a9601aad4d67d6dedaf1161dadd606d9ca1665d6ff86a3670650c
SSDEEP 24576:EVbqPb88hv/l+BO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EVO88hXl+ALNiXicJFFRGNzj3
TLSH
T104559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1fc38501684c005f95ddb93e30c06f5739c552081802207f3f8ff115447f7653
MD5 fff63bb49982fb7b5bb02c5a584f538f
SHA1 391999f856c93238d72eeaff8513bc0ee5df61de
SHA512 b7f4981e822fbe12bf6c9fedb12f36ebeea3cda78fe3949f63bcf68c304449adaf05b267daaf5633439222f4ec9c17c6e47e492c6fcfbf22fcf348359080f1ab
SSDEEP 24576:yGR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XLNiXicJFFRGNzj3
TLSH
T1125523D3468854B1FBFD0039867A5828B5885E2C8A595DE2D2543E5EE13CFEBCF38163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 42bba346db50db4bef34a056654a6feba53ecc9df50ffe9822b6e47ce0199cee
MD5 0b9043e1dab848acf7ea7d81cde82232
SHA1 ed3e3d392e939563df2428b40b30afef4bccaf10
SHA512 c21ca32bfe15d556897f7fbbb840bc637e3c393077a9b8bb232dcc3f6ad4a6aa17d9b5b56ffddd9be1aa205a957fa55187abaf0bcc8b2ac76f626e3106abc876
SSDEEP 24576:5JIUm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5JIUmLNiXicJFFRGNzj3
TLSH
T11075CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 206099149836dbb8c8e7b587aa938e3006548810709504b727ed243aee590cc7
MD5 002cc5b8962e75bebe6d0ba490d4b661
SHA1 32ea0afea48c62bb5da22fa03cdb4ee1afeeb8cf
SHA512 27f3e1fe37d2c2268acad1dbed98c5305b389e0718a8da0a32d492339d30dc72c6c07e0d2e61b4ef8cc5273e92213c080a40cad8d4c420b266b2d3b62752d707
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THo:NQvGAdlCEL8c/WRNw5CX7wRGpj3
TLSH
T100266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 8c604162a4c0999d3163d36d496ab0f604106d64f8640e734402cc0cca384c87
MD5 39298d6c473b10a1707e7475d4f2f48e
SHA1 11c0fdceea6048f1cc69dcd732bd17a26e95492f
SHA512 9614204a45484ea88a39f16599b8572dd7254cff64ee2d837d66054df4e11a532387f496392190a3f771d29af1900763d1fff2ea0554a057feeb6ce56878ab80
SSDEEP 24576:xfewsAjQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tljQLNiXicJFFRGNzj3
TLSH
T17275E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b324dba16632ac4f66cd251acbfec6e7e19d9b52794928497a9d4f3b355e27a1
MD5 3057db885867562a3d4bd053a8bd81f8
SHA1 9251da7b205ed1059498059b01e29766d6834498
SHA512 744bfece447f2ce5b0171ad2afce1f6f8de4a3af6db278c2c93437f694429d9f496a1eeb06fea0b1b48dcd5926fa760f81c5982a8f6f79b17ac905b704cbf186
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHEF9:WUEtQevvqc2W1cpV20I32Y9
TLSH
T1C9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f1bbaf4d7bda615635ea99e80b1a787debe09406b6f4f836c9d947edefc937a9
MD5 957eaa871429615dba2762b3dcf9ca8c
SHA1 32aa63897d04574739fc852fdef07f0973a7d1b3
SHA512 8bf675657035201bc8cf48b13a2c1210979f1373cc3cf7783e984cca9711e824bcbc9c8a7a1551bec4a1385deadfc959196a7e6792c8578e34389c2500a8e031
SSDEEP 49152:MCbRquA/m2yL5zLfFiV+XenmE3/zwLNiXicJFFRGNzj3:loq2Vjnm77wRGpj3
TLSH
T178D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e71b6cd033331e17ae069e24126e845543f47431ca21eb84cbb2629f91e778c8
MD5 c1968a0a85ec5ab3b196669c5c2ad227
SHA1 87a4a69aedc447d6bd31b3d8febedccb06add484
SHA512 60e5be2647de398e3486672ba4b3b43a49ae74bd0fa8defa55ab9ea7785c2dc5460ba982a3b2a023f1155152842a2f15c60324ec6e307e2ba1b9b71e432b0d45
SSDEEP 24576:OAhGL6IFoiwtA5l7S53b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OAM5Foiq5rLNiXicJFFRGNzj3
TLSH
T1D1359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 647f22125ad90d804892c0ce0cd190535ba0db08f4b3a28c2f2e60e60699b80e
