68ac609692d47e3372f18d45c564135bdc0724d9a0a69b589e258e6c3eb96ea0

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
Size 1.9MB
Sample261102-fa11wszzav
SHA256 68ac609692d47e3372f18d45c564135bdc0724d9a0a69b589e258e6c3eb96ea0
MD5 e947eb9110d09151b4ef175010da637e
SHA1 62996305bbd5b0dbae48a434f273a34ad876efa5
SHA512 5d2a189ea7b32d074698ca29c9d1dec6e0337e7dfb51d9588f7a908d1ca7ef8fba5d1dff0b1ce591d1220024682066395b512690786602ea4e7597631c1cca0a
SSDEEP 24576:caFDd70iTWCZfhOB95Dr47iJ0nQZo2vI3:BDd79WC9hOlciSexvI
TLSH
T1C595E01037D08136F1B329768BBFD724942D78715FA886CFA388162E5E706E1EA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5956	elevation_service.exe
4796	elevation_service.exe
5388	OSE.EXE
2568	maintenanceservice.exe
6064	PerceptionSimulationService.exe
2800	perfhost.exe
1548	ReFsDedupSvc.exe
4256	SensorDataService.exe
1956	ssh-agent.exe
2304	AgentService.exe
5300	SearchIndexer.exe
5788	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2726da9e3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp	AdobeARM.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be252064846add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001195b064846add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f2290a63846add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044aa9b63846add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f86bb062846add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014d7d962846add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb1f9ba5846add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2976	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2976	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2976	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2976	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2976	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2976	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2976	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2976	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2976	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2976	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
5956	elevation_service.exe
5956	elevation_service.exe
5956	elevation_service.exe
5956	elevation_service.exe
5956	elevation_service.exe
5956	elevation_service.exe
5956	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2976	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	5956	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2304	AgentService.exe
Token: 33	5300	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5300	SearchIndexer.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5956	elevation_service.exe
Token: SeDebugPrivilege	4796	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4332	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 4332	2976	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe	90
PID 5300 wrote to memory of 5728	5300	SearchIndexer.exe	102
PID 5300 wrote to memory of 4928	5300	SearchIndexer.exe	103
PID 5300 wrote to memory of 2712	5300	SearchIndexer.exe	104
PID 5300 wrote to memory of 4652	5300	SearchIndexer.exe	105
PID 4332 wrote to memory of 5788	4332	AdobeARM.exe	108
PID 5300 wrote to memory of 5232	5300	SearchIndexer.exe	110
PID 5300 wrote to memory of 2524	5300	SearchIndexer.exe	111
PID 5300 wrote to memory of 1996	5300	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2568

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6064

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2800

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4256

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1956

