f857bc1c697fe9c596626501b72bef50a1f75ca540e4639ef3d305a796d809fd

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 06:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
Size 1.5MB
Sample260820-hh8rtatzdv
SHA256 f857bc1c697fe9c596626501b72bef50a1f75ca540e4639ef3d305a796d809fd
MD5 ce65ba593bdf944851ca23df280ce24b
SHA1 1019f9b83bc7aa274d0d1ad78a89daf7b8e1256b
SHA512 e519aaf0d2d3d06b80bae2c3ab2921c7cec964154fa9ae219d6ceceef4ce68a09ed1019a9a34c73bd2fc07c58e64995886fc09a2c5b8bdc624c8b831d33628fe
SSDEEP 24576:aWbwS8k1lPFgXe4i7ojhsP5Lgrk1TWb4AN5:h8k/PQe30jaNf1TWbdz
TLSH
T14175E01076D08036E1B3257649BECB65966DBD702F1182CF67C03A2FAE71AD1DA3172B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5464	elevation_service.exe
5932	elevation_service.exe
2252	maintenanceservice.exe
4784	OSE.EXE
5668	PerceptionSimulationService.exe
5128	perfhost.exe
4224	ReFsDedupSvc.exe
4768	SensorDataService.exe
4128	ssh-agent.exe
1732	AgentService.exe
4440	SearchIndexer.exe
4192	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\23095894238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp	AdobeARM.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007e3fca866f30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de01df856f30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045fc11866f30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e01636c76f30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1d86dc76f30dd01	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2868	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
2868	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
2868	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
2868	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
2868	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
2868	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
2868	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
2868	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
2868	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
2868	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
5464	elevation_service.exe
5464	elevation_service.exe
5464	elevation_service.exe
5464	elevation_service.exe
5464	elevation_service.exe
5464	elevation_service.exe
5464	elevation_service.exe
5932	elevation_service.exe
5932	elevation_service.exe
5932	elevation_service.exe
5932	elevation_service.exe
5932	elevation_service.exe
5932	elevation_service.exe
5932	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2868	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	5464	elevation_service.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1732	AgentService.exe
Token: 33	4440	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4440	SearchIndexer.exe
Token: SeDebugPrivilege	5464	elevation_service.exe
Token: SeDebugPrivilege	5932	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3812	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3812	2868	2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe	90
PID 4440 wrote to memory of 4368	4440	SearchIndexer.exe	103
PID 4440 wrote to memory of 5268	4440	SearchIndexer.exe	104
PID 4440 wrote to memory of 2008	4440	SearchIndexer.exe	105
PID 4440 wrote to memory of 2472	4440	SearchIndexer.exe	106
PID 3812 wrote to memory of 4192	3812	AdobeARM.exe	107
PID 4440 wrote to memory of 3724	4440	SearchIndexer.exe	109
PID 4440 wrote to memory of 2844	4440	SearchIndexer.exe	110
PID 4440 wrote to memory of 5928	4440	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5932

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2252

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4784

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5668

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5128

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4768

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4128

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2008
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 14d124b06402e2c82f17f872c15afeef692232ec89023bd86677a9e694477ab1
MD5 5b1eb1f5ffcf6d22efb2a6c1331a98cb
SHA1 5407023e28829a05fba1019140c2f06f1c4769e6
SHA512 93f0b58f133e704253c3d0d0520bbe7cf647c9d510f84021185286266cbe44eb29df24c37c71e19162311d4afa1f207006b07bfe24b6005ba2a96431f5515bbe
SSDEEP 98304:QrbT54hEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTpU023W:aonfW/JLGMcblLheTpp4W
TLSH
T10DA6BF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 dec9139bba57f127a2db93aa396eae31327d2f00dfbaf7eb581b67a88c4fa7a8
