5638ba11d0327b420d1d2d0b27091649e90ffa035b1e2fd0837ca5f884ebf04b

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
Size 1.8MB
Sample260903-xategstelf
SHA256 5638ba11d0327b420d1d2d0b27091649e90ffa035b1e2fd0837ca5f884ebf04b
MD5 f56ef320ac7c9aa27c9e58c1ea25db12
SHA1 765ffdd9deaaf25564e6bb75d6bc07372b1411c7
SHA512 1b84f3ffb67056bfbf7aa9e5502a97588943bbb0d8b4abc33f79f151d822de14a08a2771ee8b9de12f9d4cb310a29c158c228c73ba19ff1eaf2c78ac8688c0ee
SSDEEP 24576:fgCikESnMASgXe4i7ojhsP5Lgrk1TWb4AN5:oCi+nMAFe30jaNf1TWbdz
TLSH
T19585E11077D0C136F1B319768ABFD724946DBDA15F6885CFA3C81A6E4E706E0AA3071B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4320	elevation_service.exe
5672	maintenanceservice.exe
1764	OSE.EXE
2380	PerceptionSimulationService.exe
5052	perfhost.exe
3320	ReFsDedupSvc.exe
3788	SensorDataService.exe
2940	ssh-agent.exe
5536	AgentService.exe
4800	SearchIndexer.exe
3644	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7072c486238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	OSE.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085c75f96d33bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003954dc95d33bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f2431e9ad33bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2164	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
2164	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
2164	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
2164	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
2164	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
2164	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
2164	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
2164	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
2164	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
2164	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
1764	OSE.EXE
1764	OSE.EXE
1764	OSE.EXE
1764	OSE.EXE
1764	OSE.EXE
1764	OSE.EXE
1764	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
836	Process not Found
836	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2164	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4320	elevation_service.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5536	AgentService.exe
Token: 33	4800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4800	SearchIndexer.exe
Token: SeDebugPrivilege	4320	elevation_service.exe
Token: SeDebugPrivilege	1764	OSE.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1296	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1296	2164	2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe	90
PID 4800 wrote to memory of 5768	4800	SearchIndexer.exe	102
PID 4800 wrote to memory of 2964	4800	SearchIndexer.exe	103
PID 4800 wrote to memory of 2100	4800	SearchIndexer.exe	104
PID 4800 wrote to memory of 1108	4800	SearchIndexer.exe	105
PID 1296 wrote to memory of 3644	1296	AdobeARM.exe	107
PID 4800 wrote to memory of 4148	4800	SearchIndexer.exe	108
PID 4800 wrote to memory of 248	4800	SearchIndexer.exe	109
PID 4800 wrote to memory of 864	4800	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_f56ef320ac7c9aa27c9e58c1ea25db12_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5672