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2764 2836 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2764 2836 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2524
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 4f0dd7354587226ca7d8ae19313f3a98707c9ee1fc182ddaa36a8f9a11cf63e9
MD5 f03fbb7b1ec432690827330710fb839a
SHA1 38ecc59b1b2bf1a6553f786ce89a355d74dad338
SHA512 a6e72d72edf1dff5cb72a734595f0b9d2f9a0adab0529f0a5c8fcd1fdbeacccac580618af33652cfc2e01399bdebf10428ddd9154ee297f9b98054f9187bd54d
SSDEEP 98304:nrbT54hEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTi8rSex:DonfW/JLGMcblLheTBek
TLSH
T1D8A6BF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 28db4fd8c92ea3fcfa80c7f779387a6717216227c09b152d5c734cbb6d11f87f
MD5 bf7c7fbc164c7975bab4c11878cd99d6
SHA1 e7396d026f6454087e7e5e21f9b0397e7a74c180
SHA512 1401b2a1bc9e72e3d1d37d37810c1e3f3946d4e7e5138a17f2ec78cbb4df8f996011d74f302906d22f47cf0f565e40f6053c8488048fe4e3d9a010903471e805
SSDEEP 49152:cTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJthOlciSexvI:cTfiG/nzU90x8rSex
TLSH
T1D0E5E526A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.5MB
SHA256 46df2704be84a1cd395d1313a19992c1df1ed578ba6ca44b116069d790d617d0
MD5 9ba362e7a7fe049ba2cdbbb6a6ef5010
SHA1 531a1df544d6c4bc8838c868a46287bdc4d3c2f6
SHA512 3dd3b186c6991605b28cf4d5618aca56f7df7d288f9684e7ea6eaf0aa371687619d931558dcd9f8ef0b3b930f73c83111759fb7bd6105ec4659087e393ed5e35
SSDEEP 12288:XFYTXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:1YLfhOB95Dr47iJ0nQZo2vI3
TLSH
T1DF7523477FC99F63E272C6B51EAB4B62C0BD6D609F411B939B00A22EDC784C1457A12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.6MB
SHA256 4adf380639a87e8ee46c58351d977b8fdfd6ce83c12a9cdb4ad1ee233309387f
MD5 2fc58f1846419f021061d77285782e1e
SHA1 bec64a8a4eee37bb65d08bd4262d29be325ac5ff
SHA512 005487599093a8f5bc18aa59d6d252b161b7927aa2a63cb7bd67b990adb893584694a242e3154e924cba7cc1c85d7f528a152e6aaff4903f9d0b2bea6fd11a24
SSDEEP 12288:u5CDXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:ukfhOB95Dr47iJ0nQZo2vI3
TLSH
T1D9751210B6C559B2E37242B25E6FAB4BC01CBD744B6159D3F3848B3DE9340D28BB6563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.9MB
SHA256 c7951f28b84e8f236fb558960f3eaad9fbaa39f20f595855b46294138f02e8f3
MD5 4d3d1bd139e2b04af3c26cc791311e7d
SHA1 aec145039dc46dfbadf5d75ef7149da76f9be901
SHA512 e8887a7e7dcbd60e521e3681f2d94e8b9d5e7e4b3ca7417f87afe321ce978ef97fdb66c9284df8e77c5ec5232375d75f65141cda49c843dedee5152c654de11a
SSDEEP 24576:xATAbD+Ome3fhOB95Dr47iJ0nQZo2vI3:STAGOmevhOlciSexvI
TLSH
T11195E01037D0C136F1B329768BBF9724946D7CB15F6882CFA388166E5E706E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5eeecbc092f336d9172e6b0bd3ed1e4d42e9d9c605b5bf05d79182fa35805380
MD5 5965ac4108240a6a7a532047b9b18a52
SHA1 c277504e147d48f44395301ffb6860cdb9ad6a4a
SHA512 44c5cab0517f656a405a1b1c873945c107cac40fd1a94c414b53de22dc9f3b118171bc3a0853ca5962a01f30b6867a8e09c8ad18bd639640b6be30d00583379b
SSDEEP 49152:Bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnAhOlciSexvI:H3q6sjBB8rSex
TLSH
T1B0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 758e4168178970e2e89968e13f574cf87ac0ffbd4792f91d852d6cc6d3008e3d
MD5 01e470e8754f345d811449492753f612
SHA1 491a4b43ac929f9a857901674e6c92eb49e1a3fa
SHA512 9979bc4ec005dbd43deade9b1577500c6f08ced3926c1b21d5add236501d3ac484b228b29605f88c64952dfe3996de7531a8de0dc22f0c0dafe326480a4be9a8
SSDEEP 12288:C1XLsswWkxy2lRq2czAhXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:IXYfDtczABfhOB95Dr47iJ0nQZo2vI3
TLSH
