49e2a315525531344de3e06129b66aec775354af1dc54a4a5b110a5151a264eb

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.6MB
Sample260804-stxtsshm3w
SHA256 49e2a315525531344de3e06129b66aec775354af1dc54a4a5b110a5151a264eb
MD5 6f83f77689b349e03b2307abebb8e0a7
SHA1 1a1beb3faefd941792abb6fea3791d5271a48830
SHA512 9330c81ea79101573eb514c5b43f7af3163b18056311dff3a4b29fa3ed4b7d5ebda750df5a1b4151d30ac83300b4d051f06cbf42a2a7d72ba4c0ffa1b75ea91f
SSDEEP 24576:ULv5qMr1nD//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:c5qM7LNiXicJFFRGNzj3
TLSH
T1F275E01077D08036F5B324764A7E8629956DBD715F2181CFB3C02A2E9E70BD1EA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
1224	elevation_service.exe
5660	maintenanceservice.exe
5764	OSE.EXE
5124	PerceptionSimulationService.exe
4920	perfhost.exe
5512	ReFsDedupSvc.exe
4288	SensorDataService.exe
5620	ssh-agent.exe
4636	AgentService.exe
4964	SearchIndexer.exe
2896	Reader_sl.exe
3220	elevation_service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c279701fc618523d.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	OSE.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f625098d2524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdbbf58b2524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092053a8b2524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080ae8acd2524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000805c38b2524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3384	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
3384	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
3384	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
3384	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
3384	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
3384	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
3384	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
3384	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
3384	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
3384	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
1224	elevation_service.exe
1224	elevation_service.exe
1224	elevation_service.exe
1224	elevation_service.exe
1224	elevation_service.exe
1224	elevation_service.exe
1224	elevation_service.exe
5764	OSE.EXE
5764	OSE.EXE
5764	OSE.EXE
5764	OSE.EXE
5764	OSE.EXE
5764	OSE.EXE
5764	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3384	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	1224	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4636	AgentService.exe
Token: 33	4964	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4964	SearchIndexer.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1224	elevation_service.exe
Token: SeDebugPrivilege	5764	OSE.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4344	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4344	3384	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe	90
PID 4964 wrote to memory of 4724	4964	SearchIndexer.exe	102
PID 4964 wrote to memory of 1144	4964	SearchIndexer.exe	103
PID 4964 wrote to memory of 2564	4964	SearchIndexer.exe	104
PID 4964 wrote to memory of 5964	4964	SearchIndexer.exe	105
PID 4344 wrote to memory of 2896	4344	AdobeARM.exe	108
PID 4964 wrote to memory of 3432	4964	SearchIndexer.exe	111
PID 4964 wrote to memory of 1636	4964	SearchIndexer.exe	112
PID 4964 wrote to memory of 468	4964	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5660