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2380

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5052

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3788

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2940

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5536

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2820 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2820 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 1206bc1d264ce947e3046b7ab199671ec0d86bbde4d3174b92ad381e7757e775
MD5 aa22cfd796853e64cffd96a75a744cca
SHA1 3b3f7a103ba59c65a0e236b41d2a890b54948c72
SHA512 aa16082bcba8c6eb08c78dda9efc1ff5d42fc1749974790307fb9d33f4810ad2a9a005826e758638d424b31a8d0d80ff6ea262434731561f455c5f870cd035ae
SSDEEP 49152:/TfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJwe30jaNf1TWbdz:/TfiG/nzU90cU023W
TLSH
T1E6E5E526A2C8C0EBE5642170CC69BBF900546D78DBA2CDD7BD447E16B9307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.4MB
SHA256 f2d51827f667728521d47328342a66a166a214322463ba4f6faeef053b813dd1
MD5 1f3a1f63b56938a100af9d8e362c7ff8
SHA1 d2d8a63cfdd173a1f0c92f87b915d89940db5ebb
SHA512 40cafc345be99b5c483e1cb73530dde42c24b9aa9c35815b56e1402e58de0483e6739c731073865a28af8a078642f5bf9046b41fb36a2b508831f8f902a9d3c2
SSDEEP 12288:EFKm0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:qK/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CB6522537F468F83E146C2B010E68BE5E0F9DE90AF044AA747D0B6674DBC8C65DB512E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.8MB
SHA256 a796c668d5eae19e21072bb912fa43540cb3dff9dd3dc461b347d3d46cb48f50
MD5 840531665b7150899161ccf2cb905625
SHA1 36aca4185041538ff670ad73fbc4425580d0415f
SHA512 3db132d58f516e086ca8038e384c8225c9443b7222932ad1fda96b7652e55cb9cd7d011dfcc684d958c1d03b59278cbe783eab89fc2c54ba8db218abf62303e8
SSDEEP 24576:3STAbD+OmeDgXe4i7ojhsP5Lgrk1TWb4AN5:iTAGOme6e30jaNf1TWbdz
TLSH
T15C85E11037D0C136F1B319768ABFD724956D7DA11F6881CFA3C81A6E4EB06E0AA3071B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bfa7ce0e9d1c9201afe36d14ae3064fbd6612402f18ac0ab79fcbbf431fdcb49
MD5 1f2401a384e07ad2139186cab9098129
SHA1 ec3eb53046e6d34a38661060d9a7e116419fc924
SHA512 78afc59e2d305442f36b032cba09d61bae3b8369f4463767b1b3f00230a15aa2d112de566e1f622e055c9280d024ce3697e03791295c3f9ba9771e4fd9feb134
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnWe30jaNf1TWbdz:63q6HjBbU023W
TLSH
T141D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 7ba51f0ca024bd0e3bca5e9bb7d28a131f1e71b0100615679575eb466c2060d0
MD5 a56a734243206b8c7d616afb3f91b749
SHA1 95c569bea08dc7d91f5007fd2649f259ff6faa6f
SHA512 c1e205cced9bb1c5e20e272fa6f25ddc1bd5b9e6140b402b617e1479ec1e5138b3374a2de4937a3cf08fb4f86b303ae178f8f5453969c5a2126deeb4de0ebfd6
SSDEEP 24576:sXYfDtczACgXe4i7ojhsP5Lgrk1TWb4AN5:Ltcie30jaNf1TWbdz
TLSH
T1E175F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 f489e5ebb2da955e85728075b1b73e707df79e9772ed8069435b499043875c8e
MD5 416f901e90743e33d6a09e2a9a1c2815
SHA1 63fef043473c03a96fae54523265c33d27544c87
SHA512 a55d2bf45569bd3617e94f846b4916c124464d9b7ae393c06fe258e4a6e9822b5c22db5ae197e15556d5dbe1e343f5219b1056b58672c05defdb69d7798ab356
SSDEEP 24576:x0Le5ji0hmxlrM5gXe4i7ojhsP5Lgrk1TWb4AN5:xPji0AL3e30jaNf1TWbdz
TLSH
T17295AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 62a5ea2c9583b67072b563021c0a5f44e0b31fea19b7cf5a6527348e94d6af7a
MD5 33f5ce70ffedf99c824dbce7e547b1d9
SHA1 c5348502a667e354c9416b333e3f04d4ea9d1e9c
SHA512 5e5b4237bed6301579822c2241e6688983aa8a3d6ebd4307a7e61bb24e801b30ca069e9348e40dff4c7cf0c65796a6c1abb48b7779abf38eb6e8f88274327a1c
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWE6q8wyuLgXe4i7ojhsP5Lgrk1TWb4AN5:k/ezSC6vUzPvxHjyze30jaNf1TWbdz
TLSH
T19E756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 52a9feeb40fdaf4e0f6f456406dd971a1f09c60b791ab49fd8ccd7e7dda82609
MD5 171d655e1a871d70a5408d88e599c21a
SHA1 bd1cb210a66a47f6cc78af71916e8e07c313e506