MD5 b93ae140c9e62d41e3ea291412af9019
SHA1 92cf2004c2be0eb4e7d209179b90c63afebda1ba
SHA512 f79140f07d5610ce27fc78e74e5eee2c288c9258581c459a763c3a6c3a7aac64226d1313ca10ba20409c061bf68becc54f7239200abc2074d981c1a52447250d
SSDEEP 24576:UwuROWx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UwSOWLNiXicJFFRGNzj3
TLSH
T17765F18632940CF9E9BA41398657C036F7F2BC152A25DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f096ccc5d69f920bf5bf5201084381eccd95a6743d126c847f5b9c9b329c8083
MD5 dffd9db1c8e181547a14e6c448c8d438
SHA1 1f2d8f0f592b434162fb01a40cf5aa39ec4fcba7
SHA512 67a783a131f9a71feacbbc78ee76f749567814698c2a9aa23f1d6fd0444aa40253b8ad90ab0a551af3d1c69e7413027a6972a4596a3c503cb1ea5c9d50384101
SSDEEP 24576:3ZuN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ALNiXicJFFRGNzj3
TLSH
T16955129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 59c380c2a61c75215ef904c7acc0c4db0c716dc6adc5f26e0ffc32d433244973
MD5 688a901fd9c75777000ea2e82eec8997
SHA1 b955d5fb18cad71fab066e98f87d65d4417341a9
SHA512 b94eab0e13fb5e5fa0b7eed10ae58b19d7c227f5750200d18021ca9941f7d040281c4f67c61d015ff4826290c7177e5eb3db07745b3144db193a2bde4dd987f3
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN3q7wRGpj3:qQyiKanX+PNuF9
TLSH
T11F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 30a111c8b3dcee7b0a5e6dcbd581ec3c7ad25c4942a9eb7068a30bebc115437b
MD5 64567fe5d768b03b26dedc6e4ea5d14d
SHA1 81144bd03e112f41706ec86c9f01e46b9aac64c9
SHA512 056a70e3b941b335c85c3abe83bd84b087cea26e75bef0f55f0a3482b883a0e36af74e41fe7bef935c958d0c6ce9dcc038f01ccafbaea6d183b8edc9ace638d8
SSDEEP 98304:pQRQyi36YOcPDLvw2gAf+PN3q7wRGpj3:AQyiKanX+PNuF9
TLSH
T193667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 70ef5fb97f569b143d37eab074e770384722f4b062d755147c58a78e79d44888
MD5 0983ca42756a68ada48b9082b4b4cae5
SHA1 d4194860427f278ddf2dbbccee41e77a28450aec
SHA512 4558c60ef006586784b121988a24ca9a9e486af8963d51134e649e2f8f1dfb812045d8665eded95ba9b921dd86b700d06cab7b72983d71e7b4bbd93adf5585b5
SSDEEP 49152:R68Qg55nhkeWu7PNU3/gLNiXicJFFRGNzj3:PthTRc/g7wRGpj3
TLSH
T167B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 35a1781646d24b124087064d23d903d09402e6c7b428fb0615617661e50dbe6d
MD5 4f569ad2a715356993aed7b46ae6243f
SHA1 72f24ca58ef2772e4487353dd376a2c29f1687ee
SHA512 8364c278672252fb7dade51d667ec1b18593a1ee28e51225757c989444b6428add41b9ae2b82c2fa88ca927c7ffcd663d745bc08ef521ec6cd879798e9404330
SSDEEP 98304:Oy5112gYy5azzVvU69nLKnhZR7wRGpj3:/LIHRWhXF9
TLSH
T1E2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7164be88c27f39bec4aaee7713fdcb396d9bc44627f722d6b14147fe6d9b2a56
MD5 1fc487b58633a0bb63bfb4ba85095458
SHA1 ebb081a16ba3e9eccf1445ada41136f588c7dac5
SHA512 8f6c05fff2306a7ca0717ea1a0931388bcf5b79dfe64e5b0eae8baf43d5dc9c8b19e89d250f16e20af4481f5eafad0216edfec5bd8fe567562636d950910a1b1
SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl7LNiXicJFFRGNzj3:mu6JmIxd2d77wRGpj3
TLSH
T159D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dcc6f625c3271f2c68bc84b7a7eea16a397e936c87085c11b3ec695156c0c8a8
MD5 3e7099d95018727fc84630ca09fe0b80
SHA1 85ae5865998330108f8ede0c7fc16cbba213dbbd
SHA512 0cfa743dc8ac387a4bb6e3942610c3484d49db2ed92fe0dde26719ab9faddba0b0c8c889484b6fa688c960347e4e0fd294a7fa392ce7e6f17714779573b5b575
SSDEEP 49152:r1hpsNoJpF1A67U44CwH7R4xGLNiXicJFFRGNzj3:rmifPqR77wRGpj3
TLSH