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5124

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4920

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4288

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5620

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 6d6b261153b70af9718783427133bcf0cc0f450791bb1bc4280ebf29704f7481
MD5 9862c062278a85d0e8296add264de4b9
SHA1 10fe067b4eebe2e11e254da3fbd15db5e6cfb44b
SHA512 0d465e61abf5e88e0d7e8b8d625fba1e1ecc7ca7055f851875c2bc1cbf60152216450d416e07e24672f763ebb9ea1c6f37567ca896c504bb571bc7391409e5de
SSDEEP 98304:srbT5whEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTv7wRGpj3:+QnfW/JLGMcblLheTzF9
TLSH
T1B5A6BF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 f58bd1c06632f1b09e6ba40487ccea6e470cf075d6163e9f6af902c7212c9597
MD5 ccbc1eb238082004ef13efc34f45a26b
SHA1 b89d94162c6652c22930b52a5aee56cb6bd24eac
SHA512 9d457613c93690979e924194155d9869b2be1f04021185c060d7ab4fb64d59d0ae728cd11e13ed230b928ee09fba089594cc9583adfec253f1beb75128790c39
SSDEEP 49152:2TfiUEWo6zuEz439S99akTBc4O8b8ITDnlT4NvJmLNiXicJFFRGNzj3:2TfiG/nzl90S7wRGpj3
TLSH
T1FFE5E52662C8C1EBE5642070CC69BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 611KB
SHA256 16478a9cee863856d941df604adc0da48c3900e85cd15162e8812ebc0313ad60
MD5 082dfd3baaf32e38c39ee245181d03a4
SHA1 6268788dcf277b31d558151fecd4f48c7b933a20
SHA512 2e9ab3efd0593e1f6b592f95163a64d2fa06afb6fff22843aba1edebb4e1864ffe05959c7b8060501544cbf33e482a32cc2d5ebba6d8358d2d09ff8c5da3b55d
SSDEEP 12288:yFQuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QQY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15ED423532A869B72E9B8003509795B78E0ACDD38DF161AE393043A1F957CBD78E3512F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 662KB
SHA256 74f9bab81aa2264e8ae56c24f50c2438b60bba8ae2c3b920b1ae35c9c6778d7d
MD5 1ceb1120240933ab35fbb84830c4dc9f
SHA1 81ad3def4ed2f8a4d144fb0bcf6d5168cc71a4d8
SHA512 b55a9bab5c0f3c07e3f73730ec27ae174361480655a5734dc756af45abcc28023ceef889bd66fecc610bdabd7e1ac4fca2ffbd9e972f11e409d9a265a10c70e3
SSDEEP 12288:+5AeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13EE41261B1C545B1EAB900324E6A6A5EA04CFD384B2254E3F3D82F3E95386D3CF76563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 973KB
SHA256 43620bd4ead8a31fddf2339eed194e4c9602569df484af34962304675522bc7c
MD5 fd33e90bdf5cdf358ee9c01b1501df34
SHA1 00a19dda7ccd1310d21889d0f262832766a442e8
SHA512 7008c930a500deebb2634bc333e9973a03ca26b7fbaad6fc2720b76e9332f705cc21af4cbf988b32ac423a7af6383a978af8cf11c50dceec0fc344fb2d85bbce
SSDEEP 24576:g/TAbD+Omec/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YTAGOmecLNiXicJFFRGNzj3
TLSH
T16225E01137C0C135F1B318368A7F9728656DBD715F6881CFE3882A2E5E70AE1AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b0eff4400276cda4678ab56a9457727da0e186fd09d42ceb0809d38c4f3ba88d
MD5 1248e32871e4615da2d1387b5a0fc014
SHA1 a95deff01db5d7a2fa222a872217828496740e0a
SHA512 1ff603e787f055ad4dc10c2e319d6684031dfe4bdba9ca87b12cf16b54f5245ad0beb094b829c3191d92dd788db13d8ec87706d3eb0d69c6dba193a325360f3f
SSDEEP 49152:Zb+632BuPkFKRrdE6oh2stBhuXjfS4LWxnMLNiXicJFFRGNzj3:v3q6DjBL7wRGpj3
TLSH
T1DDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 3.3MB
SHA256 1014528cc1f7c237d3086698a70184b6ce1b6e0881359395cd983b81c328eac1
MD5 be7d53f2eda4ad443c669e9a9403e795
SHA1 b2865eb8fc4beaaec65deb565c87f3fd5e4e3e96
SHA512 d56331b91098c2cfc32317589584e92c86331db654524c52650a43364f3caa6500e453c21b804beb3887082fd3c3eb493ed58c9410ce14365b4f0db74e0dd2b0
SSDEEP 49152:2b+632BuPkFKRrdE6ohkstBhuXjfS4LWxnMLNiXicJFFRGNzj3fLNiXicJFFRGNf:o3q6NjBL7wRGpj3f7wRGpj3
TLSH
T159F5AE03F2D900E9E06DD178D7469132E9A2BC890B34B6DF0790B6562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b65e425494b95340219abc56537e0720f61a2e4ffe925cfe0a5a367b151f73a9
MD5 c9242a380bde8d39831b6a27021f7833