SHA512 934e3879f8ac19404e915d60b0bf8f1c7e342cb30e39265bb507c207e838c29406b58a25dbb6efdb91471945361430b7adc744eb939df90c1a8901c714165edc
SSDEEP 24576:KVbqPb88hv/l+6mgXe4i7ojhsP5Lgrk1TWb4AN5:KVO88hXl+Qe30jaNf1TWbdz
TLSH
T10D559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 915eff6e52138a3254577c598df0c301a2c00ea73083f6393f2cdfe45f77ddbd
MD5 a24186a6abf9028f1e0bc338069e3ee2
SHA1 bedd1faf7c4f77565af5dc6bb0b610510bf4faaa
SHA512 f30d45dc5edad51c4102ec30a3834dbeced08e1634acbf8bc74c54220692fda5a7d950efc4f60fb7adaf93d57d0045cdac86d9dafa48d5102b92c95a8e6e92b5
SSDEEP 12288:7y80DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7y9gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FA6523919F5409C6F38FC3F4A0F7CBD1E9A11EC065448E6B47E0BA931CBC899EAD4469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 e7c616982c33f1c62d58f391ab3e52e1fc124adc9989082e1c012bba3e131d83
MD5 72a2d2bd2ade5bcb834078f489647e3d
SHA1 147bbe32cc9d9083a5cd34ffdf4b85101403f162
SHA512 72a167f5da1a1050d308e41d7cfccade61f8dede904219201af72c28e0b6ff9fc64b864b50ce59776af26ea675f8d2684ae84059a06b5be5ba7a990401267413
SSDEEP 12288:oeBNUbTVO86Uh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:oJIUOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18385CF3BEE28ECD2C27E8DB85691C740E7B278704B5193CBD1A4C20E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 22ebd0398fdca7bd381da66fc4d1ddc7406e585ae2efdcfdb939641690898e27
MD5 7e59d278e5cd8e2805b1397b2793f4b1
SHA1 9f874f3a944239f64b6c160c351e5a382ef6bf78
SHA512 b6a5a941d09f68887cc0424fb2f67c73cfea5281334817906a2d74681357915aa2cf2a48c58767fd9d2e8c7fec3f538afccf7ecb53046549a1001643f249f56c
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THD:6QvGAdlCEL8c/yRNw5CCU023W
TLSH
T1C9267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 4fc0ae5027c3d4e78f07acf563488e618822f84bdc77504478b0f23fd9445b13
MD5 a39b26768d969c37491576622b03ea7e
SHA1 7eff724fc779d9b427201c1e4d1b5f7e2568a1ec
SHA512 e46f8ff91daef34b541de2774a083182059f2db83bc3a9b807bde235d87ffa9aa6433265645a09b2130ccedd8bb200aebf617dd66db4416c645957447f2a8a55
SSDEEP 24576:mKewsAjggXe4i7ojhsP5Lgrk1TWb4AN5:pljne30jaNf1TWbdz
TLSH
T11B85E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f42910d106c04e8984f41cfbc50eba6f40ba0893c702a5d098433c02788c761b
MD5 9fe5c4d1e58f2d1249f4225f902530b3
SHA1 5a8f8622a5f7a5702ab435e14a466e68c10c606f
SHA512 9f99e7018e0e378fee133c512931f1c02d45436a0b20e51130dd22f72cf0384863e6e06c9cf91f5aa97678a844b3449673b3854940dc978da8d372f6c4d63348
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHPp4W:4UEtQevvqc2W1cpV2EI32h4W
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1e1c16ba5d14e16c0ef13a848ca1b12a37e5e7014886a2bdf2728303f169756f
MD5 1d58c685b693f61c3a7947d2b24b72d8
SHA1 dba98bf55ae7741119c4746e3744d8820bb9d967
SHA512 3ff639eb71859bc48cacb28690cdad06666e54acc48c639cc2146a4c40834a0d731bc52a63fcd9c4470a4c040ac718073a4afb24417ca9fbc5bce92abf5bef40
SSDEEP 49152:MCbRquA/m2yL5zifFiV+XenmE3/zHe30jaNf1TWbdz:loqHVjnm+U023W
TLSH
T170D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c30768344e4eb69717f2ea10b7695113b1525216f4e3321f883f46f08a849a4c
MD5 c50385a2a89dd11802beb07a5fc22b9f
SHA1 dfd1157e344cd6e60ea158f59aaeb7d220cd7a09
SHA512 8a5582d6f6f6825e6a0733b094ae899c6a7aeef90fd36564721e30de29127c1e7d921d08467ec6159d5df98390b8e51ea45d54d953f93b7c93424af2dbbaa650
SSDEEP 24576:oAhGLJIFoiwtA5l7S53XgXe4i7ojhsP5Lgrk1TWb4AN5:oAMyFoiq5ue30jaNf1TWbdz
TLSH
T109359E81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 0f64660791291c7f9d9e0636b95e6e42d69ac4e0c6137e7a609c42ceccbbfe12
MD5 07344571029cdba8022d8b43e9bff6a1
SHA1 26564119ecb78627a6341ce56d216638192c1c7d
SHA512 2b2b74b304b059c16602c0b46317be924cf848599b96c150156431b7ee5356336810e049076e184eb122823c206af600bbbb3a87d37ca8213aeae739a6959fcf
SSDEEP 12288:Hmw5HEjsChN4BFgl0WDm+Cy0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:GwuVOW8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D475E14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 c2ae5c313984ee30d0ec8613653b27de4b01b2e9eb2d75f6825c2ccd588c19be