MD5 223bfd5528a9f9ada363b6e3b7b53e51
SHA1 2be323e1917d695f96d1937ed8c42ac6e2af5d3b
SHA512 fcc622ce58900129190cfbb7b1230a508e9ff19cc892eee607b2403a8c5e1f0b7887d13b464ebf07ff0377c31cdc911baba78183366f0298bf395432450d9cff
SSDEEP 49152:NTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJ2e30jaNf1TWbdz:NTfiG/nzU906U023W
TLSH
T11AE5E526A2C8C0EBE5642170CC69BBF900546D78DBA2CDD7BD447E16B9307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.2MB
SHA256 813e87ab7b24b11e5b3339f5b25e7cdda56e9f3e06e9e5bf1b9a8743d676ffba
MD5 7b62ac8b3cb2725d4f6b0832bc64ecdc
SHA1 31aaa8a6b5f56dc5dabc5a0a579072b7e02bac3b
SHA512 07b4a430ce6f2ac3730967ba59daaa6b05de0af8cbf148eb6dde8d6517e6753430c7fdf7e9a8a25c573495ff72d70d4c9f5de9a369571ce9e26dea5587575a34
SSDEEP 12288:CFY40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:gY5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B05522537F468B83E146C2B010FA8BF5E4F9CE90AB004AA757D07A674DBC8C65DB512E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.3MB
SHA256 506603a99a2b7a619eb8e434cd60f97ef060effaf0a0b9e198ab85b5419dcb0d
MD5 987266aa55167d37e080dd310d4f0465
SHA1 c809010cd60bdaa9f16cba2ce4a3eebead717b13
SHA512 b03dd379fd1668bb478540f1a3c5ef64ddce86d3b08c50c65b8651fb2b7b643d18c1b7deaea03b172cfa4c8eb0b664228119da8b54d71ee0d9d89b4506c02752
SSDEEP 12288:15Co0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1kgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F9551221F5C149F2E25742B149EB9B9AD068EE740B1188E3B3D49F3B5D784C39FB2462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 c380f70edb2bdd368f8e1b8eefe33ae2fa8765d006513aeb48635544a585b95d
MD5 4cda3d743d10cb9ed8605c5d4b07d4e3
SHA1 569802d403447ad198a21afa3dbf0599f5038c51
SHA512 bcf65916638b77b096ea523031f3c20c35d7dd87c0ef1e9fb176d00851db4021d875e1dafa3546f9443f8e427b9b2f5a891730287bfb29d67df9c30f1112ff22
SSDEEP 24576:QATAbD+OmelgXe4i7ojhsP5Lgrk1TWb4AN5:TTAGOmewe30jaNf1TWbdz
TLSH
T16275E11037D0C136F1B319768ABFD724956D7DA15F6881CFA3C81A6E5EB06E0AA3071B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c8f7576f48fa515f4229c91b20fa026d466bd9de0e248e333ab199356985b019
MD5 ff6c0c0a79b29ee90a646035d174f30e
SHA1 b93b0603c123e19e59bb3fb690c2a10e970e39a0
SHA512 447bf797ace84520bd045fe8b8fd3f13ea8c7c97eeceedfa90cdbcce41f4d3121c01df97bae5593a3a8c9f99ac08800b748cc7b9f8f4e733ad3304e494bdc6b4
SSDEEP 49152:Vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnue30jaNf1TWbdz:r3q6sjBjU023W
TLSH
T168D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 169f6a010d36b0bd199fb2fa9665a6c0a27bef360b3814a196dbbd6da2bd7f4e
MD5 619d7f053ea5f06830b90f7506e2432d
SHA1 2d1291c0df690a51628a75294d90bebf90c2110f
SHA512 19082a61f6f9adda6779bd716f11c1dad2847d7abfb619252c7ef95d35dc0d43ec162a7fa5feeb8825924824378534bfb091501658536343e476995bee2d9da3
SSDEEP 24576:YXYfDtczAQgXe4i7ojhsP5Lgrk1TWb4AN5:Ptcwe30jaNf1TWbdz
TLSH
T1BC65F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 82797cd18718196554b9d3b56a68b9605e83e9e01acefe290f3c33730581cc59
MD5 83b7d6ba2a6859e58a826c707fb50ba2
SHA1 00676609d41d61e1a9725f50d85f886e5255100a
SHA512 e6d67e8db756b25b163e6191bc8c30e2db13579c2cb9e12813a3f9d6e16c74908e6fcaf64808e1d6c5d1bcfc49c6187bbb2cf7e691eab41f63e26fe67983138b
SSDEEP 24576:N0Le5ji0hmxxrMvgXe4i7ojhsP5Lgrk1TWb4AN5:NPji0Ajde30jaNf1TWbdz
TLSH
T12885AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 95eb86f1b3bdf1e8ff3e4b424aa00435b2c2a947f561ed05f85b46bf652509dd
MD5 c8f3f9832eb76be2c5f222cad75beb83
SHA1 3d05dee8048f1e049cdce77e47386be1f6509d07
SHA512 b5b3e4824434af26122bc1e95562a4ae1ebef8bdc40358a1f7a17be257c48b1d3cc0a9dc555c9a04ef08ffa5c684c0a1fcd3467dc5afa6861f2f41d4e56ac4b0
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWn6q8wyuVgXe4i7ojhsP5Lgrk1TWb4AN5:z/ezSC6vUzPveHjyxe30jaNf1TWbdz
TLSH
T1ED756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 454605713ca21bf87acf988d802c3f05948b37b8ad299444d6912883701555fe
MD5 fbc5222f4e71a3badb88f073ab249e30
SHA1 ac04d115ff77911c07355f0148abf5e771af6606
SHA512 843c8631e3dcbad4dc22262b1a36c947312def37e21b8e85dddafde09cf153656e0dc650425c055513e7688af9e0474f694c89f438e59734a8d7288403ac779e
SSDEEP 24576:OVbqPb88hv/l+YcgXe4i7ojhsP5Lgrk1TWb4AN5:OVO88hXl+oe30jaNf1TWbdz
TLSH
T14D559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c9ee900dfd71e25ea6cd3d15425a8a0df8381926825d3ea66092752145cfee7f
MD5 b55cde59c20ee5d0cb4f3694c3d07b88
SHA1 6e4391f1b62cc8c35a3f85e51a5c5032f4a25c2d
