2eaef8f383aac0b2b2d7824d6fc60699fd19c4dd628130ad36e501bb88a83695

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.6MB
Sample260804-s3k7cs1xd1
SHA256 2eaef8f383aac0b2b2d7824d6fc60699fd19c4dd628130ad36e501bb88a83695
MD5 5f73286e851421cc2321e78b748fdafe
SHA1 e27d16705c2cd9631a91418b9ed4470479c898b8
SHA512 1db266d083918fe7f053a5316799d0b8ccaac3e276582b6664420d0350fc01b275be3bb2592fa98151783933b1c3584482e65adbe78096ed3ca7703ea53ca55a
SSDEEP 24576:zLv5qMr1nDy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n5qMOLNiXicJFFRGNzj3
TLSH
T14975E11077D08036F5B324764A7E8669956DBD715F2181CFB3C02A2E9E70BD1EA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
3296	elevation_service.exe
1720	elevation_service.exe
3300	maintenanceservice.exe
4092	OSE.EXE
4152	PerceptionSimulationService.exe
6124	perfhost.exe
1952	ReFsDedupSvc.exe
4976	SensorDataService.exe
5136	ssh-agent.exe
3128	AgentService.exe
3448	SearchIndexer.exe
4144	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8256de4c83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\RepairConnect.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000413b476b2724dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001713426d2724dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad2fcb6b2724dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006eee676c2724dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000483676d2724dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4932	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
4932	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
4932	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
4932	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
4932	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
4932	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
4932	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
4932	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
4932	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
4932	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4932	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	3296	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3128	AgentService.exe
Token: 33	3448	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3296	elevation_service.exe
Token: SeDebugPrivilege	1720	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3444	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 3444	4932	2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe	91
PID 3448 wrote to memory of 4884	3448	SearchIndexer.exe	102
PID 3448 wrote to memory of 2820	3448	SearchIndexer.exe	103
PID 3448 wrote to memory of 5484	3448	SearchIndexer.exe	104
PID 3448 wrote to memory of 3220	3448	SearchIndexer.exe	105
PID 3444 wrote to memory of 4144	3444	AdobeARM.exe	110
PID 3448 wrote to memory of 4928	3448	SearchIndexer.exe	111
PID 3448 wrote to memory of 4332	3448	SearchIndexer.exe	112
PID 3448 wrote to memory of 2372	3448	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_5f73286e851421cc2321e78b748fdafe_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3300