MD5 ed9d500e8bdcab1e42af6a1f6e617701
SHA1 44a647a7b6f8c4d57a9b62b6556c78e48021d2f1
SHA512 383625916926d0fdcff4fa57552a8dd5141eaae46aefe411d0a1d046016af311cb3a20ba7fab7c3fb057f78bf155e14008fcb7d8b247af7c5b78265c5a43e3e4
SSDEEP 12288:60Z1Iyz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:hZuhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16865129637E421F9E2978278D4F68B41E7B23882233147CF02A096A71F76DD65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fe88c242eb5e6fd0716b5ececd6ef34515a767b87970aeb5555f470a76661510
MD5 725626069cbce5ffc032af398135f1cc
SHA1 453101560b83e23e24a466756b01b4e4933b7731
SHA512 61f7d2a529ae59699660f4da1ec28383715b77dbdd67a9810c7651c5c4594ea20c47d3ac097e5b01e62e79c9ba479db6a70bdfccdeaca857902db5faae0e245a
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UH:gQRQyi36YOcPQLvw2gAf+PN3tU023W
TLSH
T11D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 660fd669943f0615261d2eeec72bb092445715c2396a29ac279f54ae42577fae
MD5 421da9fb3b03e9ba3d405f569f17f71a
SHA1 88a6f5677f4ee1cc6a9d04fb128c580a9c69f331
SHA512 1610326714f080d7a0158e420da5c5661a67b1381ff166ebdfd0d86223af395279f46d254debb4cb34eedb7e61ea8f3f8fa59f6958d673fac34e1201ae0c143d
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UH:ZQRQyi36YOcPQLvw2gAf+PN3tU023W
TLSH
T1F0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3bedc3f6f547973692c0b2c3bb31dec605a1090070fe568e8cc8a48d3b0a0b9c
MD5 fe9ae5df5d57b03db88b26abee47ff74
SHA1 8e13a269cefbc6fbb3f452624a37dd8795478174
SHA512 56aa22661a593f1edd306db69b5f075ceb796379f1f8b191b20afcdd11624ec257ed20fc725be0cdd3d1c2518837144f66f5b2ca71f846f3f7b339126d792d02
SSDEEP 49152:t68Qg55nhheWu7PNU3/3e30jaNf1TWbdz:rthWRc/3U023W
TLSH
T110B55933B2F60099C04DE1769F4A872196E27C718FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4ce7c9f6344692b1d94dacfe800f851af26ca77c73b12844b5bcb52f2822763f
MD5 c94df7c2b37f31fcfda5c0e09883a0a9
SHA1 7e535814933b04e054c6f3fbdcd90039d5bfbe7b
SHA512 24074e32c3183dd306ff9af5f063753f60b6497c8a25ad4f963a39f0bddd9087b57c8f9d60f9d68d44ea5b9e8410850777e869a5db29187546dbce9b4053d629
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99x:Dy5112gYy5azzVvL69nLKnhZYU023W
TLSH
T13B168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6b4e7034ea44d8295a4192ecd7c9a0444d144665d1141e534bc7d399c36de2c9
MD5 7819f58f800f54960261c6ffd815e946
SHA1 f1d22ec87e224eb57154d334cf7f9f9b0da7c64b
SHA512 1e8314fe6c3c643ebb5746c67aad65a73830d53701c9503e53e4b2b4595b3c650657251ec4a0900e1999aad93ac3bb132c9d1f2039d12746a72b30bd58124ee1
SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl/e30jaNf1TWbdz:qu6JmVxd2d/U023W
TLSH
T10BD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 815d9884ab7a286b8ec84bc3f49a3eb241f086b5b357e3ab44076b220c549c36
MD5 9d2c4d4a30e15f60b66db774f9ef04f6
SHA1 01699d08c9fb09957de5b7ea70d1ecdefe61550e
SHA512 a7a17d66031d4661c91015e4856f4b8f39948f4de0defc25a423799ea95f36618700713a95ec5ad354e868f561544b6044fcced9933985089db045f30fba6bb0
SSDEEP 49152:81hpsNoJpF1A6UU44CwH7R4xhe30jaNf1TWbdz:8mifPbR+U023W
TLSH
T107B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ad1fed43b7179cf43ca92fc99dfd8702b3648f5766d55c2c993ba3a2daa08939
MD5 b9bd99970e493aedd0645385aa3bc242
SHA1 dbf7db709586785c9a85e6316f87ca863c8dbeb9
SHA512 66c87581e822ac16581eba87ae0460a4df93741d25760388d53f60d191e2c00eb2db48ac4f8349907a762d37dc4ae8f4f0a03cfc4f240edc67215a622924fc8f
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHqce30jaNf1TWbdz:L5dKTi61cU023W
TLSH
T13AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8e08df0b98e0bb33989e3495b38d6db891f65831c00b5dae051eea587d7dda4d
MD5 e2aba890d744b2815f496bd9c60e43d5
SHA1 97be54476474f3852f1bcfaec9150a91e11fbb96
SHA512 82bddb651d5976be6fe3db57904bb4a2ee9bdd62b1feadd7aa8e31075b0a52cb8f0c733e1e47e164b98b93ae5d57b3199a84a078cb41529e660b5a7cce08fef5
SSDEEP 49152:NhtSn8EApI0figngiDn0AP5wVe30jaNf1TWbdz:cX2iyphqU023W
TLSH