T11785F12877D409F9ED77827CCDA28502DA337C9547A0E78B03A096295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 b954373ff1a9f621d483a3424b0b0f5db53c78b4212a56654140891f49884f21
MD5 89542cb53b97bcd9ad1622382bf32f21
SHA1 2629612c5063ed8c46fb0f6a2b37fe13f2053274
SHA512 5ad796c6bfdd4281f476eec12c22b0b81ed78a2e1b3598f6752959bc36b01b069d94e1d61e43f8712bc7da5aa3cd6409419513a740ece80dba0b76cb0cc65e66
SSDEEP 24576:/0Le5ji0hmxxrMnfhOB95Dr47iJ0nQZo2vI3:/Pji0AjghOlciSexvI
TLSH
T168A59E15F6788731D073C0B9C5D2A68AED72308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ab2ed2aa3a10c8ac6034f7230dd037007f785816fbb841bd146532995a523eca
MD5 73a97b3581d63c3440d18854898a81e9
SHA1 0de399bab9b10ce19be25fbb9f6a1554acbfe724
SHA512 ed138d46e17099158245a33ab07aa48ebc3c85f0cd9a2761c5bc0e957da4b648bbcf537f9c741c526e0ef5c03f667ce2cf851b865be36ed69a43e837212d08e5
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWn6q8wyulfhOB95Dr47iJ0nQZo2vI3:k/ezSC6vUzPveHjy0hOlciSexvI
TLSH
T1F8755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9b588c36549f44ce9c2b13a001d3a924e8871874cb3d03754ce87559bf5b8ce4
MD5 635e0a18c2927f7e3b6cb72cb73ca907
SHA1 18cde769084f3164bd960fb3f286abd321ede6ba
SHA512 c6cd2c10576b4a12f47e73cc9e8e289e7177109d21082d5d7e9ffbcd6ee00b6c810ad0c98766688162806c645f4bafbc3d61ef03d3ac7dac37e60616331de8ab
SSDEEP 24576:uVbqPb88hv/l+YKfhOB95Dr47iJ0nQZo2vI3:uVO88hXl+RhOlciSexvI
TLSH
T10C559E65F5B48331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C3E676D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 96fa2244f3f7835084dae1a6756f67588ddd08001fbfec92e686fb2b96527ee1
MD5 3038f142ce61c20a8673df2ee033245b
SHA1 21a73c5451daf0736f60dc0d7ea5f8292d57b5c1
SHA512 9f61f0cbd40c1c33c3d5743945336eee4f7f4ddb5d5dfb385fdd909b78a652de200df4c562a9ed2d5cf48c50c6ec14651fddf1ffb4be4f701e219b7708f6ef17
SSDEEP 12288:dLrXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:dLzfhOB95Dr47iJ0nQZo2vI3
TLSH
T1ED7523889FCC5DA2F3B7C7B97FAB8B03C8593DA494C11E539D00B26DE835455C2AA027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 b4fa4ea61dd1c01b90cf544c6765e13cf7abe3c3d3820dcdbc64a33d9ff68d00
MD5 de0e369512ad5193e58d0ff3968261f2
SHA1 e56b55cb455c52d479bd2229b55d32517fea9b4d
SHA512 95d8bb85f964b3701445d4e29e45ee7f5eaf5843c0345188b9522cc4271f15e3f786e4f2cc4fe2873ec65dfa6c189c28038c1e5ed8ec2d149fedfb70130c6305
SSDEEP 12288:IeBNUbTVO86UMXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:IJIUCfhOB95Dr47iJ0nQZo2vI3
TLSH
T1AC85CF6BEE28FCE2C27A8DB85B918700D77278704B5193CBD164C20EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1af0dc87cc2708dae934a328310bb5aef14fa72c75f7a0e7bec858166ef7c4c9
MD5 8d5e8270913373e698ace6d4b6516c62
SHA1 79a38c90f2729ec6c4b44d36fd007d35d002ddac
SHA512 b7b5a7d3d5a1e2f3980044cd01d4ec007a57ecdead95bcfb9ef28361ebb84faec19704a8a13ba7ce30b9aa32578f418d83c46d5e4adb9b25b8f840255b0cdc1c
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THo:jQvGAdlCEL8c/DRNw5Cp8rSex
TLSH
T1A0266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 8ac6f72a20299a7ec30e3639b80c0f4d8ca83f1913048a43660e40fe8f0c29d6
MD5 ba271ce5a679f5af8d6721925a6b95bc
SHA1 e9b523051ec9fd7292e42e17be043e5237887e81
SHA512 98b3e986cb35aa19246988f270940dcfe6d765216a445f71e9a79885eba707d9705072db33569f6f5c219a4fa00f9ea8a583ff53aebfe4c18e978f7f578106cf
SSDEEP 12288:VAwSfxL/2Dc3RDLLmt0LDQewsAjaXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9k:20ewsAjgfhOB95Dr47iJ0nQZo2vI3
TLSH
T14195E030FEB4E436C3BB0DB61B36C716583D7D604B911AC3E3A89A9D99301D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1b821f54aa1ed32a5b5e7477c852aa8fd89ba61d5a2ae8a8fcef534258693505
MD5 c81142e6bf1a746b7a7f484868876417
SHA1 4ecc05f9e61e0cbf99a968d3bf000738141647a0