SHA1 f754118d3afbc1007a25837b8402ce0606f000c5
SHA512 0938dec5554cbd4078063c2891c38d2cf0cc1463b8e4addaf5f6459fd9e4810fa7d850d337f7b97c00ce00c5e24a7ab1361bb5b798442526b4897b3e7ad5d960
SSDEEP 24576:DXYfDtczAz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GtcGLNiXicJFFRGNzj3
TLSH
T1C575012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f9459480672ded97f6c9ab0f2bea3ba4741d45286535adb9264f152acb9a4c6c
MD5 b481a6fde57a0ef9b76dc2489acc534c
SHA1 08b89c0a942bf1ab5035654b69017bb6db6f8bbf
SHA512 10033d2da01cc06f9ccf3601ed8347174a8d73bd3b57a77890ddfebd8cc09facf5fe61bc14bf9ffc891b3bf60c3793760262e241a995de527ce2991a1b4482e5
SSDEEP 24576:z0Le5ji0hmxhrMI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zPji0AztLNiXicJFFRGNzj3
TLSH
T17B859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 149b96ea22671302b5e8e895e2971982f579e78e456645a6e9ae4e92c2c22fda
MD5 147eba57687d9b94aba76bee2705a2ce
SHA1 31da16772919ac139304bbb850b0250066326102
SHA512 5e20d072aacd62e5bc8d886e4857a1718179fc6f304ba825862e0bd7560eceda55960dd3e81437466c3dd071e3645b94d1c656f45cb35815e8c30a9165428b69
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWj6q8wyuW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8/ezSC6vUzPv+Hjy5LNiXicJFFRGNzj3
TLSH
T121756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4a5136d0ee92ee9bebf61ae7a35332600218a8f77428d821d69d0b4defb0841e
MD5 c780b8738b866ee18d24a24d9869dee0
SHA1 164082950f50139da81f4d6fc54ac41ef9f18427
SHA512 d5f9250a5d39c1240f133132d348fcdc9e0db6dc71f0867d636614744ca0760af3b9c298848cee552587976407d869a1b5a2018a5f015a1e38a407357a98db87
SSDEEP 24576:wVbqPb88hv/l+Bn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wVO88hXl+NLNiXicJFFRGNzj3
TLSH
T17C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9cd106abed52f104b3b09532cb8fc13308aaee7cda1819fd26645cc9b4b730f5
MD5 bfb1dea41341533f76fc11644c569dcf
SHA1 30c596cdd15f9ceeef63e609768578c615a4334c
SHA512 4e88c203920af7c95271631733bac8e0928e0e34b1eeb9afd8e1826b81c7f82f8955f51da47dfbf6fe4c91ac83ab80b4e33e3a2770473ae0ccf49702278af9e7
SSDEEP 24576:6GM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OLNiXicJFFRGNzj3
TLSH
T1B05523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c007f78ba01e37fd4bd7adb1608b183cb0b0491bcf42d4ebab4cd529bd78cbac
MD5 5e2b42cfc15faa36d5e25c0abbf5c57b
SHA1 1852579ac0c6f995fcfcf09844b8b0d81e933939
SHA512 843772a0c245ca22c843ae0cee50371437aec6f01c08fcf78f1c5f1585f3950d0f4ead5c7762b43681472867c7fcd743b7933886478a2fb95a3eccffc110cf4c
SSDEEP 24576:zJIU//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zJIU/LNiXicJFFRGNzj3
TLSH
T1D175CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f332cd33786ab206299edc6458b6de7631e74f36766adbaa20d094b5e74a0ae0
MD5 66ab9d1f23270c98b99db5f633162fa2
SHA1 f11b060e12e3499c54583fc8888e914a017f60ac
SHA512 a123e96394eb622c9faa6f421634704d979a234f31897d8860a82c59a9d3978ae4372105cb3497f6dc46a625b80fb5dd91393ffa09a73d556867b8751fb06ed2
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THb:wQvGAdlCEL8c/WRNw5Cm7wRGpj3
TLSH
T1B8266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 efb04af259ade9e3763ea7807b6ce1df6deff7433e2cfe960503ad56679b0f08
MD5 8a772cf0cdf741a4611f6f109d28e78a
SHA1 99310eaa578d880824746cfdd9562d1470d26aab
SHA512 1c7e418920f07c8e8247e2712d2cf3098c467c85dab64b208c7ae0bf40d6c2da77794105b322c312252e06c417c06938918e35525fe4a8a228338c78f4c76862
SSDEEP 24576:bfewsAj9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:blj9LNiXicJFFRGNzj3
TLSH
T13C75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 14ea7a8194fd9256e7e34e20c9d64071b2aedd0a59c4869a37c7bda096a698dd
MD5 fdfbf335d4afba3f233113df3565d452
SHA1 f295e3b9bce4e12c41e37ebe311bc783158ef708
SHA512 122b3f65ccf1fe7a14ecf204adaff4c66d2d5542dee966f76828c966ef59ba0694d1a0b3c6dbb0bc449c21b8629b5ff3f0aa00a1cbb99b3d411468ced7188b2b