SHA512 df3b40b7b76329c7b72275f5902a27b3cd13057c950344792e5e2cb4a09feb133e51838f228e6bc40af8a36db1131daec979a842e7ff21269a38ec5720121caa
SSDEEP 12288:kLi0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kL7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1704523919F5409C6F38FC3F4A0F7CBD1E9A11EC061444E6B47E0BA931DBC899EAD8069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2bda94dcbed39e06bf654a27e2e21db0079caadc805e1d579ea2a921d31262d3
MD5 96a535596f75911fa5ca474d341a3565
SHA1 f20b144987918ecb2473d7a15a54b17d9ddec336
SHA512 671c542592a055ad0f6661d8ade7bcf89235ffd44f6f84aa7150a53f800595370fe5c70a3f7ab09c7342a9c050f3def7ffda8a95751edf8ff471ee72413ba4c1
SSDEEP 12288:FeBNUbTVO86U30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FJIUkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14B65CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD1A4820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fcd85df8ee370db1b290828de2c812ea498b3ef4fd80b9c04df22564226d6bae
MD5 8c6705c427ff986e1e35d452cfbc1aaf
SHA1 3f20613ffdbc320ecd8074281b2ff9f215f2cf0b
SHA512 e20e8e5021f90c867309b157b241f300f792fa132762112746a7b4cf5f10629db2e2dc9cc0bee5f2d29a619bf6b77a799584e88a95899ed40eff0c1671f8ebb2
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH1:bQvGAdlCEL8c/DRNw5CQU023W
TLSH
T145267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 26c1437c608cc524754ce7fbbefd8a31617f3e1baf01f12b6b12cccdf821f41b
MD5 a87d23b9b216b550bde7ae4a17eda66f
SHA1 bf7b7e42367a25ceee0b750c2ac911023914e931
SHA512 1e3c3609e2f29db57c7243d4f969f5356b1d696ec5793fbb23c7135239c2124a4d29c1813588920045cf46a882c877133f03983c94ebc6c8c4aa88ef698210f4
SSDEEP 24576:r0ewsAjKgXe4i7ojhsP5Lgrk1TWb4AN5:oljte30jaNf1TWbdz
TLSH
T14275E031FE74D032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d024e86a1d96bda80eae6bc3feb717d343891c6e520427defea841cda56b0cb7
MD5 a9964b5a7ca55ba1703cdcb53e357eac
SHA1 516873a7475179faaba4c6024cbb9f0624aa58f4
SHA512 68d5423bc030f0f64eb4f81eb227594a72385d8f705b8e3b12426b77dd07013787665a40cb50abe1119c51dd41f41743c2cff2e4ebe1d9f69f5b888d57351c08
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHVp4W:GUEtQevvqc2W1cpV2tI32H4W
TLSH
T1ED474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 674feba8efbc8fda61ac2c630eed3fa84bb0c871d7c18c7425245a2c8ab4e4e7
MD5 aade176c311c5fb5cc2f14caf235afa1
SHA1 84b36a5c8b7272dce82d821444299cf15268dca3
SHA512 771f30653641e3e5e8fb97ca79530ff8552768ea5bd54fb294366bdd67d10bd15078ac04516f8030becae971e08a2681755ca8d473013a4213743fbae6f35a87
SSDEEP 49152:vCbRquA/m2yL5zTfFiV+XenmE3/zNe30jaNf1TWbdz:ooquVjnmEU023W
TLSH
T1F1D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6315d175ee3a3282282767855cc42120dc99f1b540c0257cfc34ba70e887eb7d
MD5 715d442c22a86276579b06020ecaf654
SHA1 844912047d5e24047bcf618a3be69b7e8b6d5c90
SHA512 9085a65e52500f65c7dce2bac67c3d25d44a91c6c3698cdf28b2f0944f462d6bb23f729c2359824562fb91dea8e4b03ad65f04eafa30e6287673cd535ffc9075
SSDEEP 24576:OAhGL3IFoiwtA5l7S53ZgXe4i7ojhsP5Lgrk1TWb4AN5:OAMUFoiq5Ue30jaNf1TWbdz
TLSH
T186359E81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 683cc70da5d5044581c60a0a474366d0f91665505a3cdade7c2eb9c81d7bd0d4
MD5 6ece183ff77082eb66cd16ff520e5ca5
SHA1 a361ebbcecfea73dac2667d70dfa2aaec3414d05
SHA512 f29267b9367c16f7a41f2e103bbd0b24368db9bb6ae9f9bb64b21a660d2fb9db709e9dedde07e4a384fd9ab13ed3fa3ea5517902fc6d1e45452c7381323d2819
SSDEEP 12288:Kmw5HEjsChNVBFgl0WDm+CU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:Dwu4OW+gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FC65E14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5be4ff0a35a7d43bd6363c2ea529b8428799c5492aa236c0e1a69a18a73991cd
MD5 ee0d5957704b61c2ade710a5abcc4162
SHA1 8e2e964ebec4c59e69e3e5b6992f51a3c0198b09
SHA512 aebbefee6cd30fe015fffce1826c0c14b54e412dd65566464253d2c3ef8ee6473c6fa6c80cc63d894676dbda98ff74a339845b9fa145aaf435e825d92beec8e9
SSDEEP 12288:7eZ1Iyt0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6Zu3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FE55129637E421F9E2978278D4F28741E7B23892233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a0831b78da121a07c68db0a742ad9728ec84e9b1ceadb149625bb1d14dce29f7
MD5 209cab1f5bbdc9f73a33232f230090c1
SHA1 e76bb633e689a01dc3de9fa3feae5c09c3d2a310
SHA512 3d6ba076a16ce7f189475d5a703c930f1cd04c9bf6c9f0e8f7e733c3e2978e2449350dfe5f08da4a34065f883d72c1d678118641d58414dfff2ac0b060dfcb90
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:bQRQyi36YOcPbLvw2gAf+PN3PU023W
TLSH