T16095BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 891690d7608d45dbaea97cd8c099c819cc48bd4fdb9c335ab78b3efa62115e0a
MD5 f32bd4caf46a4ae3ecf143dac2bdcea6
SHA1 eb42b66e3a8e25acac51c57cfdd77f496ef270f7
SHA512 48ee67c2dd1342aa095646bf7a4ef4f191d107c081f8b759b0c82d158b43844124b357de65afe81304cb3e876d28ec2c9a0b289f6407b0b3c4ee448b3ce696fd
SSDEEP 12288:TE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TFgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D3652391AE550ACAE34BC3F0D0F787D1E9A11FC272404E6B57E0B5531EBCCDA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 1cae3e99caf34dc5e14bf874024ab8452bc0fa900e6d47b7f5b3594bbc55f8ff
MD5 52ffc5d3e3a110e357c58b5cb3c556a5
SHA1 6529eeedb12328beecce80eeeda6d1ca9a764034
SHA512 055ca1d0274b1192fdd7ce71291eb8506be76136fe3e1ff848351225a69b6343b8b8890990c68695ebb4018a144b620964b21d4dc59aaf034bf4eacec11b639a
SSDEEP 12288:tn0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:t0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15E6523A1AE550AC6E34BC3F0D0E7C7D1E9A11FC272404E6B57E0F5531EBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 ffdfdad345d2341fff914ecf41498e3a68bf6416eef2cf3117ec8cd84108920f
MD5 b903c664e804d9310930adbff7a66772
SHA1 0671862e53bd429fc1d0912ebebd5be4299ec37c
SHA512 4de97f6827bf06a0a82e2fbe982bd33032e3175175360f654f287e30c8b8959e4aeecac0d9c64af0a6a485f6df472fd15e3f6351a450fd1631e2cf86a4a51c43
SSDEEP 12288:pJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:pWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16E652391AE550ACBE34BC3F0D0F787D1E9A11FC272404E6B57E0B5531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 226ad534e5c9d2ed709f0aefa12fabff9c55f8a40f9ecdb1702f804747c37c7e
MD5 1ec1b6ec0790949462b69f871364b821
SHA1 44f34684f82c7ddef7a295c567e1d4ecf7869823
SHA512 9ec3b410a04eea43c4b1d0cda9f2b1e80f430cf72a8bd06896cebe14d373e2af8a3c506e8ba9e255c8e81394236bcde5932bb53b9e41955737282f937c6672fe
SSDEEP 12288:NV+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19C6523926F6905C6E14BC3F4C0F38791E6F13DC173118BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 a53d117b55a781eab212e558be91da01a8a2903c3ba06729e9cd46ea028306ae
MD5 3ed6c1a48da21f1105d4c3ec5940be4a
SHA1 b695937b5e403eb6870f907db826629503d54eb1
SHA512 bfc390ccc0e423c920f34b13831b16e391f063a2dcc03719431092b022bb8970f93b2ef4f933a0307141d0b8f5cb5f94e1bcd763876b05b163ee8e9c188c3c3a
SSDEEP 12288:G20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:GvgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D3652391AE550ACAE34FC3F0D0E787D1E9A11FC272404E6F57E0B5531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 bf4759412751563e31e626e29393bbec35aab1b5cd53f6d72795850b4c1e03a0
MD5 7c68f629ed64ef1e422218fa4e0e5194
SHA1 eae0c202067dc7a906f0adceb6750d3e68a48d62
SHA512 18332731b93bdf4b7afcded10befe3be8f138aa1f8f9ea59c4f26664bca04b3dfb621dca6d2ed68c6ddf178d4fa1c58c39526a7c8784d6196b12ea81ea988031
SSDEEP 12288:Fr0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C1652391AE550ACAE34BC3F0D0F787D1E9A11FC272404E6B17E0F5531EBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 3b026d75a16dea1dbd34f6f14f91b321f4a6530f7bb2777659681afb523835eb
MD5 cc7a0d07db968bddae7aaa41fd2af208
SHA1 ccb573ba3b6accaa306c38c40ae337ed2f7db94f
SHA512 7a05f803feaac88f4c9e4f5023db013296b0f8af42ea77691b503532f2fee76d603dc575dad8d7a8549c1ef166a14fc1218598dc8935bddf8eac28602f6d6bfc
SSDEEP 12288:G/0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:GsgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15E6523A1AE550ACAE34BC3F0D0E7C7D1E9A11FC272404E6F57E0F5531EBCC996A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 82cc5f25c4f09e2d0e3b638456bfc203dd5214dd885186080c9aa0ef553f03f6
MD5 0bb0640e378e5c434e8e74b70f1c5453
SHA1 1f25f6fa8c853e233bd11b1856c7bf4d72407133
SHA512 6b67f073709f7b218d6721ac50e0d42f3cda3da53e986770201919cde4ec896dd57387ff9b91742f27b0a49ecb58872e183acf91fce7e70e5575fa524ed7f5bc
SSDEEP 24576:jZMNzFVSOUgXe4i7ojhsP5Lgrk1TWb4AN5:jZMNzfve30jaNf1TWbdz
TLSH