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4092

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6124

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4976

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5136

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2700 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2700 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 30591c58423b2d5d391701bc78f8a69a4f840e95ff8019303a8a60cfdd22b7a0
MD5 5c48ec0c90d79baa9153759bdfd4919b
SHA1 52df5705921ba94b08a40e6c35180dcfe0a28b53
SHA512 ee89f649fa78a7fa22831b3a14c456d95b465aa6703ad56fb2f25dce2c04ca349cc9c5dc43d37c4b8da644978edd9b49767f2bb997f50abd7e5a4d5d407ebe15
SSDEEP 49152:kTfiUEWo6zuEz439S99akTBc4O8b8ITDnlT4NvJrLNiXicJFFRGNzj3:kTfiG/nzl90f7wRGpj3
TLSH
T181E5E526A2C8C1EBE5642070CC69BBF900546D78DBA2CDD7BD447E16B9307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.3MB
SHA256 4e9f37ba71fc3f472cfa9369298367a96f798118e55611db99394b51343db89e
MD5 0c5cd6dbc5bdc248bd5efc309724b995
SHA1 837b5062e66b6cc2d5df7f6dd21d82ca8864404a
SHA512 a6f321215b10685046311865b69636f5b9e6f4d7037caa2f9200995958d11a335c3ba0690d48a4dc5f320ddcd9e41450b2e421c0ee21b32f5b15a323fe1e26c8
SSDEEP 24576:qQh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bhLNiXicJFFRGNzj3
TLSH
T1715523532A869B72E9B8003509795A78F0ADDD38DF161AE393003A1F957CBD78E3512F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 79d23d2fe8f2cd01666fd00beed0a20f86a870c858e654fb5318f8d8eba0decc
MD5 f649efb1a50ad79480ec238d054f2b83
SHA1 c87068bffd24b0f7af8b7850d54778aa451a7fd4
SHA512 fa980311e469fb8a56b6963d47de716b4b08e811a53e89e550214228ab54610f11410e7d57a8c2f9dd019b9be5e376f4514ea6d27517b14a1a7fa64f49f17529
SSDEEP 24576:3/TAbD+Omet/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PTAGOmetLNiXicJFFRGNzj3
TLSH
T14275E01137C0C135F1B318368A7F9728656DBD715F6881CFE3882A2E5E70AE1AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ebd2166b02edbc3afa7e264376ef94e45362ba729312ffeec044226016e80d40
MD5 83a3b89b85b50677557058fe8b003064
SHA1 0b615a2b8efb953519b402f1b3c18e451d659032
SHA512 b96b7c796bdc363195d0cd9242229b9d68cf6bbe9904adf79ddb7c1dc4465cc23d0bde6502144d11877b73f8e0ca073b78cdfceff07669012e62db98373089f1
SSDEEP 49152:Zb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnALNiXicJFFRGNzj3:v3q6mjBT7wRGpj3
TLSH
T189D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 133faa925b842151129fc5e5efd924b98cbc50df562b955fd0ddb4c3bb71fcfa
MD5 24bfd5f3382f1d51a20087e2c5457d74
SHA1 9501eaa6bf8d8cf25b2a2b7a9667b8aa52db6c12
SHA512 fcbecf7415bfa405aec65130165812afd8f2debf890b04ceda31d687b7830b8b82580b842cf4d08f7595f88e2621fdcfabb7426ad570406d1ccb9c0d66aa63b9
SSDEEP 24576:tXYfDtczAf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4tcOLNiXicJFFRGNzj3
TLSH
T12875012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 daa57777c65750da9e3e67cae982acb0f452fc31f96751d293b9b3688a13e97e
MD5 83838572c148d6b368dde6147eed1b55
SHA1 00fd3b277f4517c0f3351992427e94f05fccf606
SHA512 82d4b7670890a38379c3d47681f5d701c8ce138161db16ce3b78051ce0217dc24f163d9b84d0f4ab6ac687f9cb7705a6de3125d5364297977a391dbf735c96bb
SSDEEP 24576:Y0Le5ji0hmxhrMM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YPji0AzdLNiXicJFFRGNzj3
TLSH
T1E6859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 86828c79fa26d5cad6618af7e569a5b1e57892696668ba4d37cd98b4533359a7
MD5 e6e2035afc7c8801633af5934cb34e91
SHA1 56e658e102abf208fd87e63d6d518ad3c2e8a037
SHA512 aa6b1a2450bf06b550ead14df65146b1d6d64f76ffea5b4ca4d01c7662517381dad3a05e273c1214f8201beb3c4be12c0e29c7b8a67ecb284d1a01c3b185ce66
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWj6q8wyu+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:G/ezSC6vUzPv+Hjy5LNiXicJFFRGNzj3
TLSH