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHZF9:AUEtQevvqc2W1cpV20I32/9
TLSH
T169474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8a05e67dbb13894a508ca219248014381ec9cf9da19827fd3b1b6e75cd057425
MD5 83ea7090e576d855960123ad971abbdf
SHA1 39a4a4c3312c7fa276092cf5675b81e17f71c4f1
SHA512 2ac5cd2481d8828e82260225a840c5949a7b25cb3add79c2c1db42423766ed22337129a8a45b744bb926a75e6680d9470e2ab3f2eda3c47960d1db398a12e569
SSDEEP 49152:DCbRquA/m2yL5zLfFiV+XenmE3/zdLNiXicJFFRGNzj3:8oq2Vjnmy7wRGpj3
TLSH
T138D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 096b9baa12df258a650b25269603e58b155f611ce3ae6de18f4e80a8d478d18e
MD5 1677f7757c49a9d200f1ac97505c2be2
SHA1 9bc99ed4777075b037f096e46bdabb7b9e56ea64
SHA512 55bece2d8129414dc05e61d2aab68778eb91c553cdb8b504e8469c6a56241f6297dcdd6cfc29aeb7e0998282fe338ad4c599fd973516b06e02187b6ccdd9bae2
SSDEEP 24576:YAhGL6IFoiwtA5l7S53S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YAM5Foiq5CLNiXicJFFRGNzj3
TLSH
T112359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 cd6944edd5c037651a29b5a53e8b2b2ee8804754fda7d2493d13ea9523f31064
MD5 7dc71c72853c691741d41d8cb1f39532
SHA1 a4f31898f725dcc0ce5a830a0c45f85c0d90d3d1
SHA512 50ce2d7a467d6a5a50aabf04856f8362ea3dd11e2c82193eecf0c120d0df1b77a830630a03b7b9c76958859e565454456dda1782efd67919869e77d3173ced13
SSDEEP 24576:ZwuROWZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZwSOuLNiXicJFFRGNzj3
TLSH
T1EA65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4def40ba7dcc16578f55ef8c9ec4b94329622c8a012c39ce66baf0dda6d9f5b3
MD5 b125ba3934af5a77bc9ae2dd2a19e94c
SHA1 598dfe54f7e2545bb013b2ca52ced599f05d0bfb
SHA512 50e3a6b1ad1e1eb0dcbec824cd463cb8dc547f98ef293671d6c146d617ea82435604e447086a798552a0bc212ce7b5aaf0de0afa0600c5a70477b8bb08ee46b6
SSDEEP 24576:kZuA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iLNiXicJFFRGNzj3
TLSH
T13C55129622C420F5E2BB413DC9F54504E7A17C2A673643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7d94efc9421a568b2c50c962341818070625265dd3c27aaaaff67fcb246f83a8
MD5 b40294f2919da2faabda4cbf617ad9f9
SHA1 0b748c3476d244a32cca08ee18c5279e94a993cd
SHA512 430373fd2a54e42e49490191e80d67f76a6c38c9c62ed9ec147e0c74438944368c16f1c3f589ed20f6dc3247b9f45c17cb95aa77b493915a01f26c4782a207a6
SSDEEP 98304:1QRQyi36YOcPDLvw2gAf+PN3r7wRGpj3:MQyiKanX+PNfF9
TLSH
T148667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 55460b8a4e13cbbf27d13d27d262be1b51ceb38bce0c6c3e992075fb0506af72
MD5 6d861800ec296526ed72517ec897e75b
SHA1 2ebc02f7e54763f8b9a6c57cdaee5df8eb978a42
SHA512 fa3e346dae6a755c247419e5ae487a732a2857a110c9b668567368f4959fe7fb000d22f6e4f250772ce4168939190bbfc4ebcf6657dcf68b08bd1a976dcdf0d9
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN3r7wRGpj3:qQyiKanX+PNfF9
TLSH
T1F9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6750d8e0f8e9dfaf857784212e64ab066af913c183ce064fe9afa56832564e50
MD5 bf0c0d73397ba31eb68a721a2d7d05b4
SHA1 092a4aea747afb220426cca78a837fa387bbfdac
SHA512 8ce54772e795345400482be67e943940226fb547e29e80ee44cbd8c74f9335117cafe76ef9b6f32c7a63a839f935f5e7ab0c9136ef92642f60bccb568a4b2c19
SSDEEP 49152:O68Qg55nhkeWu7PNU3/tLNiXicJFFRGNzj3:cthTRc/t7wRGpj3
TLSH
T145B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e7396cb8334ff83e1f3525dc3b02238fa300334d5c0d8f91641d4df5d5e80bb6
MD5 213e7ad7bae1b37d89d8c0c6ff74f615
SHA1 c157d71ebaa206a5fff3db3fb4b1c6ce7871b202
SHA512 2a789ea6841abac7e0041c05abd15fb1f248fcd9d2afa30c814101a52b4f902a2266e8396c1bcc6060d9f303f033cee815437d700a7b907686dbc5420d0ccd69
SSDEEP 98304:my5112gYy5azzVvU69nLKnhZM7wRGpj3:XLIHRWhuF9
TLSH
T179167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ed26d06d997e4b14544a175fcf7a5a84385f11f231cb9f4bb55b4554e0f45736
MD5 b8b3bab58e8176147f992da1e5726a87
SHA1 1b662db97b27dfd4576dea034edd0072506f28fb