T14E850195B3500CF8ED67827EC8A68A02D6B27C561760CA1F03E436671F733A11D3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 ea676da37b89cee591b1342fff708843213510ae9dec2dde9069b261b0aeefb2
MD5 b4ae2b40b1e1f560e7456d81d83b4e79
SHA1 a67623acbecde11da6b8b37f5d3ce98dd25962c1
SHA512 4408eb079ec37c7ba23f27b6b6a33f1ec4ad6473c5fb5a6c213d65dc3e8bfcb8332bab917098cff877b527619075b8ad28b5f9095f2d6bb5f180f39abd2d5be4
SSDEEP 12288:fQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BF652392AE5509CAE34FC3F0D0E7C7D1E8A01FC672404E6B57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 f5cc3caa4fe9366cf6550c9808de80dd1212a8a12de2206a16af6c3031103432
MD5 a08373be1459683a372f7ba50acf7a27
SHA1 c5e40b56c47d680c0c4ff2ea77ee0d77e4f1a029
SHA512 758fadfd7edb0cdf957ce9e1026c15fdac36e59b0184101d7277e43da0258a043d0786129d7a3429dbe9d189ca8f0437e5092d95963586d864f0518babedfa56
SSDEEP 12288:ts0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:tNgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19C652392AE550AC6E34BC3F0D0E7C7D1E9A11FC672404E6B57E0F5531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 490a8cae518092a82441697f519ff191f8d695dc4a0d0e031d3e905f8a8a8a05
MD5 77b7869a812b5574f9814e8682f66db3
SHA1 2fc52702914b16bd17e22fbf8ebc7880e2ca89bf
SHA512 111da1ee83faab71a66387fc06f225601a3a4505929376c9a98b3d70fefd8c9e8d29eb81e5045fd76f6bd26ac58350b8c725116d32fcb0ab26699714cd0f3545
SSDEEP 12288:zyPz5L8z0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+zywgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16B75025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 46bd57f3bfcdc7f7ad2be3525ae343320cfe3e334530ed0b3cb66f7cc3649167
MD5 dc4be6b5bfa5c82ecf8a31083a9a1002
SHA1 af772a72a45853c5bd5dce1f75f78f2a8f489618
SHA512 136a47609137a48afc643f99667ffea7e17d4e7233b152bea4d1e8829f5d332fa7fde212eb9d2bc854db7ce100a9c57df192e6b7f583a8e1a5ea79bc7819746f
SSDEEP 12288:lQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:lxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T187652396AE5509CAE34BC3F0D0E78BD1E8A01FC672404E6B57E0F5531DBCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 01cbbf4701fe8bc5bae5902be9ff9a0b15de389e81584634a0d7ef1fecd9e22a
MD5 e4e48999b95c9742d77195ec341f3f58
SHA1 9d11a1ed4937c30e8e0d9600af07870d280ef7d8
SHA512 a38695edba60990b0e2cc2dc125cf3a06809f5a7a1044319d80eda7e06ee7f41a7768278a6e75c68a5c9c28f08157a41e88e8f77311ef93fa9432c905b05617b
SSDEEP 12288:HQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:HxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T103652391AE5509CAE34BC3F0D0E78BD1E9A01FC672404E6B57E0B5531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 0aa2d66b6f54a8308c05797fa956313f0bee6d975cf8ddf2ae05ddd537524383
MD5 ddf3621cf97f75fbe77e5b3f62618bdf
SHA1 76c6391dab33b8e1c8852bab13edaa8e61a9294d
SHA512 7f222e8733ddeea81b4dbe9b0ffd4326471be0f3b93851e8961c378446dcd106ea1c7639354b6bb69fc4ceb821d01ee17bc08aaf509d5314770af15f07d35fbf
SSDEEP 12288:tyPz5L8z0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EzywgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15775025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 02523e76da82ed487f6aeb006eecf21c5d961bc09917a62347ec47a9b45a1e96
MD5 f61928ea54516265f41d99dad1e01625
SHA1 18d509ca0bdb06e0dc46904d895cbdf0fac9016d
SHA512 e239d1a4b979d37693b7ed654d4deb6b5f233afed12d345592b18b1826902743812ac9f291b1aa800fbbe3672f61a739ed7dbd2093722842bb76076de034652c
SSDEEP 24576:xT2aLl3z0zDGgXe4i7ojhsP5Lgrk1TWb4AN5:xTVLljSe30jaNf1TWbdz
TLSH
T1578502A5B3500CF8ED67827EC8A68A02D6B27C560760CA1F03F436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 f0387efad31139d188915bc48add507ef6230aedd30f341fa8d7855e843ccb04
MD5 d37ac2612f6d0125d93256dfb150ee45
SHA1 c313341e0b2e48662df70aaced1fe795fdb31c4e
SHA512 cb75036cd233134890022898cc50d655cafdb49dff4a7524e70d76358943b3736420fc1839eadaf05dfa3bf351d5b809073923715ad4c7dc5e8abfefeb89cad6
SSDEEP 24576:z3yd9CHKy7GZqgXe4i7ojhsP5Lgrk1TWb4AN5:Tyd9CHKyave30jaNf1TWbdz
TLSH
T1C495CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 39b476af6ed72f24b40fd761b2c33644dbfecffd19ab514b3d226009f0488be3