T1F0756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9a61b3816ab8a8bbcb7dea0dd41a188ee14c5ee4b1daca339938063a0872123e
MD5 153eb6cd9437bc44f0d29a4932a6f4a0
SHA1 dbba1a79b5d1b1c60e4be6fbbd4251254d03de97
SHA512 f8a6bfc1ee847a0445aa539fb2afd186b7d064b55bdd15190818699f44b8b4c758aa9a704943251e89dbed2a463f67090c358f87e383472896582003a0c5fcb0
SSDEEP 24576:KVbqPb88hv/l+Bb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KVO88hXl+9LNiXicJFFRGNzj3
TLSH
T15C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0afda34981e6fbd1943cd11504ff71cf7b8e02f9166faf7f21df22fb678c0e40
MD5 8d3458e2c0a8843edfa03104c3b11346
SHA1 e2738a7ad94b503fb21f887726f0ba7f2093d93d
SHA512 ac2cd0e8692e99f97e0365ccbed35c3f07456ade752489b79e3af9ca9f626840b911b1652154ea370a312c78c7a3d0430d9b663a45f507f6ef8e81b520aeec39
SSDEEP 24576:yGg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uLNiXicJFFRGNzj3
TLSH
T13A5523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 cdfdbed67fd5674d80c5d645e4acd5d803904175edac0ee00934ee92b6e11860
MD5 f16c244978914ea2a1ce495eb9218c5b
SHA1 85880b477d5f75a9e2f9e803336c0fbe51c853a7
SHA512 de0c055db32af67da297ad792c0f16b589358e5eb1723d1b7820628b198285fb005b22f4d4b2d9ff61440e6f81846a9d0e654ea67635211b104028587771fbcb
SSDEEP 24576:0JIUT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0JIUTLNiXicJFFRGNzj3
TLSH
T11575CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 82e153ba9bbffdd159cdcfdedf6cd76f8fd3ec0dd59ecf0050696859188b1010
MD5 d8d40d218a5c8cf211e6ec292fd397d4
SHA1 31338508123c22481a8127edfc8e3ded2c08efa6
SHA512 ddfa340fa8bb2ebdb2b4a0631dec552945e286da3fcf4ba7262bcb9b152a3aaabe712b601b26fabe202ffc6ec993f5e5794f99df3b6b80e2d5ca855bee7853b8
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THH:1QvGAdlCEL8c/WRNw5Cu7wRGpj3
TLSH
T1FA266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 794bbd5cfeece404229b5df47d00cfffdd0d4801ec44ede76e0ada9b7577e51d
MD5 7240913a19adf0bd1a9e4595a158a519
SHA1 ea4a972b25463570badf11fc0b93a4d8aef3e8d5
SHA512 601905f39b7128918d79125e3cea71700649d96cbd9b7038a97b9fe5a177616b8dbf819d376de112a7a80064edea1576586e3b41516eab0c92ef28bc0159c309
SSDEEP 24576:NfewsAjN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RljNLNiXicJFFRGNzj3
TLSH
T12E75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ae01561ed301a00d64f4c725897e61905fe1228fc745b948e787ef88ee5301b2
MD5 d03cca983310ad44d137a15fd55038aa
SHA1 f1c5ab96b9700fa6c281d263cae4f4a758dfca5d
SHA512 6a88fc4044f1780dee26920a4a1acdf8cb21b01afd6a71c211923d68f4b621d88abc5036ae79e4a565d53d908e9daab2232d81408452b67f6b4ff21abf3f3a0c
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHJF9:oUEtQevvqc2W1cpV20I32P9
TLSH
T196474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b0909749ae6b76e27ead02169f956fd12d010415c3d3cf66c7492966b2d82a46
MD5 b1bf515477cac32bee7f2b1c6b12db37
SHA1 091c9d98651f0d15e73834ce6a828726625dfd45
SHA512 983bd8618a7ea5d3f8d04c1ea4ec01fe5bac15c36992c1a395f30e0419d2973eb16227367f26dd9e56186a2822aa51f093ed160b73b67f5780b8ea73adcf3f35
SSDEEP 49152:lCbRquA/m2yL5zLfFiV+XenmE3/ztLNiXicJFFRGNzj3:yoq2Vjnma7wRGpj3
TLSH
T11FD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3248890bd1f05ff20ecad71c75b0a58a2848cb634798ec4521d1afc4fca0168a
MD5 71e685f6a626cc1bae6ffbcabf36ddd0
SHA1 b46fab009f0dc96b358e9bb434ac25a261f9a245
SHA512 9ec015e7167f319568b27782ae3555df1e0c06d00c5843a08de48220a08ae8873d89344dd28af133fb6db09ac8badbef6b1b379638f695184ece50199428ec6b
SSDEEP 24576:KAhGL6IFoiwtA5l7S536/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KAM5Foiq5KLNiXicJFFRGNzj3
TLSH
T141359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 6f5232a7550377a1084cd78bc620f0d21efbbe59185c1f8395562ca16b701e1a
MD5 e80e925f93007ef36c7452211501ba88
SHA1 aa502048de7f4b47e5e031ffa8e7584cdb0e4592
SHA512 52eba5a7da74fd9b7cc19f4d45a6d6323e79e26e047155de5df33cb8cec9fa5e5bb6e0c091a1cd97287aa231cd97ec1643f003233ababb35c91e530c76cac2cd