SHA512 4625da6a1e0101e2ac57aacc50a62df50fe6bfeafb7dd57e685ea211171457bfef89de8d35812a7061e95038442a50b69744fbc8e2ca952318b99aac22bbc56b
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glvLNiXicJFFRGNzj3:0u6JmIxd2dv7wRGpj3
TLSH
T119D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 048d747df106aadcf1891d27eeb210a428f566ff75f17ea4ad9bed7d9b41516f
MD5 4237d2812c550648d19f96436211fb69
SHA1 741e6f9fcdfd7a1cf47ec3cc07a231c201a75e3d
SHA512 ce3ec7a8909702ead36d635ef2ea9b8888dbc5a516ec5cc37fba26cf3d7c06052351f225e0233a649c7702b1f97179e0a38653bcf38303818b328a538934ce18
SSDEEP 49152:t1hpsNoJpF1A67U44CwH7R4xfLNiXicJFFRGNzj3:tmifPqRy7wRGpj3
TLSH
T17BB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 22eb53494c503b6db77acd84ccadc3af265d5b5874fbb3776caa9b4cf8827495
MD5 16271a615bc54f0a52caed473f331c2d
SHA1 bc8f323ce1681ce88f0f6972bed964110180c92b
SHA512 0bbd99b3b28f3e5d27d9d933472fbd5df3fe7ff2161ba670ea46f705e76441f47a9e0e250bedcfcdccc9f175c3e95d1a344b719848c2a285fbab02fce95b031f
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHqALNiXicJFFRGNzj3:A5dKqi61A7wRGpj3
TLSH
T1CDC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 68c84361c815fa9180dfb91abd1d92f23b5fe779357ab4bdc4903b53e7c15ed7
MD5 2bddf45311e8e740025fb70b4c73c03f
SHA1 cb4e24b9c0805f116cdd1c3c7cc9eff3e7629f80
SHA512 b39873b38760744f417d452c535efc8ae7f7b3a0a5516f42f1788583454c16676cdb94251ad2ad35b27bfba3e19a9ffe33e41488e7dcafcdfd96cb07e37b39d8
SSDEEP 49152:vhtSn8EApI0figjgiDn0AP5wzLNiXicJFFRGNzj3:+X2iWphO7wRGpj3
TLSH
T1D795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7cf0b9b85b7241753617a584c56370b6982bcc95e90b0f8eb5b619d2b064738a
MD5 a6dd5d9148712b66b8ce2ce3e2fcee00
SHA1 e3eac3e893267db2ed82163b3da1feca576e0a1c
SHA512 c729bf5548fe6185026adc951eb437947804b20b12fdac0118169e4a1d174bebd1630b571986eb809ef76e9442a15d4e8e88d8c75f7ee930b827eae26cdb5b95
SSDEEP 12288:PCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523D355C955B1FAFC0039C6755428F5882E2DEB5618E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0812e5569cce4dff6c0c563942faa924bc3c7f990887e316bec7072d6374c086
MD5 6c976e67ccbf775395fcfcc0407b4942
SHA1 b1989f95150ce04d1e33f24ac306687d944815d8
SHA512 349c17839d70c51f32a5c4b8e948505383e5ec8a0436c73649411dbb34a3f9f414821ca12294f02b29df86ee306b82a7a273ae7e8c2401efce19ae8a818f3bd1
SSDEEP 12288:U9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Uh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1475523D3548955B1E6BC0039C6794428F5882E2DEB5619E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 faaadf0596eb6591085b02dd61659272c47df73dedfafd5f3aba3eec63d0f417
MD5 b941774812fbad11c5a044537f62bc4b
SHA1 2fdf039089d990a738c6fb755668d26ad0db7018
SHA512 cee98673e908303cf2ff44cd75f786bce0c78f0be3d4d890bca099ea3dfca4fc8993304e1a1f73a00d380a31fb65cf729c3840d0f2b7235e648ec42ed03b610a
SSDEEP 12288:ijiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15B5523D3558955B1E6FC0039C67A4428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 893b693c06784c9bef5b81232a416cef90acf7ba31e6cb61d09183d1189aa652
MD5 e41e54fbc174dc5b19f5f1fcc3ce9591
SHA1 44aeafb2bf7a6f1d5c7e5b21bf83111ee1a2de13
SHA512 dc7945519efcb9d0ca46c03820c0a5330fea57165946e4d3892482fa5a7cc2ab7f24592816b4ce382add91d1d477f24d1ef34a88a430bf5caf5b8d33cd888016
SSDEEP 12288:MVgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13C552392168900F1E9FD8039C6764424F2A47D6CD7365AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 76725e8cfc0fa8a2f48daef7e3f285bea8b985d7901de7378d013d5775831bbf
MD5 88a8e97a835d252f6a8dc5c94cca13fa
SHA1 3e9b1dc4164fdd6bda03ede7d7c1220bff27dc0c
SHA512 96dbdc6f17535dc6ce1dd990b27f6efcafd568a71236140d58944e28fc9c5cc5eff1feb5313c1ea39f9be2c6b63b52a54725e66981f2375f3dd17049fa0c1d3d