T1B4B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d1a47caa38383150127613cf93fe786a4d5d2cd0c670fc33bcbd7d9af04d56ff
MD5 c947af4c3c3f64af7ca09dabb4a86a61
SHA1 901bec50d6a12c00534c5ba30aa8ee842d8457d3
SHA512 02d27034c3e72b9f5a5b13a2800f5730ce3035a83003b2933381257f4a592972724ea12cf23d8cc972125e865f8562769335f111462f21211df028190a3cdc0b
SSDEEP 49152:6SuZQIY0Be2KkRVtOnks6NMHqNLNiXicJFFRGNzj3:k5dKqi61N7wRGpj3
TLSH
T18DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1b0e0549ed53e43651aa0f46295d6ff71f70cc1257bf191db88de34f2b84c892
MD5 738d6d6257eb9ef990f08615498a40b3
SHA1 40b02fc380932f35666e6d1db98fd3d9c6fb0f23
SHA512 e6b82f1a4abcf0dd42664810e809a115da965a2c6272d7b2c13a64abbf45af92771d979445ca15a4d3dd93719a27c70fbe08715aeb2f7e499002d6dd98ef6f21
SSDEEP 49152:QhtSn8EApI0figjgiDn0AP5wyLNiXicJFFRGNzj3:BX2iWphf7wRGpj3
TLSH
T11695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 732807a41ae01216951d412fb228dd63f6c77d6ec8f6ecae2f2c565d00471e55
MD5 a176d70fb7ec22e59ddc4c7830cf7f43
SHA1 dc82b8dc467a5c4cd394d6cfffbf24eaddfa78b2
SHA512 7ecff54c565e41c6830babcc39537063c42562c5653b44928ed5071b9c1c86661380b28d1726c2acf732b6e285f8dfbba15af4238d9a23cac156ff4fc2716884
SSDEEP 12288:+liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1085523D3558955B1EAFC0039C6765428F5881E2DEB5618E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1da93c4f410ccbc0f54ab6d3391c913002ed656686b2f00de6a18cf2fffd04a9
MD5 8430cf19f0a074e712c056f4de217b30
SHA1 dffec5b06d13a428ef8e293d98fe8c5bbb98e5b5
SHA512 6bf1981f3b8057f16f83fad39cfe5e5152fc79737582a5bc67e31a3f1babff7224f841ee84867db51c5ae978e1f3ea517ddd53aaba7cdacfd4e1b1df42683a58
SSDEEP 12288:5KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15D5523D3558955B1EABC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5edd7cf262d1607f55c7c2cf17c5f52066ac03ec78613b499c2aaaf7b9ce109a
MD5 2d20ccaf4a25ad612aaacfac26ac1ef5
SHA1 f89cb0b90670a805e4083db3f4d066463e49bba2
SHA512 ce9e3bf827037f4d7e09a0adc09df9865338c1de663718d9e83777d1c73bd580acf20367e23a4ed597a8e65105b6fc3426c5ea548fddc5cdf029d7b26bc20eeb
SSDEEP 12288:W0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:We/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17A5523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d6d8c04d1b816aa813902867e46a7a8c007c227ca31fd63645f29c6fcf3a223e
MD5 64fdfd732d7eb7a875fad526b84f5e2f
SHA1 46dfa14103352e40d297208366f6bd04727ba6df
SHA512 46c64c53b32f6f1539070bf38f0f6d54189e8b3e9803c60cedb44a51454c00b3c6530de5802e1274897e7aff28da8052d83f4914c5af32fca29e9b2949fd8d41
SSDEEP 12288:7VPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T148552392168900E1E9FD803DC6764424F2A47D6CD7365AEBD3003D1E5A34FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 926c43f4f92aa2aee0b146b955bd84cac21de865caa841120aac359ba2c8dcb8
MD5 c9e17be91e45e7b48e8f6945a7b7554f
SHA1 d333092b177ccca865d1be50b39ac7be9d5b948d
SHA512 0c3dffb275cd2b7a84c03ab745ae060b9f1bc4167cdfef4f171b954cddf579b50e86ca52d36e7d5e6686b3dbce894c95a42de9870d2af5b863f1dbf08eb5f0b5
SSDEEP 12288:83iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C5523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e043e1ed64799268dad54462d36e509aa772990692e57eacaaf704bfe1c78939
MD5 2403c5d071751b73bf956cf815acfa0a
SHA1 d33574d094c6d95481ccd1a616cd13a2599fc816
SHA512 df6ecf664400ca6056890de54c091b92c0d07aab3c0c7c138f8f9f0ec297407f5536b06859506b99576990d97b329736dfff5381902698dccdab6aeab7ac5b24