SSDEEP 24576:kwuROWZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kwSOWLNiXicJFFRGNzj3
TLSH
T10765F18632940CF9E9BA41398657C036F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8bee8ff8f418f41259293a98ceee848300d4e869c030cc73fb034ff5e634ff6a
MD5 d3fa1b8c8ee67867ca98bfd4bea5b5e7
SHA1 b0087fa5756179f386b15fcbf121fa08b7fa8f99
SHA512 3040b72f2210128610a4863982c398a940a2c84608b2b1cc509b5ac54612c129f387b431583d6dc372ebc325df3af351cab22c9ffa8e70beac319c6ef69b2394
SSDEEP 24576:QZuk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+LNiXicJFFRGNzj3
TLSH
T1AC55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 22736f207c2bd12b5ee1cf3fbe7dccd27263ca395f65bf9959f024cbeef35184
MD5 31c4b68b29457ae3a4a2afcfa3c58086
SHA1 5d370b9aa564bc135b637478342c0f96e3b761f0
SHA512 8869165aaba5d206e88c5353f0f24740bd555349956d6fc0b5c419d76a2a2d1c5497a204ee3c8ff4ab70cd8fef423f1868423cd6faab545beef198ecf52569c5
SSDEEP 98304:VQRQyi36YOcPDLvw2gAf+PN3f7wRGpj3:sQyiKanX+PNzF9
TLSH
T120667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ce8ae9304f0d46c77a1b32888dc8d89811e90be1df5c844da09e7baf21ffad6d
MD5 4526c782943b0c72031a2bffad863e9e
SHA1 4ed3767284738913b582887f3505dacdc2df02c1
SHA512 0cba047f435f0bc1d3008cb7096f22d193ab00a642e675a7e4c9588c49f855a86d64e457b60416d291b2d80ae9b59c9b2d8f7a65eb1b7377ef7e4a84e8c36ef6
SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3f7wRGpj3:vQyiKanX+PNzF9
TLSH
T12A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 58b963c7605fb8beab4e8de2d49cda11b28caeec1cb77552064991b5da3752e7
MD5 71edb79bd7fbc9e3ebf40c9395623c7d
SHA1 b4d8b3342b4d964f5e186ecda026f83ff8a6a2da
SHA512 d6e0d60f156c915b2038d3c5efab747199280b5dd0208316a459f1d8ccf878164df45279f76289ded6f4b18e602aabda81494d44207f05e0add8d8bc637882fe
SSDEEP 49152:568Qg55nhkeWu7PNU3/dLNiXicJFFRGNzj3:HthTRc/d7wRGpj3
TLSH
T1DCB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ee1d129d9f8743c0ee4497df1091153890cd7738a6d44617ff2b51cd8283643d
MD5 b57708813807cfaec6e3d269ad06f8ee
SHA1 eabeff4f7fb24f503453827aaadce05e5a925ea8
SHA512 f4182248027f3f9cbcd01e9aa5a22ad25586d26f05f3ff9db85e489d9259326321dc14b88b81a9586607fc5c6517a109a72c12dcc74bb96c0d4fc59531e73e04
SSDEEP 98304:7y5112gYy5azzVvU69nLKnhZg7wRGpj3:WLIHRWhGF9
TLSH
T131167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d877e0101fe53b6dd7765dd62c4391ba16d5349d7256388128e893a473d617b1
MD5 857db95381ace25aca89be32ad8dc87a
SHA1 929ad3c2388865574033bef08366147fce6585d0
SHA512 1192a373b9dbafd3289cf625aad0ab064eaad5ddaa1dc45f977e7a037889c959679e32e600718e60a7b368a1ed543e00e41439eaae80a3c1dec9db1d9e1f57de
SSDEEP 49152:iB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glPLNiXicJFFRGNzj3:Qu6JmIxd2dP7wRGpj3
TLSH
T1DBD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ffe22a95ad3325ca80726f61f9da3a207a7f9c117abbd81ae2e7a7aacefa3f76
MD5 186e14e6e7817b3e6041f30bacc6e183
SHA1 903c45349efbc7803f4e81857f16205409310b5c
SHA512 dd82e629d7d01b398b50f1d67f5900346001a1ad79f4e7dfbfb9fced615fcab586a497dd6b6fe931ef781a5edb8a7dc81ef0e42b0d8ac8b7218091f4b9cc4dd1
SSDEEP 49152:71hpsNoJpF1A67U44CwH7R4xzLNiXicJFFRGNzj3:7mifPqRa7wRGpj3
TLSH
T1F7B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d85bd250d149ed22270371c26cbca781671b1c6337422ab9d2fc8446b22850bd
MD5 723279376e9103b1ac5dc292532c8653
SHA1 be500703b8eb3d763c96ae42c346db56ecc9d9aa
SHA512 e528ceaabbc8de077b6e8657c9cb66510c5fb6eaa2c2285ece212a3b1ddd5811af228df3b70700d0be69196f3a837ef24a64911b86afca406892c4d4bc9e72b8
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHqkLNiXicJFFRGNzj3:A5dKqi61k7wRGpj3
TLSH
T119C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1e47a91096f80a97a04e312083a11c4a13a9d28798c0649175b73e3539212fa7
MD5 8ddf74c58f7942b7ffdf284bd8d3ec6e
SHA1 29c5c9db2716e6e28d4cc2ec7d227b72adb8bfe0