MD5 51d32142879d619c364d3c72a17ba3cf
SHA1 85806b9634725fc65e8ebe9d4a31f7c2c343c355
SHA512 087a40c8f83197056f298a416ceed1d0cbfc82e5fae8e033b2586edc8be9d2dc7eeda8eb0a440bcc03a2c8cf116e80e7f593336df76e29b610bdadbf0bccc2bc
SSDEEP 12288:Yp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Y2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14C652391AE550ACAE34FC3F0D0E7C7D1E9A11FC272404E6B57E0B5531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 0e90526e3a076867c29090d935a547a76154c36af254893ea28efff3e7c75540
MD5 1bf453152d8db1bf8c0b841a0ceac87f
SHA1 2bd145fcce1f08ad3cf22e67d744809ebce3da08
SHA512 a914ea6a907e2085110c26ead0a4bb136b0761772da970d35afcae3fe9b13c645e16da2b6fac7a6b87827114571d60fa27d4080f8c782fabbbce5c8a6e12e353
SSDEEP 24576:tfwvOk9RX6wkyAIdgXe4i7ojhsP5Lgrk1TWb4AN5:1MnYI4e30jaNf1TWbdz
TLSH
T1D495DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 494c3be9d12d6f76df5885b32993a685100d7e74d0009336f15d50931e3d5fe2
MD5 2ae58b2f1fc266c393a73c0277a67bd2
SHA1 496886cbb1c9480a9f3e60138363ada213692ed6
SHA512 2298953cd9865cfa118d1756f0d87212c7be5154dfa4967ccfb04ef6baff9e3beaecdba8bb1d70d6aed543d7b604bc0360aedc6ea078d3a287904fd8c93b5c7b
SSDEEP 49152:uYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01e30jaNf1TWbp:gySzPNU023W
TLSH
T10E067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3cf601f8000f57b2cceca61cbaa2bb57f45380ee1568c43b6195c344ca582be6
MD5 0d25b0648d52a0108945bb48967e3938
SHA1 2e6d18d72e518325259b2a5e1fb84f95db2fcb91
SHA512 62f906d6e9151d5e83a9a1f5b9cbe97decc061d3ff96291d979555aab65a66198aafa8cdc8844d4817bea1bf46aea80e9340d4d44aef9eb8c1ddf15a2e360132
SSDEEP 24576:v47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYkgXe4i7ojhsP5Lgrk1TWb4AN5:v47JUQj1irIhCnDHUPfF/le30jaNf1Te
TLSH
T1D165AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 0d7275999d6fad63d09ea62f3e6ced322c5758a5fc1eb123f05d1f3eae12d0bf
MD5 e9ee59cdf4cc9ba3df8bf2e2e2a1ffec
SHA1 a060fd1b53741a7086e524977f23943cdf52b767
SHA512 ebec86d2743b42e8f5a38f0e98b9dde3abe12943c291f3aa6b6df7c2598456036a45395b3b82700e4d80648aa4808a6509aba3c78172660c82c0be445088744d
SSDEEP 12288:TOsfg0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15575F15AD29802D8D06E92B5C3968A81F3733C5193E1C7CB13D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 8d54f8cd392647e608b73492c6543a92ece9c666a7a5578a9e1b013200fd7e3b
MD5 366efc0ca504282f83bf69a9d205bf5a
SHA1 3b22ab7535d72031028daada45e10828f0024176
SHA512 48703e25f73225d1fe0775c82339861f58dd97b45fe7b64f66088cd324bc5a28ebeaed2f30c6c33ce7eb668c4ade5b95c176018fde17a8e0cfb091a905410f31
SSDEEP 12288:HjX0oy5OVqDoWAj8r7bT+Hf3AJLfLHGouVmUvG+:Hoo389vbqHf3AJfHGouVmUvt
TLSH
T157452911762AC75FC5A940325E33D2CCA7707D05EE45AB0772C8873FC5766A8BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b20a9acecaadb5127b32f6ed6dbcd58ad7a9e2bd4a5f5cb517860f8ad006c1b4
MD5 cb4a4038a931b6bae51caa45e3066adf
SHA1 1aea31020358b1de94671402976d2056f5cdf4c8
SHA512 b3f6c49e8a11c82ed6d42ecb47511b0fd2f08dafaf9f20df4a1bee2888eab8568e5e60d4bd16572b5f9ba273ba1e98eb415ea9e0146c8e116ba6568925247d6e
SSDEEP 12288:SofWL90EAcOOSXiFs1Pe4/g/cA/p+YOC6xWQo/:bWBogUA/p+YOHpo/
TLSH
T1EA65E9819137E38FD1F76072033A9B4DA774EC12B7096F267388053AD86AB55B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 178B
SHA256 eca5309c62ba43d12c28ff4080ca2faa5dbc3779bb61a0a9ca8bb769d0acec67
MD5 417e40dea167acb823d4e0d934eb678e
SHA1 e9a3608547048aa75e709be14419161d51ac78e6
SHA512 5f393a3947ecbb83d07c01086fee64ada056cf89680101dc5bea1403012a79bf4bdebd58ffac404f156f068774360a7639795f6d812ea6ffe7ae26df8883f24a
TLSH
T18FC08CA2213E50FA2B390083F66B2FA610803B50E34DCB20721C3F47B06340B3A2BA58
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp51EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp51EF.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp6E43.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp6E43.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