SSDEEP 12288:ToiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ta/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F5523D3558955B1F6FC0039C67A4428F5881E2DEB5618E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c87ae39dcf43d34fa10ff2813df7382bc563bcf6407da9b7b6f9860cf3e4029f
MD5 f1eb738ea508435732957c480d87df24
SHA1 9db8e0807cdf2e246d27cae84a8d4feed09cb703
SHA512 9ff99b2381a134c5ecfa02961f65b3ce2f9d10693ae74f99e2ff09c8245c06053ed05757ffa5c2a76aa52e9ed8f89f3e0f50e67161a52478f56c9a2c1a5f8f8d
SSDEEP 12288:1piJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:11/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1885523D3558955B1E6BC0039C6794428F5882E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 27abf314f34161406c224b725cab07cabadef0cc771584fa721b557cea6c8812
MD5 8378e2ba90e0b27f51d4570793d0d630
SHA1 bb33c29d875174d33fc9a90d1a2ec4c00e5fbbee
SHA512 5e9d2711a96e25c64f7c228287523a26dc35ac967e2d79fabdeefb0a3046442d2978fbc6c376e47b8a3bc9d01d09fffa98b56bd774fd57bf1c19b0f548925aed
SSDEEP 12288:CFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1025523D3558955B1E6BC0039C6394428F5882E2DEB5659E3E2083D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 94ef00dadce3feba7ba722f23a2d1913337437f8a10d9531334469475e636c67
MD5 88bfd9341622567441e161fe3966eafa
SHA1 7b4eb7ea12d4a63fc4bc496d510e775ecfa3bc97
SHA512 5cb6e5960cf5954284f22b6d278725cdc0484dd9d138928e07608e718cd265fa86a267513bc249ffb223e5b7efd5348d59117f7e3622d2f4c2fbf3fdccfd441d
SSDEEP 24576:SZM3zFVSOB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SZM3zfFLNiXicJFFRGNzj3
TLSH
T1B7750295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b623dcaf02aadeaad9e7beb85851d8aea6965291d83d767dea249cd70b59f9bd
MD5 a59aa5abd66bfe3b563d53bf83f07205
SHA1 626462df8ae350d28996173541724d5b8c7e6dfc
SHA512 d422416d87fb6723ab551862b8935763f7a4ad41cef69fdffd2112eacccdf8f26075ed698ad52c43176d8597565a03b48653968f81cefb93f7f638f4f8ce4ff2
SSDEEP 12288:QmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1755523D3558955B1E6FC0039C6794428F5881E2DEB5619E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1469bc0204f36eb189e92798b8c65293f1af32db106d5cf3700d13061f66750d
MD5 3bd532dc64c6ae0b9d6189a5d28e274c
SHA1 a3727c368aa96412fdfd0c2be357c9d341861f8c
SHA512 3a0ac0c35ea8a76552e8c76b3309901b2ff7a2b55663fcf2a34483e65a078ce4a9e315f7bb917b266d46621f7c64e18fe315f3ec2b2e7e20edc27777345d4057
SSDEEP 12288:F6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F5523D3558955B1EABC0039C6754428F5886E2DEB5619E3E2083D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 4c25533d09ee802b6be167039565f0721183369eceedb9826d1e415b9f12514d
MD5 02d8c2269d7dbddc8eb2d15349d942c8
SHA1 adff8a8606f8fdf5b5c62e313019aa9722222ad8
SHA512 676c206a180f61f55b749035a7639e2537b4eb38e4656e0eba1bbf62eee58557040acdd945eb15fa7ef857450108ffc5a9c291f3197149981647dfdc2b2f4e4b
SSDEEP 24576:BzyN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BOLNiXicJFFRGNzj3
TLSH
T1CF650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7414bcdb02b4ee58acb84db1fd0645bfd5c9a04645df910eb220a4e7b965c920
MD5 4f5f42454d4a0956ead3c37091ec82d0
SHA1 6450a5cf9cd022f67df6ca17355548360ca02621
SHA512 f7f1768f1d418542dee409d7172c59d65a6b80e39b7769aef214eb04ebe466b39fc070ad7a546bd969ddd27b89e45705fd4b64b2d774dc9abc863a0cc0392d2e
SSDEEP 12288:ZmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1765523D3558955B1E6FC0039C6794428F5882E2DEB5619E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c36bfca75a9a1a47b1d049d05c5eb01fc00a40a361475eae5f2042389ea3215e
MD5 4efa10d9cc4cf204fadc84a1db5e5e26
SHA1 db2e3b9fb4256429d57e69514dde468523df811f
SHA512 8d1f0927005ce1742da034b4f7d6345b6d79bc0189f7f4b60b6f3264c5c35b748b9dbb47908e1194ec644f70b7fc048648e2afd92bdea06edbb4ba9dfbdf9d9b
SSDEEP 12288:OmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E5523D3558955B1E6FC0039C6794428F5882E2DEB5619E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a18c5c41c3e99b7e9dc2b3b474974ada104acb3a8decdd92a165ee9610a0230c