SHA512 f918651f3a2dc63d1a32e24c667d65a4a6a1b9239dc909a9c6921e70f4e300f8133febcc5d05c9834b3cf9e62af7ffbbbed3eb753dfb7c03898a39aae808b6aa
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHfek:AUEtQevvqc2W1cpV2tI32mk
TLSH
T16E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0839bf0d19d4f2b2f7038542666a9d68a386a5dd7c0dbd762f3d1a16f2904712
MD5 9e9c53812eb5037a5ada8aa2d2afd68e
SHA1 658e2b0b1ddf2f808ab432cf9260ce8754aa6474
SHA512 5661a8fb2e052ae0afce2915ebe5284d843ee0637d9cce47dc2f785822aef5bc5c991f73050719cd2719af8eea80f4b8f376958f3e48c206bb6a701bdaa6b4f0
SSDEEP 49152:fCbRquA/m2yL5zLfFiV+XenmE3/zQhOlciSexvI:4oq2Vjnmd8rSex
TLSH
T1D5D58E0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4bd6db7edc9e3d4e912b54ff6804aa7d8f8c17b311b2d7698c50f328d0ab6f89
MD5 cbe23094fd6f204b27b7d6a631c96f81
SHA1 0e930b7682c13dbcf0835b24dac1e84350044d3f
SHA512 b7d4eee3eda9441808f9982189707e989321de1568d5830d5a630a338b45a165095c786eff857318897594717fa2e4a0d99b23ab1c6cf4081ec0613debe736da
SSDEEP 24576:XAhGL3IFoiwtA5l7S53ZfhOB95Dr47iJ0nQZo2vI3:XAMUFoiq5thOlciSexvI
TLSH
T112359D80EBF955D4F5B3AAB899B68171EA76BCA95E31C20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 6cc2728b880b5df5aebdccdf2541d20aca9e02e65a50dee11f7be4c2a4c6e3c7
MD5 c61bbd10e1757b3f180aef07170c40be
SHA1 de502cc5ced1909562ec4f6c74cf0245f1fe67d3
SHA512 6a169a34d7c6fd907e11ee6937a531c15b6f3fa478f284525539caa78ff2cd06c521bcf204b56764b43961f6cf5c82234f5579a22d284026b23679acbec3dde8
SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+C9XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvi:Owu4OWEfhOB95Dr47iJ0nQZo2vI3
TLSH
T1CD85F14977E81CF9E67782388A57C532E7B27C112A21CB1F1760C65B6F33261AD2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 6e0caccf6ad6a80dd5fb93f0e6bbb8672acb267f5cd5d842ded763ae345503b8
MD5 b171f7277b1fbd784add46958d5a389e
SHA1 6e8b6005545f9d0d02899807b8545537c8fcccb2
SHA512 47faf526ba53e7e78a711572b4a3a568d550d1ccccf27dcd47ff0251d3d02c0c59c5a6812289c648ff40822b8856188b275a93024a0d812f48e2b6618a037d41
SSDEEP 12288:QeZ1IyqXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:xZuffhOB95Dr47iJ0nQZo2vI3
TLSH
T16575128927D825F6E2B3827C9EE64A02C7763CA5537143CF5A10826D6F339D59E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4cdc25eec713b87511ba8c95d5f99e6361fe0bb6e3245c64b31c834f4a3bffdd
MD5 515280d42eb988098e537ed5d27a3683
SHA1 954e47468a97928f7df007dc4982f15ebf1c531d
SHA512 d9a34e1630be6046d9dc88bfae84ae222fcf7cff6c128ea9b2f7672208ddbb0198d56c617094ebf9e6cd5c4f97199ab7954d6a9f5911307de7aef27ea156ecec
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:AQRQyi36YOcPbLvw2gAf+PN3i8rSex
TLSH
T1AE667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cbe9017ac13a338e9f2244a7a7167949208c503912dfc683136ef9bd58c6119e
MD5 4681e6511e40021db4790c0b04ff56bc
SHA1 95091fd9aed881aef0f0997a627a0238554d4e50
SHA512 b7f6dee3f2a6d70127f620fe504f2d01329307a8a3e67384543b0dc5b84e5b3aa60b0ed16a28e837ef330d425479d7cd2611e2f029e9c8e5ad07eaae30ed0ea7
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:aQRQyi36YOcPbLvw2gAf+PN3i8rSex
TLSH
T113667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 63242c0a26f74d9914fb7c95e99216d5666aef47820b6b25506e9c7717de14a7
MD5 85c4f4736f7d7c18f541e09d8ee20f9e
SHA1 d248d19772c314ce1e6839863b43c5e62ecafff4
SHA512 3b6855ba7801151c88155f27ab60444f9ec85bd34675f5c96a4533d0341b759df8a479d2d6f46ab4687556b9e29f16a408cca31d1adce09a9ea6247db87f61fb
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0PfhOB95Dr47iJ03:C68Qg55nhceWu7PNU3/ghOlciSexvI
TLSH
T10AB55A33B2F600A9C45DE1769F4A872196D17C758FE0E3DB8501721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4c330631c8532754492a89018a2df2b1195846f93fee03da3b0b21853f3ef8c8