SSDEEP 12288:8+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19F5523D3558955B1EABC0039C6764428F5881E2DEB5619E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 901b4e727849cb49194726c1015bb902eeebf1100c7b86c7d9cc4ddca807b1f7
MD5 194bc156a7bc5f8b3893bad0b5c49aa9
SHA1 05c6efc6984941f5b660e55513fe2c3155b80114
SHA512 498c0ff886a8ded5fbe06e553318d9affc855dd4948f6f3fc50d4938262415d0265930124fb40c24fd4594661fea2da06985112c50710340e33cda7a907038d7
SSDEEP 12288:ZSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CF5523D3548955B1EABC0039C6354428F5881E2DEB5A59E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 94e020b53274331a48f71dfb347a8a856d39202a7352c629c2374985d3217219
MD5 e7b4d26d7aaa3d4a027e0421860a82f2
SHA1 cf86717b749b5583a8816840697e11e1dfe2e3e9
SHA512 daf43d52431aa54847b73dc07a1979845adae98c91040f321d804dd735ca9a01ab8f8bfedcec1fee378fb7ead2c5570d2b38f57677ce2732404ce46edc414638
SSDEEP 24576:KZM3zFVSOs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KZM3zf4LNiXicJFFRGNzj3
TLSH
T19E750295B39018F4ECB7813EC9258815E2B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8a0472c7594be1e06e03e3b90588dfd46b9ac9709aaed6b267379c15cc8b6d39
MD5 2087582e62bb43fe1d2daed626bdfc64
SHA1 0f6767bde5788725fdd232f2531c0029b8b83ffb
SHA512 89673579a12d736819bdd5025f63aa382374aa05bcdd1cbaf1e702853ae4049f713c0269e832abd1872b34baee2666a0a94a6cdaa6cccb70ce5aac9a315ddb6c
SSDEEP 12288:IxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1165523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0e597bdf3c8f67d167340e9fec4c452bf7cc848a612955b16d6d9beb2a92179e
MD5 11c1b38df6124dcb80364edea3758bcf
SHA1 c2e83bf19e69c7d45ca4556ea845b689ba952339
SHA512 1b7ea188dd1e87bead2214ab8d19b787e4ca2faffcf8b7c0f5c6348bad4e1b462a82d1f73ce2cbb8c53cca7a0ad58bc81a959a421fba6fafc4369c7cefaa962c
SSDEEP 12288:mdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D3548955B1EABC0039C6764428F5881E2DEB5659E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 543e0577567347bce65589d46d5810c06fa6a2dec790f625a33f4babd333ae0d
MD5 44aa23ded5b0dd96e11e370b0633ba79
SHA1 08e0858beed5982243453d725ba54fbb5c98666e
SHA512 e2f121a77c4018c86740d958e7de38ce533756d623b1ffa55010177831584421efe60be74d8fa98de593940abfee6bf5ab2110af8169b993c624277b39ebdc8e
SSDEEP 24576:HzyA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HfLNiXicJFFRGNzj3
TLSH
T18A650247629530F9D17A8138C9620911F3B57C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ece728b5376a779776d73a8b026d299c3c1f3c09037c063d8e36ae346a67656f
MD5 d82e553963c9ff6e2cea8ad288cbcaf4
SHA1 ffe6f37fc291362942f3edf887da28eab4e06388
SHA512 3721393c593ae86698281f8a774dd2cba5a8324f1a2e82966d2dc62aa21c1c551d329167fa559d532af8b3f8ac8f1e769b25a9d4f369a005671ea6cfc72bca11
SSDEEP 12288:OxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C05523D3558955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 241f45cb18e50fc06e75f090ea4bd73904833f9e9a9420cd999b53ced7e1d5d5
MD5 bedbc7dbffb880e03360d8d6706fe96f
SHA1 4bb0d889c41af6950d7918f4e5905ac40ab5b831
SHA512 574b27ce2d31f85f33412cae7e6e25818ba1941a97af69a4564c3b9f7892a6bd1f355bddb27ef05784fa8ec21eae93d57d317ee5e092744df059b48b209a88d0
SSDEEP 12288:RxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:R9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A85523D3558955B1EAFC003986764428F5881E2DEB5619E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ab358365fa3f91daf8679c046ea2a65260bf79cdd1affe02e88d7c25bf823c97