T119667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9f3ac8cdf0570ce7e48e08e878c0c4419cce6fc8dd0e87160efb94053f4ea6cf
MD5 b244dc7165484e1985ed4e852ad69fed
SHA1 c117ef72f19ee511040c5a445bf0bd8e29914a1d
SHA512 0de5bf57b50a46bcbe1fc456fb8a192bf5ee83def0c0fa5b69b6c318ac94dc5dd1ba95a19cd70eebf5bfbe5beeffbccd3b4446790f3f9178b4e1896e6a51144a
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:kQRQyi36YOcPbLvw2gAf+PN3PU023W
TLSH
T1F2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 16450e6f765642afd28e5aa539e1dc3ec4ac804d8061ff205dfe12c4c49e388d
MD5 617dfbe6dc60697c63e43034ca9b899a
SHA1 16c796925367d14cd241d7f8a1adf6d331011cb7
SHA512 b27cba4cda50b463826c59c3fffc1fbb26a40d094a393862041edfbea2636276e48decd3675f31e41b244ed551858bbfd303344c10f1295c94813e91b2d36505
SSDEEP 49152:D68Qg55nhceWu7PNU3/de30jaNf1TWbdz:9thLRc/dU023W
TLSH
T1EAB55933B2F60099C04DE1769F4A872196E27C718FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ea7a9960019084d866d087f678f084705295834bc3066b22090cfae06f72396f
MD5 e24b5e7a8e1d419eae0399b8badff8ba
SHA1 0aaba60d53df46da6d24aa8200827b6d62ce87fc
SHA512 09ba0fc31c0be7aca3db57f3dcf77d869f5e19237e3fbfc1447e60a02df8c7156196b5a3af2525e56fe2275357ae2f3ca4b3a539c0a1ae72806519fc81225cb9
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99f:Iy5112gYy5azzVvt69nLKnhZiU023W
TLSH
T199168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 078c97a0c03d0e720ece64c6720fe5d01a82f0e28082ef193cf8e60316947dd2
MD5 8b17a984375b62348d0d2ea83b111aaf
SHA1 a0c496866437954eab6724eae1c640077466f2bc
SHA512 da23696b8f3f7b28e73e30795df1d67bf6839394aaa1ab9b75bd590aef7db3bcd8e29f9e4b013beada751b46e3c10e06aedff183ad3becf56d9ded73e14adb17
SSDEEP 49152:QB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glIe30jaNf1TWbdz:Ku6Jmdxd2dIU023W
TLSH
T19BD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2adbda1ca593ad838cf436e78b185bd8c97d9c39f69c3944dd478260c73167e3
MD5 d995f7d9ec6a8828c3389b722ad41ad7
SHA1 9e20d4a1c81323a05c0837311922a3a0292988f5
SHA512 a53ecc474f3ef02b03729a6b8ac142ce669433393ab23c1f139a6cde1f194f4e1facb16c139740527a3a29405c201cc0e96326fe1b68b9e4bcaf40bfd666b822
SSDEEP 49152:W1hpsNoJpF1A63U44CwH7R4xre30jaNf1TWbdz:WmifPWREU023W
TLSH
T103B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 dd235648ee71870c083d582c45ac2463f588d2df63762f380dabe747592e8ce6
MD5 275d9d75c20bf5c392c40e1df0c4935b
SHA1 f0ee556fe23a2e916b84014d5b7fba37a8c847a4
SHA512 306fcf6fcf842565ce684775285d842185dffc4ac6c09b29b11da1f1cc36b798541d56d7253e065239183f65742926f262e7d7827938da542857ed720c71c426
SSDEEP 49152:XSuZQIY0Be2KcRVtOnks6NMHq+e30jaNf1TWbdz:N5dKii61+U023W
TLSH
T16AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 78453d3b9e5dc2ba5a002cd87d09bae994c3042f058075630a2ad57517a3e25e
MD5 dfadbd93d211c899eefe0904d6e1d098
SHA1 dc676078e806f8168934cec3c4d8f66d18fc7172
SHA512 3e8d4080ab789bf08c45d07b04a56e472163c0a1f35b2f23fc7032aa248ab8103d890ad296f5660295ce24430f555c1d6998e436f14ed311ed9a92079f6efccb
SSDEEP 49152:DhtSn8EApI0fig3giDn0AP5w3e30jaNf1TWbdz:iX2imph4U023W
TLSH
T17195BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e1fc0e42cacf3604b5bb518efc67be1603deba77f13a3cfe7f39abf2bb059dad
MD5 3fc7d6921fd11912cbbd6be928df94c8
SHA1 13f458481ab6aec8a9fbaf0efcabd44131baa257
SHA512 4aba256f1bc4c05b7aba639cf2aab6f043fd5049488633de0fbf16fad09af59686febcca13a5060118e966e7f0f0894d46228635e8d0ff90a0d3c97bc3cdb2ea
SSDEEP 12288:Dq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DjgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CC452391AE550ACAE34BC3F0D0F787C1E9E11EC672444D6B17E0B5631DBC8DA6AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 94af817df5dc95e98ce097ed289bf663c153bdcbad0c217ed0b0fac14d2795ae
MD5 1d7f074e8c1b057d0450d1d12b049fa6
SHA1 dd2792d1b13637a92174fa0e5b7a268c5b841680
SHA512 c1b38e8110a33a60742cb37cafe0a95d4653f2f342d2734b3c5b6ab7c93ecab8b0de2ac4961553a07cc2f0cbdf2dd9b7a33d96a068ab38c95d8cce7bf0fa4402
SSDEEP 12288:IJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1714523A1AE550AC6E34BC3F0D0E787D1E9A01FC672404E6B17E0F9535DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 dc18ee85a95bb21ee1061c3a241198ced8499b51ed0d4900ec181ccc02e8854c
MD5 5b7344255817526d56714288906f171d
SHA1 ddbe04d275b11aededf4ca355f1a5533cd4ad38b
SHA512 387791ddc5e8e87f93ed979a84e5aa5519867a40d4f8b6344657f5c8d61dbf30a200f8548682f67bc19760ea8d14a71f2256e958c5c08c64ac225b561666ef8c