SHA512 28ac91b53b36ef8bbadb5db4da4e8a22cc0d51ea1896940b9faac71072776b9acf18ef930a1b5111b261ff3e416fe0287c369932af9af738761c9a078f87eb01
SSDEEP 49152:5htSn8EApI0figjgiDn0AP5wHLNiXicJFFRGNzj3:IX2iWph27wRGpj3
TLSH
T19695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 43756c33a3d76a9183fa8eba23e4364022544d0a07aac94c8a0b73879aed3dc3
MD5 21243e9d6536c7c610eaf99bb46a9cde
SHA1 83b7ba2a4003995d94e4c309e3120872f7382fc9
SHA512 89797f340ebeea2061aa166d0b872468bfe8799b588f382757341c55e640fe931334a1ad56ca3058046a3142c1a12e2456c41ef0a6062a5fe5999665553693af
SSDEEP 12288:EuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B5523D3558955B2EAFC0039C6754428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 375c2134c13c857bb6df10548613472ea81513ff7d27f3137d400165e10f41e3
MD5 bc8cdf36b4e3fe5f617708c24fb3d2f9
SHA1 0423677c0b3484724b20bdb0f7e6b4dee8b0ce77
SHA512 9ac96adc5cd8acfacd54b43bac39e87fe9fea20c40e4b7001799753fc2bb257f995b27098167dfdd2baa7a0a0c2f08207caeb973f7a5ec2666958953d28b664e
SSDEEP 12288:19iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1905523D3548955B2EABC0039C6754428F5881E2DEB5618E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 483fa447e3bcd31123c54e1373500b245fb47f8f8a7c8320f3432a77e662e6da
MD5 073948f72b98ddee7b47a6dfc6421808
SHA1 65e6eec4ebfe3e234b64066228c41236066fbc64
SHA512 82b2d2318df28301d5d020b0a18e3b127ee973b422433f6eb8ec43af8af3d8984c41b5216e9c76e3e8e616456411f1fedd9f94595b295cf511ae1f2c05221d26
SSDEEP 12288:BfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Br/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D15523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f8579793a116593d2ccf815bac5568bc299b23c4653bb0fa1cf601996cb092d2
MD5 504a7978998e4a3b9e7d4e738fbed83e
SHA1 20a68f437d1b66ee92a58ae875bfa176094f429a
SHA512 59258d1208054f94519a3df43139b4e08e66dc85dbc56ed7cfc891a34c08a11dc4fa414dc0c21c373bb724f7fe2b7a81244d8cc8f550ca09b49843da0d25aebf
SSDEEP 12288:pVoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E552392168900E1E9FD8039C6764424F2E47D6CD7325AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 832e6cbd0bf9263e814b8e8124af5373f9831331c878aaa36811d721368aa782
MD5 dc5a209341a615097c18283addd72a43
SHA1 257d496bda86bdf4886691e9f0ab937b910f7d64
SHA512 d95de307cf8845edbe2bbdab9c04ae6cd83ab3695edbd36da7019e1e327c74ec8c04d82582c6312510b14a1fbfd3197dc31e9bbbd11efc20df2bd3386e5920c8
SSDEEP 12288:CQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1035523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 827ef93bf4f9151ae61f50909104bbad641230e7a8b8a8b294d9536cc30d104b
MD5 a9d946c6fd4e4d22c082cd702424e99b
SHA1 8d9cab586856cdcde3e9c80b031d3a5bbacf7ad0
SHA512 6eec2b7593355aac7708406d9f5605998469044d783f275e6b3cc4856cacae78bed1d2b21f07cc5ef868fd3c41cd68208fff304025c2f95edc1513d9ff62834e
SSDEEP 12288:X5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B15523D3548955B2EABC0039C6754428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e0ac350f376fdbbf14138c1175717227238220e04b6c93aa196f53cc26105ab7
MD5 af57c84035edc5f614090ee871db6338
SHA1 ce0df36c77d2b601f75755995ec88fbeb1f10481
SHA512 6a481e5a59c25470baa4cc94b0a939b56ed8cc46affeda73198a292de24c31e419985678e4bc7d142871c2ca82282e2a18c53387a53b872f9e4d9f668cc96ef8
SSDEEP 12288:5liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C85523D2548955B2EBBC003986754428F5881E2DEB5659E3E2083D1EE27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 9d54de2d6bb31ad9b9d0de77b7c879d68c64eae85245b3ac73e14a54ff64b986
MD5 313e78406cd0916efb3b049042b93d28
SHA1 d636db5b7496b2bebf2d43f36a8e7684f7b702e5
SHA512 283575ae64522216d6d8bcd094ede2081792819fbbd64fa724291807cec04ee9a7feea2948429c21eea99a900166de9397b20a9ebf542763f0493126d3c9c293
SSDEEP 24576:NZM3zFVSOB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NZM3zfVLNiXicJFFRGNzj3