MD5 1aabee38492f32a888e0144ec3f39351
SHA1 63a21e274bbcd99561d572b4b98952cbee6714b6
SHA512 7b6de1949e0e6fdfc7f876a66857d57a485ff018d638d086a6dd7d25962d7495812ac1908b162c3f866b8d5427ecc9c10e4a701b45e802832b19cb4dd7c10477
SSDEEP 24576:AzyN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AOLNiXicJFFRGNzj3
TLSH
T10B650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 bdd622a2f758237eb1b1d230ea52cc8a18127f28d9e959333d2d73494f154c8f
MD5 9a6171d8728870977996b73a8153c5d9
SHA1 ccc63d474b8f037b723017b5cdb82a3781ef1d4e
SHA512 37e14efde44e605c2728cb05c3925fc8f61f7a00f3c99e0fcd6ae16c375864c09d9b51c48854858b05a770255e02df80250cc19a5d739d0a232d1d3c1c7fe12a
SSDEEP 24576:ofwvzk9RX6wkyAIs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bMnYIsLNiXicJFFRGNzj3
TLSH
T16D85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bdf5529b2a333412f849085c75918947f87e9b250e07f79ce48bb545b0b06353
MD5 48e99204f4fb8c659f34bdf2f60a9c03
SHA1 b0154220d274786b70a844b4d8c506488b3f3856
SHA512 2cbb1a93392ca19e45e5a9eabc1b8a981757decb3c91dea2412f647ea1f789df9fa91762faf245b9a71f73b0e3457af4b60747c8721847a7b5a9036111305f1d
SSDEEP 49152:GYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TLNiXicJFFRGN:JySzPL7wRGpj3
TLSH
T1EF066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7e626cef239bc52f6a3f8e4af1669ae05a941d476a7d9871d97f50bf254794e6
MD5 099f63b1a9f775d64651af472091fe11
SHA1 636fe92b1feeccc264f3570651bc502a1e9eeb32
SHA512 808f99f99b35093d3da47a18bec0ab8b612b26c8bfd1c7277ac02b0bac369617cd5646a31dedd7d5052e9c16692621301977229c9968e1bef8fbecd42783bfcb
SSDEEP 24576:Z47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Z47JUQjqirIhCnDHUPfF/jLNiXicJFFS
TLSH
T12765AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ffe6c39f6cf38c388712aae70863da90df92ca18c1442a90cb48cf6ea80ff19e
MD5 15935d214beac1e1682f500f5ab9a49c
SHA1 2170e8cc656aae72aceba1e6e19161614f285827
SHA512 dc67b5fc1fe86486f6324e0942ab2d44a55ea60ff1bcf10227955ba538441f5b755d73f7812aecb6005a51897153d7f3cd1256d49905710f769ec88931cc9945
SSDEEP 12288:ppsf2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C565F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 93d52fc7d30ccbb5f8981d6312a2234e7d5d8d7f5ff94b7b85272806456f3bac
MD5 ae5de44ad5b6469876fd3c5b4ed6422d
SHA1 cbf38a42bb4d2316f1481daf4ee9e3a14ed1b8e0
SHA512 7a6c99acdf1bcc076dd89e0a3975071f2c5dbea30148d8b1795907c0bcbe6838a2c5d3dc95fb9b24cd344824adbbda3a3c15be30d5d8767a4d6de0927f72a249
SSDEEP 12288:y4gwzSU3fKsM8jjhtcK7dXI+yA7aWZc+ZVYfpJewO:y4gwOUPxHfcsBgAPK+ZCfpY
TLSH
T1E5351850766AC75FC6AD80321E32D1CCA7707D11EE05AB0772C8873FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 0b420bcfcad0668a9f062de2b1457fabe474ac412cddd510b11cdd7dc41ebe11
MD5 459f1bae68d2af9b567045512d8e8eb3
SHA1 836806f285385e96071de9ea1ab31f68d8ae3583
SHA512 bda55999346d3d32e2a4c92d582fb5bc06a2a30989e847fafb7b97fe04ad8bd298fa97e956c233aff9536086ed1f01dea86b2fa07ea3956cfd7c58ee668407e9
SSDEEP 6144:rX5JzqFAoebsv8CSVMf2WQKRPtMxFLaRGw9aYJG+RoGawiMlNmmRPtMx7qXsUFDB:rX52ebsv8CS4zQktUWm6Tbr
TLSH
T1A155C6815537A38FD1FB6031072A6B4C67A4EC06B7056F6673C9453AD82AB26B0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 891329bb24a683ad68d1f70b6b55ecad9ef16b32330ce98f4ef6e2258c8e3612
MD5 a5249939659bb8ff3926169c3c70087a
SHA1 02b854772140ce25de691c6acbce6f1f96c5c3d4
SHA512 a20213d49902de77c77a151d6be2ab3f6a0fdd915c0b9d1d16ced4181a2b61fb3bc0cc76f1e194f67feb92b009249b4f1ffc03bff1c45d658f1adcba7b55eb28
TLSH
T1C1C04C9615BF509F5F3702C9AD162F9010927552CF895AF1F2347F46B9B142A0E9BC1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpC162.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpC162.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpDBA3.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpDBA3.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