SSDEEP 12288:w/0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wsgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17D4523A1AE550ACAE34BC3F0D0F787D1E9E01EC272404E6B57E1B5531DBCCDA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 cb2ff947be82ab5c1797763dcf818bb504e58e1b5f22c06dce6269cc95d9f742
MD5 21accecc4f51d456a7776bfd9caff5de
SHA1 b088aefe307e0c1507850907c71f592b9722430c
SHA512 603becd5abe4b3c3dbe9b47b67b20d0cce288de990e34eb297b7e24e24d6453e75a93b7da9a304bf40e24865856f7b4b203dd6fd2ac145c9227195f0bdf6495d
SSDEEP 12288:6V40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B24523926FA905C6E14BC3F4C0F38791E6F13DC173114BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2952c54a08e6e61f07408e9de1f835970a512759fc89800f48a4f6cdf745ad8b
MD5 8c750f587bcd91c9b60b05324869fe7d
SHA1 c011ba7077719786ab83dfcc84e41f44f893ebf8
SHA512 72a9ff78cc8fc9e2d81737a0230fcc15183e5b19fdf5c528defb530ff2a869e912f32483e69c65568857f9b47521bceb42f19813db090f1349b5607543e1cc17
SSDEEP 12288:Ew0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ERgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13C4523A1AE550AC6E34FC3F0D0F787D1E9E01FC672404D6B17E1B5631DBC89A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 28003ae7b9c56e49360b3b5f6d9d887f78916ce3815248377aacb14c5fd43382
MD5 8f6585c2b0fd9872d4e457d717b0911a
SHA1 4f9e328112c504fd2454b3104663c94ebf574955
SHA512 d21e7f38e24c0c5cc8c34f02ec61c7112a7e74e7322ffe34d2eb4dfb2b1688847225b9e552df5e288952323bef20f09c38bf34775c5c86a06402e775458b37fe
SSDEEP 12288:tF0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:tygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1004523A1AE550ACAE34FC3F0D0F787D1E9A01FC672404E6B17E0F5531DBC89A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4a9a61903473ae77caf915f91019c7e032bd93850002918f0b8981bcc31409d6
MD5 f9ada853bbdba971a6d959f8f32a0047
SHA1 d8aaa71621d46d05f9a9eaa90cfff9028429db00
SHA512 c6a98de178fb9cd1b67b77fb611e1508bcb02b0e99ca9a6f18216eefc81728cfc62fab6f400d141eb3e51cb45ad65aa71636aef51d538647dea0b24d5b9dd8d4
SSDEEP 12288:Sh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:SOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19C4523A1AE550AC6E34BC3F0D0E7C7D1E9E01FC672444E6B17E0F5531EBC89A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f9946e00b284538cf6d97393a31e4e4faa1e0c7c16fdda714a2c15060a1388d3
MD5 0223e9840926a5a3ab38b81ea43d374d
SHA1 837ee60ce2f84488d3774e4a4fea3dc47ba70e2d
SHA512 32497e41fb74344007737f5835727d2b45cb9a1928c3d3785276ce4671a9aeed661709c75e6ac15ab9760ef2fcf343565fc9b1d95b4fc46f3b1760e2a9102ad1
SSDEEP 24576:tZMRzFVSO2gXe4i7ojhsP5Lgrk1TWb4AN5:tZMRzf1e30jaNf1TWbdz
TLSH
T11F650195B3500CF8ED67827EC8A68A02D6B27C561760CA1F03E436671F773A11D3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c2fae5b90100f5cc465c56e9589c88a882f29d73eb8ed1151885a8b6ddb9a61b
MD5 7687a29b0d1f78d9b02431a988a664f9
SHA1 2d8a88255a9c4fde66a3ad774ab097d6469ad00a
SHA512 b29a82e9f999ef71ad778eb89f0aa33883a293e19883d7a1f6c28255b462c38d4e9f3a18b860d1b24163bfbc3d7192a1fe7ed3f6c0f1983f5303ecf91bff3219
SSDEEP 12288:IO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15B4523A1AE5509CAE34BC3F0D0E7C7D1E9E01FC672404E6B57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 be47ba6fa3e984a56f39a7515b2970138e39cf290bf9323bac53fe55ea0c92b4
MD5 63a926319cbe1794caf657968fcaee6a
SHA1 3245937ca12013b2547f4735f09675ae65853ec9
SHA512 c8974cfa767f9e6e847791d9e2e3adaa1090cb9b9c72c4d3a50ac0d5e83d29fe3126f54c9970cd9d47b1b5a963285cab3f8cf82e6e63970972051968b3b6b66a
SSDEEP 12288:By0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BrgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12A4523A1AE550AC6E34BC3F0D0E7C7D1E9A01FC672404E6B17E1F9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2954831f9e89e7aa609f7c4cab3acd3e6e7ffefd1b10f5a74cc7632c2f58debc
MD5 ed7d698ef36790fb3d7a14b69bc16c1a
SHA1 232e22c9de9b599451d48052d320f13325c6bc89
SHA512 80858f98c5ccd3c4d2a25eb2b6a8156cefdb5061eb94dedcf133248c3a98dcb5691d73d06cce475a17514837d5850f04e8dc43b0ea929748b2a463d07628e94b
SSDEEP 12288:ryPz5L8t0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Gzy6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18155025777A120E9D16B8278C4E24B42F7B1787217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5c98d5f6533018b1866d34f622c10e88e2038b67ad360979c07cb5c5d69e314d
MD5 e35ad91c75b2318fa21ef6f42b022821
SHA1 78a21e18d7849c2727c0778321ba8b2d50092b7d
SHA512 2359b8a5587e5ca9a42eec5ed1c991a40ef5603d0e80a763cb85d14455bb83ba742d2995b2e75872d85f59cd1ad2260ae92cb148abef194506396568ab47fe14