TLSH
T197750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ff39f0876e21bfe9d8b323f4a4947d38fe03a9e9a76fdff168fbe5f40e3a3c34
MD5 4d49558da9574cac7f53931493c3d8f4
SHA1 40d8e820da9a97ac88c2331d3a6d49a85be3fd71
SHA512 6473d73ac2b4d52433f7b5e94ed1edfc6dd0755e374bb952ccb3b7f26f3c6eca5da7b96ae3f59ce87fef5240f415a6efbf8d0bc42ac06e8da110f5c991f44ce8
SSDEEP 12288:OyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1245523D3548955B1EAFC003986764428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a0760d17800ee528da95c52137e7cd635f10e4ad43cd66cabcd65b5f097dd396
MD5 2de3d9df82f64114bbad6e703e30f2ef
SHA1 d11f64f635b0cc652799dea3899deedf1d0907fb
SHA512 a43c2c6dd38da8aa839f36dd60d43c34178df26295bcb209ffc4167f947ceeb87d2efa19c7c399a8ca8bcbdbb56b41309528aba65213bbe57e3709b628876756
SSDEEP 12288:4miJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1345523D3548955B1EBBC003986754428F5886E2DEB5619E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7dc800b8cf64b55b4ba21c80e4fd96dbd82d5aec7d9d6737623bfd991ff52eb5
MD5 59c49846062371f1cdb61ed4341de483
SHA1 bd39a3dbab464593c8309a0f0ce840ea17ec237d
SHA512 0c22b4c68c7c025a40091df01c34f9645265c9312ff9266fb9ac973bd0b09b63f0226ffed0a8baf6b02dd55e77019bbcfc6f1d0c2e38f9b36fcc1ecf017bc05a
SSDEEP 24576:+zy9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+2LNiXicJFFRGNzj3
TLSH
T1A3650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4b33021342fa7c13cf884feb9be478f52938566c48e9def9e8cbe4a1856c30ad
MD5 39a2a09df39e4535a92ae30a99d8b2b0
SHA1 17a7d3454abeac8f170a65ae5094f4614e20c630
SHA512 54e2e7f9793b47b09db008f71b222ed8c08a2bfc326a8ed19f5c05b4483a781344d7e3b7186fb54b029b59de634d5e9641f52f3671b6298281b29c867ae37442
SSDEEP 12288:+yiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1885523D3558955B1EAFC003986764428F5881E2DEB5619E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 422e0c6fedb4b2ef78d971fd2a3d815f7b6ea8ba4885c8587637a46a728d04ea
MD5 b8eb3de539e07e8940a14f8f956aa176
SHA1 d95d8fcec102ccf27f857379797b0247179c9ea5
SHA512 00a825ab539a4d87d411e9d9933ea129b9297357f2dc8b82409e8dbf20dbd5adc6de5d2c1e6fc0d9e353cc82957b9ccb5bfb611368124c68f1426d7b6c27c5eb
SSDEEP 12288:vyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1705523D3548955B1EBFC003986764428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d1144df26544401ef5279a39810a49ba502af0c8ab889d4ee4a7227612edc9f9
MD5 211b67e2272c74d85cc675d6a79e59ac
SHA1 b6dc1c86f7ac9fd8e45f4a8b5b4828a0853a05b3
SHA512 825f48dcd342752ce768ebf3ff78c62063d165181cb1e6aabf481c0541c854d3a8f32858637e0b0dac05717a741d4687dd56ca89c5b3231d33de7b4325c90be1
SSDEEP 24576:Azy9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A2LNiXicJFFRGNzj3
TLSH
T138650247629530F9E17A4139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 e10bae6297e262e26bb762b0d109d8d262508721afc37aa806146795062323d8
MD5 61789d87a9e34a028c43c4fac29ef9b4
SHA1 00885d214b839a32f3fdc33463774251ab796bdd
SHA512 8aca2d36ff566417eda73c77229cc615e281380e99963ee60f5d696783c1788b8cd69b21901a8f9b0e6db3e640815d8d33416c15ed6182d8a2192362bc8d2feb
SSDEEP 24576:yT8aLl3z0zD7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yT7Llj+LNiXicJFFRGNzj3
TLSH
T17C7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f344bdb761129dd37444f406676eebb9a45fd3e59a1a40d49aff8eb0468c8480
MD5 53f174719ba1dbee519f00e91828f7bf
SHA1 29d9f7eb6bbe145f53a613419284fbe8b942c6dc
SHA512 3b3c62255f608e079f05d6a02120ce1b42c55968d3e589b71ca8c85931838a40b6c5d779c2139ba11c69ce62296cf86a5aa27eb43681e927c9af596df760ed66
SSDEEP 24576:d3rd9CHKy7GZ//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9rd9CHKyaVLNiXicJFFRGNzj3
TLSH
T14485CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0873c102737fa12acbb011da0acbc2fd97977b5f8bfe2e931b4a324fc34e785c
MD5 fb24e17c607babe22e8c21c3f44ca520