c279701fc618523d.bin

Path C:\Users\Admin\AppData\Roaming\c279701fc618523d.bin
Size 12KB
SHA256 6792159bc0598a76a3ddf7c14baa7363434a26f26aedc712f23f4ef4db794281
MD5 4310be4378b58281336b471ede050d16
SHA1 9ba601b4fef448915caeeeb7c151d45237e412e4
SHA512 5b2ad3d930e5e9fa8f633969808baba6cbd19874e9c18e050788fb128e52c2c616a6a4c36f5a3bffb7a37dfa12656e8f74e2d361a55d040e72c9fcdb5cb8577d
SSDEEP 384:11DtUx9KhDL9OnPimoASor9cRFGdgGYEh:HKDNPpJe4gGYEh
TLSH
T1B042C09082315BE3C39CB3181EAA1DF35E767A333261B2DF88D419DF6B029196728252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b5d4c626f21cdd874e42dcce8769da298303d403482b9ec33687822ada465d9c
MD5 74779b2a7442b12b71ea8f02e7e77ccd
SHA1 b04160e0a8503a39ace649a3849f155da57c3649
SHA512 03dd39c29f1f1aaa05a83ee34c1de3c091192aa59c33d110dcccf51878bbea6a469da37658d752e018e2b2a21d2895752b6a58d97226390326021e13191c8899
SSDEEP 12288:jF7eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1685523A3568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4fc0a8c708f550900e484dd1d38fd9256ce50566800d3f2a575953669596789a
MD5 6029945d5468b73c9cedbbf088e396c0
SHA1 65e933929cdd75e859e7184a9f3d65b1c7053741
SHA512 b553e2ae31602a7425a9341195c9bcbddf9de032c7d9aedb5202832c22b20593c7592b58a396fddf158e25450d152f53d7a1a74fe6f73e970a766c03945b708c
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1gb4mBIBhGFRLNiXicJFFRGNzj3
TLSH
T19565AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 c08078c74766ef79ee60ecb0e8f9f8fd14c72516313ba528ea30b997f09365ad
MD5 f316f94f56b789ae5893224e28a7128f
SHA1 a675d309acfc5d78736fe635a462039ec69e7505
SHA512 9f500be6755d87ddbe5489908a53861ab50cae36e4afe32a7e0163251c86c8f9fb682ad16f2193fdb771fb2ac3d278fb95da6eed9e866f36dd9387874913946a
SSDEEP 24576:DG88u8FpJqH1vzria7/mB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:y7ZFPqVya7/+LNiXicJFFRGNzj3
TLSH
T1A285F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a2b14e54a21dd0528135353f93e840a2051da736fd9971258414564c49b436e6
MD5 f81614de3dda1d6b9500544130dd6f9e
SHA1 f39e5576152f60e1b498ac3032943cf37c5010a9
SHA512 101efd3337a9e4d3d3ad3ed0ccf1d8d158b800598ccce061087d4d89e638af8c9d9f89c638237859c88a640c6cb830f59b884bc22db27ccbbad1287972a337ea
SSDEEP 24576:mPUr+NQF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mJQFLNiXicJFFRGNzj3
TLSH
T16B65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 49c1a206eccc864208580c9b2925d4aae960ffcf03b78e1a2416facbace445f6
MD5 658ba5c3062e67376e0668385fc49437
SHA1 60a91f43f286fb4acf22e0b97ea88d6994af1c1b
SHA512 d367d9e11cdb56f4f8ad24e6d9644121800780aee8bc54893b7a57f9900a03ee57a333424925344cc0d1527d582fc0cd85c918f6de923b82f3d812687380b56b
SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1LNiXicJFFRGNzj3:BG05lO43bU7wRGpj3
TLSH
T15ED5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dae897dfb45c359006a5a714b6603c8b0fc8675f10d45c1d56ac09baedbeecbc
MD5 6854aa238de8a49b50122770fe249347
SHA1 f74964ea5ca9b6b7f873c7ffe467e80d43be78de
SHA512 a2aaff40fd325cbf52fd6fb5a92dcaf921d907c7e63ff919e466a2868a48a1f4a6bc3c5b58d5c4931430e6e9427b46796db4bf14c6aa30e48de82e381bd6a6be
SSDEEP 24576:Sfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnT/TwSfVcYG3K/cJHlnFR+IGNe8jg:6a5POZ3lJt2pasx2+mtLNiXicJFFRGNf
TLSH
T18D65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1ac9b71fa6bf6cf3d0c23d203106ffc9a1029898286099a78f7f82d47e134d9f
MD5 a1e242c559031d8857798cfa5da84ac7
SHA1 573d028dc36173788f54b3587359d1dcea0e337f
SHA512 bae3c9ad10d7f07311ae5c33a68407039c72864193f236c7bf12451111a8d27cecc02b37e29264e6c603d96aadcd41c7f3bf0d34e4ac4a982b006d46c35d8b2d
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7Fk5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GNc/zEOVHFeLNiXicJFFRGNzj3
TLSH
T1B2858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 567aee1b03d28838264f3e33abf3ad7a25ed02a9235dc92f9193e799eee39d06
MD5 e6e8e467b181d155bb172cb287a80d54
SHA1 16fdaa23636a9eaab6a4208b90ee1df64103ef10
SHA512 75d5338c53f222fa3ab9bcb1302f25eed78923f4e4e46fca392d84e6c27ee6f9d081f2e8228fb296ff33361c9d6ffc02e48968000e26e891750465fe4d6cfe3d
SSDEEP 24576:VzkNvNnaFeYhJNtmZBmj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VzMwBtOmjLNiXicJFFRGNzj3
TLSH
T17355AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4fd5194f54d8a335fdb3b407d89ae08fba4d01ef70ff592fc4903489b01c15d9
MD5 e0f2f1bcc13324bea74aa87872d6790a
SHA1 6c0e7e7518a6a877e3ffaf92fc22484f9cb66398
SHA512 0156476475447a8a8f5f0af338e137b204fcba20675d993e8f684799a44382feb519d47395941c1679a2b9d9d38d0a2cb362919ee0f1e9f8fbd38aba54a16988
SSDEEP 24576:nD3FHshBIYQgAk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nDVHeBIAAkLNiXicJFFRGNzj3
TLSH
T1EA75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1224-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1224-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1224-219-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2896-538-0x0000000000790000-0x00000000007F6000-memory.dmp

Download

memory/2896-589-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2896-531-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2896-532-0x0000000000790000-0x00000000007F6000-memory.dmp

Download

memory/2896-596-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/3220-599-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3220-605-0x0000000140000000-0x0000000140361000-memory.dmp

Download

memory/3220-606-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3220-650-0x0000000140000000-0x0000000140361000-memory.dmp

Download

memory/3384-1-0x0000000000C60000-0x0000000000CC6000-memory.dmp

Download

memory/3384-29-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/3384-0-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/3384-6-0x0000000000C60000-0x0000000000CC6000-memory.dmp

Download

memory/3384-8-0x0000000000C60000-0x0000000000CC6000-memory.dmp

Download

memory/4288-389-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4288-178-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4288-391-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4288-185-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4288-387-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4288-179-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4636-210-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4636-212-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4636-215-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4636-203-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4920-156-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4920-157-0x0000000000730000-0x0000000000796000-memory.dmp

Download

memory/4920-162-0x0000000000730000-0x0000000000796000-memory.dmp

Download

memory/4920-385-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4964-227-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4964-392-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4964-221-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4964-220-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5124-383-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5124-144-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5124-147-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5124-152-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5512-167-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5512-586-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5512-386-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5512-166-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5512-173-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5512-588-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5620-192-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5620-388-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5620-198-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5620-190-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5660-136-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/5660-125-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/5660-119-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/5660-118-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5660-140-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5764-130-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5764-366-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5764-141-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5764-138-0x00000000008A0000-0x0000000000900000-memory.dmp

Download