SSDEEP 12288:CO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F3452391AE5509C6E34BC3F0D0E787D1E9E01FC272404E6B57E0F5531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0e4656aabdfbedc7f75f34daa5ccf6bfa3769ccd91cdf58b4189b464a8432006
MD5 785cc1cd91f858046fd4a673115bbe78
SHA1 b309add733636070c7c8c25ff2ca91deadbb8991
SHA512 7813a82d5279ecc7010b906e7ab95092a39c80eb12131d6732626e743ae9e9fc02ad2bf0d05a1e7610ad806e6010306d00f44e473102c0334daa40e26392dfe8
SSDEEP 12288:eO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:engXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FE4523A1AE5509CAE34BC3F0D0E787D1E9E01FC272404E6B57E1B9531DBCC9A6AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 622b52334fde03a90595c5ae495ad9ac68d64f15dbef060090724959a3307fdf
MD5 ec5d2b2c4c57919d9e171f1abd0f0534
SHA1 afbdbbf492601f776e56ef05b0ecf193d73acbaa
SHA512 a01dbd7d5fdaeeeb3f80e2d941a64f809612910fffe862e1fc27bcb4e3f8bf12d2301ba846854653646b61991ebaf1f7fdbfca40321a5d61ba5ff4cb78820903
SSDEEP 12288:GyPz5L8t0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7zy6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10455015777A120E9D16B8278C4E24B42F7B1787217208EAF13E057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 3b273fdd492673853837eb4fdb860159ad41aff7d78056f4c21e5e9b81cb2269
MD5 2009b5987f2b60251fb8f585acfa5a61
SHA1 730e92e571570cd6db4e5d561bc0ffa51df96d51
SHA512 bb5222f692f0f29f079ce89d94e061698f862619ac841e27debfe70f87bceecd30c35402f6571e43111ff4ad017d22d467682b42bdb440a53588f24b84ea5d1c
SSDEEP 24576:0TDaLl3z0zD8gXe4i7ojhsP5Lgrk1TWb4AN5:0TuLljAe30jaNf1TWbdz
TLSH
T1976502A5B3500CF8ED67827EC8A68A02D6B27C560760CA1F03F436675F773A11D2DB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 d6ba7d82f73f7788429372f732bd0e6576f00d929dfac28604563ada3e5eae6a
MD5 bce884a5a6f6eef99b84ab8ca5cc04ee
SHA1 d101a16b743c1994cbabe1915899e6911ed6757c
SHA512 2b9d503f8a0d655b8b6912ad2f59d59add92740b743547fc3275e62a2b7a69886e17564931000b8f331fa71f8f8a55ac137d20d6c744536e8f7adfc9b69d348a
SSDEEP 24576:j3vd9CHKy7GZYgXe4i7ojhsP5Lgrk1TWb4AN5:Dvd9CHKya1e30jaNf1TWbdz
TLSH
T11775CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 49c46786ffb376e59e468e2c3671bf829293345d8bc3c475b6239dac844fba8a
MD5 b09d921f11d0fbfb9adce27525e1a4e5
SHA1 580f2dc6a8588872f499a13976ba2a7e86102d6f
SHA512 04fc6a667e0a82c18db2607cdec728fc2432a41e6093fef870badfdcafff5e7e7ebd7e24489702cafabc6f2112b64948be24fbde20dd5caad9924e8c32948d39
SSDEEP 24576:TfwvUk9RX6wkyAIbgXe4i7ojhsP5Lgrk1TWb4AN5:JMnYICe30jaNf1TWbdz
TLSH
T1EF85DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 75ae58df3ef7bac6be6dba7566bf977e2e436c0f7afa46a146ffdf12edd1f862
MD5 1da42b8181ecef5e443e3306dd314900
SHA1 227edbf5a5b397cd18431657d8f4f6a27f5caa85
SHA512 d9ad4e250896f5929acc5f59f63a4d39415c31370d5e5982a657ad197a6a57b43cfedd9e20e8fed48b18765b90c9fe4a8158680a9a865565472f567770e4b6d6
SSDEEP 49152:9YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Xe30jaNf1TWbp:QySzPvU023W
TLSH
T19B067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4fec880bed6795d106d5e8317d67bb7dbb1fa4a7a996c141b6c465824561f0b7
MD5 ea46838c7df069332e5343597fda9b9e
SHA1 19d053982f970d7d63c4372d3bdff02190b44bf9
SHA512 fcb1827d6a9cb42d54d2af67a74080b5e118443fae49e36f4208f34803a3d91a795020d64f019f444db6a5c8df21c9a8a45cc6cdcf0380633d44ddf42d92699a
SSDEEP 24576:e47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYmgXe4i7ojhsP5Lgrk1TWb4AN5:e47JUQjTirIhCnDHUPfF/ne30jaNf1Te
TLSH
T16665AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3f70d321151fbf44df0207476dbee9a1cf09e721d57ef4fd68d4c085191b4ace
MD5 3e8bef6bb917030d94198cc546d62724
SHA1 7ac8dd1e4f61c3db6e97538a5877336d1883a46c
SHA512 d6c637dca081d7e6b017405f5ed6541bb681f2c627c47b1de197b6724f171e96ff727684dea2471856f9e7a07047c3c1e993ad08e9ffd766a135ccb37effeb5f
SSDEEP 12288:Ubsf+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:L3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17E55F15AD29802D8D06E92B5C3968A81F3733C5193E1C7CB13D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 791fc8eaa1da3e33c3d8821320f99c7dc4f894634fd6a1adb15237fbee644d2a
MD5 2b22a1ec24f543a7db0997d5cd9ec6dd
SHA1 9753461c24a360626b19319f5ac5090c22b6cbfa
SHA512 608c3b85b6459e0931f351f05b7b4d0a2102ed8b5d1ed81bf3ba3cdacce2a879bf84549315836591d1adbbfcf225f008072f75dc3abb2def7d5f5ad283b208ba
SSDEEP 12288:6jjHRy5PBvh4Pp2NUUGcOjEkvpLGsIgbM:6HRiiPpTUGljEGpLK
TLSH
T1A7451711766AC75FC6A980325E37D1CCAB707D01EE45AB0773C8473FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e3d2906ccff12c022178ac1871078f6b4b9a1aa2554f118064e18c21033854aa