7072c486238bf42.bin

Path C:\Users\Admin\AppData\Roaming\7072c486238bf42.bin
Size 12KB
SHA256 88a445c3a684e2d4ed0f38ef156b11a3eec57c2032808a96989abbb771404b30
MD5 bcbd7d468ab09773219ebf601e72baac
SHA1 0fea1068244efe5eb5a06ae56932c9d34f85623f
SHA512 62d68d0816f4690c6f674a242aac658e67b53deb39a77792db345cd8453e95e88db54cc5b3c1eab9759ba0e8bb099af742b253dabc113a01a6f35d35a624e764
SSDEEP 384:c8ffMIDuq1RXBk62H1qaEeMAWUHi9ZJ4ybEwr11:LfMI6q1GohYCZJ4yNv
TLSH
T19442BFF64A9F9EA4293F832CA63F80F5B9B74117440924E4D42DD1C3E3512698AB70A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 5a611e032b47fc2f5b542841d103221bc4eeb5ed03dc2c930fd38653c2f61125
MD5 49b8cb030e46d8f72fddcbe772f37c9c
SHA1 b3e5d50ef785673576043738230ee8cea3335d87
SHA512 c5e428070605197bf4434e4fe6049bee7a0ea41239d9acaf8207f5f7207c8cc7e23297d561b2e0228f6e60964a90e905cbc60c8fd67a0303fc434bba56a9f2e6
SSDEEP 12288:ga7Y0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3ZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A56523629B580DC6F2AFC3F090FBC760F5653EC0670089EB96D0B69319B8CD99EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d1d8a545b786214630dd1b69f3905c25a7cb5b31704b954cc0ba30f83b8a94a6
MD5 06134f479bf008d09358a88b94b2065f
SHA1 c89170c49ef1cde295dde76ef8edc7179220884a
SHA512 b9d1dd577be863c3e9441e362d90a049347aaab4ff7bc9be7da812e90ba18ee523f5bbd12aa2348ead9e70408618edb4573b7d47b24499264e1116489ad4df4c
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYLgXe4i7ojhsP5Lgrk1TWb4AN5:pgb4mBIBhGFLe30jaNf1TWbdz
TLSH
T12965AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 fe7f3feb4e1eefa524270e6cd9ac9bf47a4b030854d461654738a1821a7753b5
MD5 a452c699c6687dc696e5692f50ef14a6
SHA1 3fc0647f06875eb621eee2b4a68ed909d09cf5ec
SHA512 ff79a0ceaba8dc12e59c2a586ca438313696d44dbc2789ff19864ff48d37df4cf7e9cc156a1fac25aa12612dba0ff4d951b5601620ada93f1817cf4ac09c419f
SSDEEP 24576:9G88u8FpJqH1azria7/mUgXe4i7ojhsP5Lgrk1TWb4AN5:Q7ZFPqVla7/6e30jaNf1TWbdz
TLSH
T13395F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 aac47e6951fc732bd362a789e7b940192308b3e1271251c3cedb9e592e4a9857
MD5 c3d00befd43d731b1c0e8d2a3e078c04
SHA1 f2fedd74d18cbcaece8a22a6cbe489c426e17331
SHA512 45e387c28267cc9a5dd1a51414a9a53eafc250899df3fa8065608ebbd0db75fe54bfcbf8e2a6816be616e536dd5e35c65b2f3a1ae6832dfca983edc77da0001d
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/e30jaNf1TWbdz:QG05lO43bAU023W
TLSH
T1C1D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f3a8c6400402eb8cc6db879356c2d2e8c6d2df9b8097608f078c1df06fed2d4d
MD5 7488c918fb3401e31bf1cebdb6d86c51
SHA1 05ca1dbdeb493c28b408383edff9be70045502ed
SHA512 c217f79f33d2e83f569b293de491acedaeefe67e99df26f144e91daf3511bd1c3cde1c3914f64ea5ad603eeafd29b1953a386da1b568513102f5c95d9ce82cd4
SSDEEP 24576:gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnigXe4i7ojhsP5Lgrk1TWb4AN5:Ya5POZ3+Jt2pasx2+m3e30jaNf1TWbdz
TLSH
T1C765AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fbbec08eda0f4b7adb46a4ad914a9f91f9da700d7fec0d5587d84121b19c5b83
MD5 76df1491971b5555932e63d0688fe9bc
SHA1 54c20f150ec3a963f54acf166e104982a7989add
SHA512 0e1d4e7882d83382daa7c1c9a88cfc7f5d6a14bd5c771f5aaad85959b1d84d0a23fb5dbd01efc14ca49e2a6ac76b97d4ea1c78bf7aa0e1bc271be2897e9d09cc
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7FkcgXe4i7ojhsP5Lgrk1TWb4AN5:+Nc/zEOVHFae30jaNf1TWbdz
TLSH
T11E858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0185f1d4f01809126d4fd23b2565036ff775731a924169475ba6ad87d1626390
MD5 e7e13e68ee0967bac55747f53b6a2336
SHA1 f63cdcb64f9a44f5f8d09a6ba2b0c9ec49e6d2a4
SHA512 21d824f03e3c05ea52c7950a0cc9492f6a9839df9f7fe01dbc7b9a61f0ed55ab7a105d5b2be364ecfb3baac2f8f14a56925c660d3e5aecf27d1fac7f32c93b42
SSDEEP 24576:88kNvNnaFeYhJNtmZBmMgXe4i7ojhsP5Lgrk1TWb4AN5:88MwBtOmDe30jaNf1TWbdz
TLSH
T1A855AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 8fdb824d4d3c0c56f4176e5a268b92bb2bcd53b41f3cc904facb682b9d707a37
MD5 1fa1801a0ba5b9b8b14ac526c550ce5d
SHA1 d6be638444d7614e189e087a8424c8fee6bfba56
SHA512 72698d2251e43013a7f2d8fc24b37abfb0695fa529d91d58480c399b8d083f4cf9ed8d83d7868dfce3773bff84920a8db383623a27ab28ef226ae5d83ef4b2da
SSDEEP 24576:lPUr+NQYgXe4i7ojhsP5Lgrk1TWb4AN5:lJQve30jaNf1TWbdz
TLSH
T18B75E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 4168b0e0efeacd8b1ec8e9e5198134d09c937745dff066f96c198c1dac0cd769
MD5 91fe5e5c0558155682aff6aa62a4e45a
SHA1 b53290840ce1d522cb435984d451d900d8f7e4e1
SHA512 6c49a67d71421a3ea4b1e67fc83731be6d6e6528cf575d48c522e1f4290ddf7cff50600841777cd7bdf2602833fe5c3108ebe2e4939f3dca30f3efed5d15ef55
SSDEEP 24576:bD3FHshBIYQgAlgXe4i7ojhsP5Lgrk1TWb4AN5:bDVHeBIAAwe30jaNf1TWbdz
TLSH
T10F85E17DEA5C04E4E57BC2BCD6A38A06E67138A9032156DB02D0D1B61F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1764-133-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/1764-348-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/1764-140-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1764-134-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2100-398-0x00000202FDBC0000-0x00000202FDE4B000-memory.dmp

Download

memory/2164-0-0x0000000000400000-0x00000000005CB000-memory.dmp

Download

memory/2164-1-0x0000000002620000-0x0000000002687000-memory.dmp

Download

memory/2164-6-0x0000000002620000-0x0000000002687000-memory.dmp

Download

memory/2164-7-0x0000000002620000-0x0000000002687000-memory.dmp

Download

memory/2164-29-0x0000000000400000-0x00000000005CB000-memory.dmp

Download

memory/2380-369-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2380-146-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2380-152-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2380-144-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2940-192-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2940-389-0x0000000140000000-0x000000014020F000-memory.dmp

Download

memory/2940-190-0x0000000140000000-0x000000014020F000-memory.dmp

Download

memory/2940-198-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3320-173-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3320-387-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3320-167-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3320-166-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3320-437-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3320-439-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3644-540-0x0000000000400000-0x000000000056D000-memory.dmp

Download

memory/3644-647-0x0000000000400000-0x000000000056D000-memory.dmp

Download

memory/3644-541-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/3644-562-0x0000000000400000-0x000000000056D000-memory.dmp

Download

memory/3644-546-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/3788-185-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3788-179-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3788-392-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3788-390-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3788-388-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3788-178-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4320-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4320-219-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4320-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4320-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4800-221-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4800-227-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4800-220-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4800-393-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5052-157-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/5052-162-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/5052-373-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/5052-156-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/5536-214-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5536-202-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5536-203-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5536-216-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5536-209-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5672-33-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5672-32-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/5672-125-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5672-129-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5672-131-0x0000000140000000-0x00000001401A6000-memory.dmp

Download