SHA1 6e5a43642225b55fc607c52f61f05ebc054a3a3c
SHA512 6fc9a14822cffccb9d6074a017386a717126befcb5dc0b0931c0099344b97993e658530959ca46068600def56ab39c29578959e28d3cca0a948a219158893b26
SSDEEP 12288:I/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A95523D2548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 bf0d40789843c6617e690a429b2ffb46fadee3fc686385d3d4958814c576587e
MD5 e80061a37ede5383c354c75cc4ac690c
SHA1 65b33f2d9cc3467da0d87eb0b33674ca8292ab21
SHA512 493968f76523b0e4fd1e3da26aa5e71c14cc16f53919683151d26742dd07b84b8aa6e7e04dd28b5486d887dd6316fb0a2f0bf6de556e594bde364757ee292b07
SSDEEP 24576:Dfwvzk9RX6wkyAIA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WMnYIALNiXicJFFRGNzj3
TLSH
T17E85D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9740811605bfeca2a957f309e59c0e79879b6e91f7aea19bdc4d791ed76e59d3
MD5 973f1b0839f1e20d1d619d4ac175c985
SHA1 6466b7af59937b4d21e1c1cab76f05d048eab96d
SHA512 7bbbe70b91a2d827da5e5bf92982c40926e6e5668920b7ba15850df63923a8563d042afd15fd3a840743e5f2c5dfdb12a7624fcb738dc7d3044bb6a2f77f9ad3
SSDEEP 49152:/YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nLNiXicJFFRGN:iySzP/7wRGpj3
TLSH
T19A066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d19192645b10b0cea18a1215637eaca02e8cc5a8f98d8d728eba7fb0fd9c85df
MD5 ae00faef17aa673e3f2c313b71c39d97
SHA1 9a78a7b43b8b5f1156a6ffcaf196a71925c17ec1
SHA512 c0e1ecbee7c9ba1039c34504a8a40506a31a53c02d50c74c60ae256c8354dc7d972387b5065dda13caf28823eed70e5f835e7fbd5fbe5946c2d3cfef5521e9e7
SSDEEP 24576:947Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:947JUQjqirIhCnDHUPfF/XLNiXicJFFS
TLSH
T1F465AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ad2fc496497912cc5460d5ff5b431d3f7fe6aeb699118df9c9f754bb309bf08a
MD5 baa40e9f737af357d57e355c61033aec
SHA1 085cd1373bc4f287474ee4daf996894e813f50de
SHA512 9c9b9cce53be2c013e6832975b5982e20fd366ba7fa8687cd10d7e2bd736f51a940166b4a06ad319438222e0e57e5b72fa0a63ffdf92bf0b1fce8e0da39b6c35
SSDEEP 12288:opsfiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19765F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52D0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 cf4aa8ae6afbd7f8693a8228e592e87000879b3f4f00bf9510b257f907065081
MD5 90f829986650048910ca430339044ee6
SHA1 900165ca211c932f8e1159e27e2e0a26ac42e169
SHA512 c73b6f6992432829b8b196fc3e937515e8747b907590413676a7fdaafcbe44d0c60a9b8c31690a9396ff66619d3499a533b6d7349a8b6da0fe55091035b6f397
SSDEEP 12288:snoqAU3foKD5x6QE/3+TiPmQyR8bPta9t:snojUPE/+TOmp4PwD
TLSH
T13C352841766AD75FC6AD40321E32D6CCA7707D01EE05AB0372C9873FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 1845851a26d6e7ec22deb8bcbe91dab513241f6f53aa9f38dcf0dfdcb1c88c20
MD5 fc3690e7ca0ad018f863c69a603116d0
SHA1 33a11938cf32f925ea8adba3cc201c39ca477c31
SHA512 9b36c21ef2ca0b38cfad216468a021e66d067e8968f61416e29837aa1a96df55946a001e5ebad11d1dcf3f49ca5d707aaad30580b0e74faf79c1092b028510f4
SSDEEP 6144:hMFg2dIdcm7O+4I748LDKu6cbVtMxozCODJX+2QhcbVtMxUf6ubEAb14qjeFEv:ha+4I75/ZPjGEv
TLSH
T1C055C6819537E38FE1F72071071A6F4C6BA4EC17B6095E26B3C8453AD82B72664F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 b5e1255fd0845a5fcbb867a4985999571417dab356df915e8d24a975cadea875
MD5 5466a3ea0aef9b0c2c8651a294a373f5
SHA1 f416e419bb6ad97e861404647a3bf1dee1cbfee5
SHA512 93b81b587038d50826e4ab6982dccf2601c3c58c03ba5c45f56ceba205603bb470b788ed20fb674c22928641732f265dd9192f8b8bb0cb93f63cc679bc7614fb
TLSH
T131C08C0201BF50AB2F6711CCED0A2F9050827110EB42CA20F231FB87F9B041608DBC1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp43C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp43C1.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp5CE8.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp5CE8.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