MD5 46088bc72af431ab273ca56c0ee33ad3
SHA1 4f13a3e816cac1f2b3f1faa24318f1a73746246e
SHA512 f5ddff21eaab7aa5a3429707350c958b9ce5703634556eba1144be2f44f615e10f6fc64006e0e7ed1f90b352de916beefe98fb1edd711367908881bf81d80bc2
SSDEEP 24576:JzyA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JfLNiXicJFFRGNzj3
TLSH
T11A650247629530F9D17A8138C9620911F3B57C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 e9596e6bd530b3b2cf2229579f0781c4e5c27e33e5b452a1839d9ecac7f6555e
MD5 54d181aec3dc53b52101e319c48a17de
SHA1 e333aa8290c1641bdf2171d33718b70946eda72b
SHA512 26b52b1a80c5970dac11a30cf5600326cf7efdaf044347dc45042645490db61f53343e45d1f9d7d2e4071440f107e1d6cd3f506ba386fab12f29999f25c8b7b0
SSDEEP 24576:KT8aLl3z0zDu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KT7LljnLNiXicJFFRGNzj3
TLSH
T1ED7502A5B39018F4EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7aa5eb886d14341e10cabd8f797229a55b7f147a266d708b71f21d7b92d82d57
MD5 9014cd7b8b16cefe30d7435d7a93ec13
SHA1 f53ee50777154f3f03baaa54a4f35e64db92c905
SHA512 8d8b1015211cf1388670bede706f2cb95be3375e04c5778c9e1a8372ad4fdb62831a05762a9d842c93e1fd742b752596fb852a930d2382e3fce3c63e1259cb0c
SSDEEP 24576:xfwvzk9RX6wkyAIx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wMnYIxLNiXicJFFRGNzj3
TLSH
T19285D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b7a13162b0218a2c089320ac91d4bc42ea6fc832afc1a7c79793fa6525cc2d69
MD5 fb4477a8fb99d96e4d060c8b57b5556b
SHA1 d3db2de12b90236a0d24cc4b1bfd18e50542cfde
SHA512 e5cdd7989cf75e5f78221812a383ebc99a0a935a890ebf0ae761e84a97630198b9d3abe3da4dce7cf59124e7db96d2b0c00a47fff6b1629ed9fdead54f0505e6
SSDEEP 49152:wYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0SLNiXicJFFRGN:PySzPK7wRGpj3
TLSH
T12E066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7a23e106b4491925a854fe0c5d25587af4072e180d252ef481439d0c761e0dd8
MD5 970e87e1e8dc2f9b1544e7297691f436
SHA1 535055fc966c9a770261a458fe0d890111f114f4
SHA512 0a6fb7beafc3ed92e0f461a17a86ee3a3734e6a6dbe6d35fe5c88388189848b25736583962d41a9e663922e60b7d99b6128505f5943e1231ff96535e53fd4c59
SSDEEP 24576:Q47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Q47JUQjqirIhCnDHUPfF/CLNiXicJFFS
TLSH
T1F865AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d3b963adba7fbfdb1f45de511e7c9b5bec12969c274add9878da2df22c48fbbb
MD5 0d1a9e2a383ebb429dabcf55c0ee0cca
SHA1 0e757a9f5ff49b26c6b79596d88594c2aad487c9
SHA512 f693dc15f443bf1c06144666333b225332f79d11b38a2c4c2dddeebcb9876b0d6f6c66bcbbd052ca6a9fbc5ef65b9262f0da0fbea6818ddf7459dc0c2e38e6cc
SSDEEP 12288:OpsfhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12C65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92C0F93E1F39AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 ba308325c9f7d036079adb4850fb5229a85e909e26cbf6b50bc8a37a986e7c9d
MD5 481c88a2b544ac582742801449b384a9
SHA1 af607cadbf85bc1f849ac60a0a7269c16985b855
SHA512 009bc46318082fdb4c104931bc1e26e20336efece5c28af918b3d4e39edadd274c2f101fb517c49879b576d2dc80a01fe9c5da3acc7cccf2f671234b82cad108
TLSH
T103C0120A01AE50B90BA60088A5072FA010967A92AB468E20F3306B06B8F04020C5FC1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp4099.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp4099.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp5B86.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp5B86.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