MD5 e3f318d9960d77475d526116891200c8
SHA1 2f34cc20908aea6cdea4f2cdd222ff07c230cd72
SHA512 c44bc2126fdef843db41dd1684dffed2f05eb240a0ccadf0a22a64e2cacd4732fa235a79797d8067625f293a795fb3dc7c704bde3e9802d70f82362f41c9ae77
SSDEEP 6144:hI+hjMfINGbNONHXGIJRtuKDexH5zuKDexHKKMnyJDJ0eh4D9SdEDK/:1MkGHIFqTKx0eFGK/
TLSH
T1A365E841A537B38FD5F75032072A6B4CAB64EC07B7056F2677C8053AD82AB65B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 358B
SHA256 ae5a8e69dcbddd5d17f19b35f94bcbfba0760a7f8cab34a11170db3529edbfe0
MD5 0e777be0ef87298911c4e54e7e004450
SHA1 49f2c353a02f85e5da3c87f1b8f27ea7b520d20a
SHA512 2b486715382f472d1f70ad836160b1f48f9e8b3aa92314a4ece89909bccf33d19344534435a256b8131ccf44b595789e2392b34500de6e762131b4da990e118f
TLSH
T1E7E0488197FDD0971E72728AEF942EF27061374165018630F3142B18A0D8869EECA56C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp43A6.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp43A6.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp628B.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp628B.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1a2848ab24d1934e5f6d43502b6df22e5e34ac06a18debaad6f3c8f10f19a609
MD5 f6d15f589138edd9872638a70f17dd9c
SHA1 fb6233511d77d993c315a28cccddd42c4cb27a6c
SHA512 62f9ba25e89510fd1ab6fffb7d6bfe41f3f1b7057b4111ddd8c2dbe66136a7375ec2649d42d5a3d7e2decf670fef2a7e918e344d31058d5cc6fab35a1a07c7b4
SSDEEP 12288:K07W0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rPgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13F4523619B580DC6F2AFC3F090FBC760F5652EC0670089EB66D0B69329B8CD99EB451D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8216f142a11e188500a9a7a8fe1cae74868066175e17cd1c8c230a5b0eedd673
MD5 4f4797e0768fa40f89fa8a0fd0a2282f
SHA1 03456afd47d4b402d44de884d65b7ce6530ca4da
SHA512 e629a9e1364a05f1db1ff16d495c97a776cee0bfa20be623b8b7df452539c9c56a82952ad25bb15ea1da368d0233f58e922854b265974c843111d0ee395b9a0a
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYVgXe4i7ojhsP5Lgrk1TWb4AN5:Tgb4mBIBhGFpe30jaNf1TWbdz
TLSH
T1DD65AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 aa8ca210d5080b9fb1214fca1df2d4d15df1077356069470414907a50c0fc104
MD5 6ad6839224963eb444dad75d877bc8ad
SHA1 0b63cd89a8a59759a0a9a1aa26e12edd59936dbd
SHA512 f5951ac0ee3fcf2e60e412f6c3f81cd0a7c448d641ef2b016fcd2185f224f37fb55df1a621b55e8a70d8fc173790b90ad3204b47fe71d6a1cc4327e48b1af41a
SSDEEP 24576:CG88u8FpJqH1bzria7/m2gXe4i7ojhsP5Lgrk1TWb4AN5:Z7ZFPqVea7/oe30jaNf1TWbdz
TLSH
T1D685F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 29ae69873af35b96d0d1c2e15aabaebd207372307c9aead7405541e740aa835f
MD5 1f3c1ec4308101d243bea3c3fc52a829
SHA1 479c4a8dc0a2e80c65db93494f66b123bee0be40
SHA512 98155e93b3bd47a133ebe51bffa6ead8795f0041983437b42863d569be11421630e02cdb9469173652f7ecaaeaac1d68ea8cfb0f3448f49dbc1052597774c346
SSDEEP 24576:wPUr+NQigXe4i7ojhsP5Lgrk1TWb4AN5:wJQ1e30jaNf1TWbdz
TLSH
T19765E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 de845a9a174a31a71055b9c1ad8a4e8f39232e3423df2b4b2e5112e0e1650de7
MD5 39cc6923db8446b8ada9b18cb42adbf9
SHA1 960c55696981e0f91235b9ee3adb8aab8a2576ab
SHA512 2d3765db26f9e8897482e74d42048877a1d0e7ba5bdcec9dfa008be5771b16e24b0a2c9bb1937c6852c1f20d98272a8c6c60556c03cf98ed236299c0d1ab0b9b
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjle30jaNf1TWbdz:EG05lO43bqU023W
TLSH
T16AD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 015af53158a830efc5358a911356ce80e66917fead8185503d10e1973bfb487f
MD5 07e99084299a3b9559187eb9a0c40813
SHA1 2cc82c98da83049c0eaf18bba1bd1022d0941e7a
SHA512 d9925f108d27eaa44a7f0c7f16c7da46e438e5fb44833166adbf6e978de517761769f49400b27fa577d4c7d19ae7690b411df8b215b2973433c725f62f50e8e6
SSDEEP 24576:Jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnwgXe4i7ojhsP5Lgrk1TWb4AN5:Za5POZ3BJt2pasx2+mde30jaNf1TWbdz
TLSH
T1EE65AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 00cf208cc619c8fb354bad6b5c850eaec818bebfec231efac5567920d7d16340
MD5 97197c091694d10e19fefed2104507a6
SHA1 e44cb433094a5a7077aac6c06d858a9e5abbc45c
SHA512 7d08a22739720540c32ca0dc9946d28b134ea7df8799cbbd92d324041864da300f36a8a99aa665d75923120fb46138dd0742e422df6b9fb7bfd22a4139b0fb15
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkegXe4i7ojhsP5Lgrk1TWb4AN5:RNc/zEOVHFIe30jaNf1TWbdz
TLSH
T1A3858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e1152c71c916c38f4bf44eefdd42049683da476e337ef9d806666770b862d710