8256de4c83806d8d.bin

Path C:\Users\Admin\AppData\Roaming\8256de4c83806d8d.bin
Size 12KB
SHA256 9e04517529fbc8b85c26a439ec4b398f085604a2dec6693e337242b134315a81
MD5 1db009ccac544f8d5317e761a17eb18e
SHA1 db38385ecb397640a3f118f2477f9d130b23d138
SHA512 63578508bf074cc8a6798c7bc50671f8d557ab36b8434e66ca5611e1c8b0690b3199f7e6b33e4e04da82cb01196dfdc43334502802f1b6eb78ae176bedd98cef
SSDEEP 192:tph2pTlZb7+2LYMrDb4u98houydoK2k9KT5Pt/VWqymAdJXpBFW3:tph2pTLb7jz/b4u98hyoK0T5yeADZB6
TLSH
T19A42D071DF30805EBDB9573B6F9D05D2A01CB1FC1470A87CB6981B385E568822AF851E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8b40e0959f7364d71b9ee4cb66e9f51f1d902cc164e2060f4a6516329965343b
MD5 863878a757672a2cd0ea51159f54d7b6
SHA1 2569926fa6bf3681a6698c3e21ddab41464af8c2
SHA512 0d480b2686f186afbe69163441013d071ee9d73650500c90682a84e527ff232ccf56923809c6a389f01de6218fdc7d12bcf71a54e7f90d07a42398e5d1ee0bf3
SSDEEP 12288:aF7qiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ws/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F45523A3568959B1FAFD0039857A8434B54C7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fb992bc60021046e04cc8e49741164107d7bc3d98b8c1757b439bc7607f5f2f8
MD5 16c523011be00be2ba5afe0502fed6dc
SHA1 248d9a9ccedbc4b35de25ad881fedb862b891fd4
SHA512 88e8e41bd35182415e99eae6191de0aa3363a53f7c90bea665807ff10aa1e013832ccda0255db01f9ac8d4557ffec5a4f1ab2a7fae5663c2063a5ad1abc1bd6a
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bY+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vgb4mBIBhGFxLNiXicJFFRGNzj3
TLSH
T1E665AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d6f0f91d3ed72bb9f4d6bbf68c5b48a6880e6ecedf44d845ec6beb37bc21a877
MD5 92f7ffd6d226f5f9c0bff9027db3084d
SHA1 578c43ad7f5e886c54fafc2ff2890ce7b357a015
SHA512 12993a4893927fa01da24f769c7f2f0ccbcacf725047bd54d03b49887803d82fbb3e83e7ed11f22e8f9702c1b77b5520f6c6b0b3af459498f74e1ccc20ccebfb
SSDEEP 24576:EG88u8FpJqH1vzria7/mB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:37ZFPqVya7/GLNiXicJFFRGNzj3
TLSH
T10285F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c861542cc4f6dc4924a844de1fc92a63d88cd78e2b282b240dca1445fee0440c
MD5 54368d6fffea23205c928267a56550bb
SHA1 d02eeedf8df8600bd12919fd1202663ee59bfd7f
SHA512 ca0bfb80aa34fb9aa3ae3a874576cf8a56fc290275585c67502b3f75e67bb056bb65458b04eb95bfc733899f096c19a1807fdb67d353657b50fbee145b15eb7d
SSDEEP 24576:FPUr+NQV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FJQVLNiXicJFFRGNzj3
TLSH
T1D865F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5ed49350c6468de281b2de7a0ccd147c82b06e328ba1380c2d990848907a3a6a
MD5 48dcb71d6cfe6deedcde1f8d8331c7f7
SHA1 6b3b3747b952fc61f0cb18409da0bc6c995fe3b1
SHA512 834b9b95a973966ad41b7e3f24e511628ef912fc1ab291767d0b200635ce209f4edb733b2a1be3f86219d69c2a5c63598c6359b1466c3db72d97a69347977d7c
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlLNiXicJFFRGNzj3:rG05lO43bI7wRGpj3
TLSH
T100D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7e4724e58f66e1331534cf47965e95d4b932c669b5241371e50c4a6fe7ef8f6e
MD5 d97fd83860dc4a9aa5ffbd51ec890b0d
SHA1 d3f79253bb1b494ad50afe0a0596f4169fb8c579
SHA512 f3d936d96142182cf76ef606e93639419f24112006fd3e322c5300de68e8451f06e9c86271cfb2d69aa9a3c2ebec56bc6bd160153236166a3f236b6cde2db333
SSDEEP 24576:nfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnn/TwSfVcYG3K/cJHlnFR+IGNe8jg:fa5POZ3lJt2pasx2+mdLNiXicJFFRGNf
TLSH
T10F65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6be7fc5bc87f9a08982b52968334f7dc55fd3567ce742429d306dfdcdbf7784c
MD5 eb60f32011706ad31b99952ca39ab631
SHA1 fcaba3eea29b76f66c393f474e6f83bab92ea1d0
SHA512 92faa562f119614248b26126d859f7e07c313677157a2d56365c6eb8e9d4f386b17ca11e20f12fd41b11ff3bdba85afb97dde59e7b662e71634169500281db5f
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7Fk5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jNc/zEOVHFmLNiXicJFFRGNzj3
TLSH
T12C858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5e642871dffbceda0fa351dd4c173b6916da52563b796f32dae1d6ea4aa6f60c
MD5 ce6375723486414c668890066cddd2e2
SHA1 88365be7f38cc1fbef5e2e168963b52b4d82a775
SHA512 aa0735e0c3663dc6e7a8c61cb57666cc700a9aa1c1bc6a17a34ca6f4d1bdb8c1a4440d6c0535e548e7723ea508d0de6bbc948e3f027bf9c28c5409fe0eb7ca8f
SSDEEP 24576:8zkNvNnaFeYhJNtmZBmr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8zMwBtOmrLNiXicJFFRGNzj3
TLSH
T12555AF6EA6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f08a7fb6c731ddde602c33059e099b8fae41b44ad46b1ecb86767ad2611c08cb
MD5 6acebf10f4588e7658da1a8228056890
SHA1 75deef4ef61e610eae00ac7f29b1168c4f0f7a6e
SHA512 54df46cfb5707906793979b7dfc493ea4d24e6d00f5a0a95affdf264dc540533046d6740ea4ebc7a23ff7e2d47c57760ef243ea2db00e8b8899284c1223c338e
SSDEEP 24576:oD3FHshBIYQgA4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oDVHeBIAA4LNiXicJFFRGNzj3
TLSH
T19175E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1720-230-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1720-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1720-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1720-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1720-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1952-420-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-98-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1952-398-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-92-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1952-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-418-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3128-214-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3128-227-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3128-221-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3128-224-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3220-667-0x0000019E04400000-0x0000019E04648000-memory.dmp

Download

memory/3220-415-0x0000019E04400000-0x0000019E04648000-memory.dmp

Download

memory/3296-14-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3296-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3296-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3296-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3300-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3300-56-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3300-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3300-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3300-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3448-238-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3448-232-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3448-231-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3448-404-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4092-65-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4092-59-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4092-366-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4092-58-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4144-664-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/4144-552-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/4144-553-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/4144-558-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/4144-607-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/4152-77-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4152-71-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4152-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4152-383-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4932-51-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/4932-7-0x0000000002550000-0x00000000025B6000-memory.dmp

Download

memory/4932-1-0x0000000002550000-0x00000000025B6000-memory.dmp

Download

memory/4932-6-0x0000000002550000-0x00000000025B6000-memory.dmp

Download

memory/4932-0-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/4976-399-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4976-401-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4976-403-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4976-105-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4976-111-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4976-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5136-202-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5136-400-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5136-204-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5136-210-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6124-82-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/6124-87-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/6124-397-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/6124-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download