a1d59555e62f061e.bin

Path C:\Users\Admin\AppData\Roaming\a1d59555e62f061e.bin
Size 12KB
SHA256 93f8099a777f251f356b0f6ac36ded8b6eaf443606b0ad7af97e25661f73a73d
MD5 e8ce73a86663490e16009e9bfbfe213d
SHA1 c4cc38ec588d26364d038e141b6ec8fdbeb938ad
SHA512 43f73dbcc204f498b04be462181cf27538db936484c0a9f71a44eec97b757198eaa09947b37482062bca212f21eb02b995c36203ced09f1c1caf40098fdd2ee1
SSDEEP 384:/aIRBt064rDsD/wUejE6hAO/VduejJjwyoETqnvN:/aIRBtaUDwhE62O/VdbjNJTS
TLSH
T19B42D01ED0153B93037FF3E83A60C9549399BA5475DA57C65BA7A5F1C033283A278C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a21821e4b16063748da16106ac33a919f338a739b2b31a9f8b7b8e37b759aaba
MD5 a9c93d3ccf703853d97d2b81526f278e
SHA1 6284c748b7353893c4381e60c2ca3099b1033161
SHA512 b5e955294a9bf14ece5b369a68072450f72e3b65e71d98ad75bd98b009d5b03afabf2b29df1edfbcc7a29e6df35daf2437b6427e78fd821c8906d70cad9a14b1
SSDEEP 12288:5F7piJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:H1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E3552393468C59B1FAFD0039867A8434B54D7E2C9F1598E3E2043A5EA138FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a7e2f1e0ee5ca2ffc7fdb6ab0f163531740011dcfa26901a5fdaf0c01e11e57e
MD5 84b8b4900d9f6c110b070ec04262012e
SHA1 3afff47aa32160a01522622aa7a5290c9a5130a1
SHA512 2fa6350bf6dfd8b0888b568954575feecaa7082316a825df4af909676a4c094c50982b07b44ef08d708bb570e2d29791f5c9cfee5687f9debfe8f959608f4b35
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ugb4mBIBhGFcLNiXicJFFRGNzj3
TLSH
T1E765AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 493dcf224f6932b72c3f0856a2d563b2bac96cc3c1acc81e78d7ca6f1655644d
MD5 10c35584e13dd6c0e9992ad70188a460
SHA1 5817b6cb5b08e85ad21cb2ad507e243db669ee86
SHA512 e3bf9c4709dae9b6fd23858054ed6b50dcc3f08991954c9b13bae43e1975825904ca641e8e5f918a778ac9478a1c8509839347a9798958b27980088c71e09b47
SSDEEP 24576:6G88u8FpJqH1vzria7/ms/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:B7ZFPqVya7/vLNiXicJFFRGNzj3
TLSH
T15585F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 96a3e37b6d6ac17aedb81c425598f252570b8d21cac0cbea430d58d5266a1c67
MD5 0951576e06ed7d04d0dad5295cf8c989
SHA1 941b30b53e4adf80095e7ac14a72508f2f53924f
SHA512 19e4c4549b000dbba5821a2c0d7b58fc82e844768a9cc2ea8a47916b363aedd086e87bce3927b1d2957d3c9d09233f6105355d16c4e312fb0d40f1c6db4bdca1
SSDEEP 24576:gPUr+NQ4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gJQ4LNiXicJFFRGNzj3
TLSH
T10C65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7621510cadb276997aa583b85b46634f7bbe11e425f7dc31e5128a8666c109e2
MD5 2c773ebe335c22a77e92172b57c74db0
SHA1 5869982d949f54fa682b93ab60f05cabdfcd2cf8
SHA512 03a44850089d211ab270e3272a059368a7e2e9674d2bea92fd3bafe84d04300f7e6ff7247b46d49a2a983106b72de6bd2ea48057e98663bb97a0f56d3d4f58ec
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjILNiXicJFFRGNzj3:0G05lO43bZ7wRGpj3
TLSH
T1DDD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 adb67fb2f5141993f3bbc0f9ce495a6eee8b0223d106609feb9c2674563f08b0
MD5 eb75841daedb0628daa7c8646acd7fca
SHA1 95542a207bbe363ecf861a64dc5b2564d76a146a
SHA512 10c0d939d24085bb1c77f5dff2bb1e535506c2165dae84d7550af448cd082cb6c9fcf0f546d649653917a92066c7d7a85186d09aec70d002505ae05264bb6669
SSDEEP 24576:Efa5POZ3dpyWVM50JicR2hG0lasx2+47eidnS/TwSfVcYG3K/cJHlnFR+IGNe8jg:ca5POZ3lJt2pasx2+mgLNiXicJFFRGNf
TLSH
T15665BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 27921ad98676c6d93abbac71ce282c0f5fad412e4be547fed5e67071b6a12fef
MD5 6c20b62768d34588ac76c421898d33db
SHA1 a7687e6f82b1e971c19909f6355a01ba3be2951b
SHA512 f6a5763af45c8b86ee3b61bbb022b8543e0e1c1987e41ebf37367d565630918b33a87526c2923537a94cabf8f97d609beda713960f0d0cc9ee0f98cf560b73e6
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7FkE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DNc/zEOVHFPLNiXicJFFRGNzj3
TLSH
T13B858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f9f7e3141c0df4a3f4c77a3d0e8d5b2372940a3b68b98a2ced41242da8089cb3
MD5 499ed5b56225597e31ec8191413ec153
SHA1 f2e43fc3b423e65455f4e1974616f738e79c4f15
SHA512 71ba93a90eeeefb3b323f96fc1395c2edf99b6209fac4d9dad599df5deb0382ed29c7804351d8ec3ff930c29581d2a0abb4e3714fe875dfbc70f6bd8da9e456f
SSDEEP 24576:uzkNvNnaFeYhJNtmZBm3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uzMwBtOm3LNiXicJFFRGNzj3
TLSH
T19255AF6EA6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0d10d8ca651278b6c995b9ddc821fdd15c06b9d3ef3ab472b8ba0419c1cbe18d