MD5 6abfe56d6bf7a5a37b0b62ed24b814ec
SHA1 05f48b6e81cad8cfca70838863ef200475447e19
SHA512 845727b4fb7e663c3a4cff5635a9e188a511ae62c9c655490efd39776eaea4f60545c61e9f4da1a0dfff56c784e2366c48d024949b7df00584dc046266fae698
SSDEEP 24576:OTkNvNnaFeYhJNtmZBmRgXe4i7ojhsP5Lgrk1TWb4AN5:OTMwBtOmse30jaNf1TWbdz
TLSH
T15755AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 c7ffc4b644a1b83c3f683f021f6a89861d3609a4bc894bec2156bd5196760426
MD5 d473d4ba07e99392fe9aec46595426a2
SHA1 6395f5c142c695a2ff29c920a350d5bce097f235
SHA512 93d88335a23deab17792180a0d1f642112ea97260972b7546c3c18dabcd1139a454a9aa99d2d31caff4220dc310c0474595917caa3bc85d3b6c7c94829074640
SSDEEP 24576:OD3FHshBIYQgADgXe4i7ojhsP5Lgrk1TWb4AN5:ODVHeBIAA6e30jaNf1TWbdz
TLSH
T1B875E17DEA5C04E4E57BC1BCD6A38A06E77138A903215ADB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1732-207-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1732-215-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1732-213-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1732-219-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1732-206-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2008-439-0x00000259CB1D0000-0x00000259CB353000-memory.dmp

Download

memory/2008-648-0x00000259CB1D0000-0x00000259CB353000-memory.dmp

Download

memory/2252-149-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2252-140-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/2252-129-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/2252-128-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2252-135-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/2868-0-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/2868-1-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/2868-8-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/2868-26-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/2868-6-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/4128-392-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4128-201-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4128-195-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4128-193-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4192-538-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/4192-596-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/4192-556-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/4224-170-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4224-169-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4224-553-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4224-390-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4224-554-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4224-176-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4440-396-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4440-222-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4440-228-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4440-251-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4768-395-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-188-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4768-181-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-182-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4768-391-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-393-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4784-150-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4784-143-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4784-374-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4784-142-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5128-166-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5128-389-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5464-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5464-25-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5464-205-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5464-14-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5668-388-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5668-162-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5668-156-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5668-154-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5932-124-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5932-118-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5932-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5932-329-0x0000000140000000-0x00000001402D4000-memory.dmp

Download