MD5 0539317a7fa34421672aa8f529d5f4b6
SHA1 da75d48edd3d7cf41e649707d01bf1f8b1da9c68
SHA512 6361c5780776592b3a530310e7afb5e60fbeb2b607b5592ca6d645dbc30560d7875b0845add71cf70b1215c400a3603475d6f34a23922a13fd74b7663c544e7a
SSDEEP 24576:/D3FHshBIYQgAJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/DVHeBIAAJLNiXicJFFRGNzj3
TLSH
T1E175E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-182-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/688-399-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/688-402-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/688-403-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/688-181-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/688-188-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/984-225-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/984-215-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/984-216-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/984-222-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/984-228-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1008-8-0x0000000002690000-0x00000000026F6000-memory.dmp

Download

memory/1008-6-0x0000000002690000-0x00000000026F6000-memory.dmp

Download

memory/1008-3-0x0000000002690000-0x00000000026F6000-memory.dmp

Download

memory/1008-0-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/1008-55-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/1076-404-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1076-231-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1076-232-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1076-238-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1080-542-0x00000000024C0000-0x0000000002526000-memory.dmp

Download

memory/1080-535-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/1080-614-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/1080-536-0x00000000024C0000-0x0000000002526000-memory.dmp

Download

memory/1080-599-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/1764-589-0x000002DF49080000-0x000002DF4930B000-memory.dmp

Download

memory/2412-204-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2412-194-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2412-210-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2412-400-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3476-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3476-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3476-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3476-214-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3476-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3516-601-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3516-387-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3516-170-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3516-169-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3516-602-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3516-176-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4612-312-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4612-196-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4612-202-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4612-145-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4640-160-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/4640-165-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/4640-385-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4640-159-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4816-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4816-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4816-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4816-193-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4884-49-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4884-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4884-37-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4884-38-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4884-45-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/5340-147-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5340-368-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5340-149-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5340-155-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download