MD5 398c95d8e26e2968504e957cbee95ad9
SHA1 ec07f20f2891cce4827fce33acc1d70997738667
SHA512 681ccd7d60091b8423c38e4a3cc3aecf95c35d265d7f97d2d51fbaa817eee5c057add285b0e898bb08e33f560ac8535eb5ef05f6aea80fb6d64bfe0f8f1a75e7
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99S:my5112gYy5azzVvt69nLKnhZ78rSex
TLSH
T1D3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 03a465ae72c1a633c808102ecd225ef8c3e96a06e3c6e657d728a7f707a3a219
MD5 8e48d26dc790cd00400a699081e89916
SHA1 8e6b4410587aaec1c597419de12ae3df3c68e17e
SHA512 954f98d06f8a7027be8500adbfb96d412b67a09dddef129ac052e5e8fe392b58af470cb12d5276892175b89d75e816b81f0eaa68760253b5c9caae6697fa6472
SSDEEP 49152:AB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glFhOlciSexvI:au6Jmdxd2dF8rSex
TLSH
T11BD5AD13F1DA01E8D06ED478974A9233E962BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f62a8eb36ff665f4f9c348d5d19c2d4760da7da91706965b9b6a995e90d9b9e3
MD5 b5000df6614fdc01d40bc9176d32075e
SHA1 a9fd553b2a6880bd8f50bcba8528fd40e63255ec
SHA512 b264c092b8c26c32a245a93118d0a453790c5b8793a6259b72e6a51d7b39bc7ed38cc303812f5e95d30d469dd8c2704b00bfeaf4d39756283ac6e461fe9df2e0
SSDEEP 49152:41hpsNoJpF1A63U44CwH7R4xOhOlciSexvI:4mifPWRd8rSex
TLSH
T15DB5BE13F2D801E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9b941b24ec61f965e6df2e0dcb2155c1cb85acf05b65866e2c4d3766c6fcf5fc
MD5 1774169026b2ed8c53b4daa8e0674910
SHA1 eb250bc055bfbb98ecffa6ad03a62ce6ba0d94b6
SHA512 d224c663d6350041a9c93bfe9e4d7a7704ed326c446b693214c3bd2d4d2f4a629000dcf19378d930c9be962aefdfc92632ed63c95b05fb8ccc7a471a218b9961
SSDEEP 49152:PSuZQIY0Be2KcRVtOnks6NMHqHhOlciSexvI:15dKii61H8rSex
TLSH
T1C2C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0359162797c2600dbe64b2b52299e9b8deecc375298db2dfb32f6e36dfe8c733
MD5 b703b8420087ee36aa68f79ff2de8681
SHA1 9b5dff4e651a13f8bf910f34da4cdeea9cf21cc7
SHA512 0910b0c72a3d6d5159fa054038232e548e80733e2d7e9026972b4ead22d8b34ac534c2c6c1282ff41a617f991eaf7b7258f12ffbf4c8ade56082f3f257914aaf
SSDEEP 49152:MhtSn8EApI0fig3giDn0AP5wahOlciSexvI:tX2imphh8rSex
TLSH
T17395BE13F2D901E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 12e6907dc22fc2accb60d738ab85563ed11ae24c736e8600da7806bf8ab58618
MD5 1291807a0727759b4307468570e72a17
SHA1 63641e15890f5080c0389cf24bbe8168a3d35d6e
SHA512 49391d18d60bd38ecf7b87eb502dd3a92457a9787aafaf1b81ea6abbdfc512cd720b32502b94711ddec546a90bc5d45c55816bd33816b4526ca5b377fe358524
SSDEEP 12288:MTXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:MLfhOB95Dr47iJ0nQZo2vI3
TLSH
T182752388AECD5DA7F377C7F96F9B4B03C85D3D98A4C10A53AE00A12DF53585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 0da02e6fcea14c0a3e85faf2e107c84c74428249009c8b0ff12beb017c851cf6
MD5 9b3ba36b4ef5c0835f28bd700476d870
SHA1 cd3cc59a4a4dce57fe5bba1cc67cd9f633acfaed
SHA512 f6c63424fdac2eb9cd6bb865aca8b9292022493a8d17c9ed3211cfd50e0d5c714f1163d806b0e63971b979fcbe5b96961ac7159a328b48ea5ede9ed8d0f168ba
SSDEEP 12288:0+XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:0MfhOB95Dr47iJ0nQZo2vI3
TLSH
T179752388AECC5DA7F377C7F96F9B8B02C85D3D99A4C10A53AE00E12DF535855826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 52aae50f86c16616563d443855bd7663996f3a30284cf046a9009e0ef8b61d5b
MD5 753b73402a2168df74f20f37ad848082
SHA1 62cd7552a20b98d80ed85556d24ba2fb14eeb2c1
SHA512 8829ccff63032df57eb3d7285d67ee573c0901be879b5195be54febeca17e1e042f43c8f82677162b95081a25616889ae345c72b70d9090a6f10dafb4b552630
SSDEEP 12288:9UXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:96fhOB95Dr47iJ0nQZo2vI3
TLSH
T117752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AD00A12CF53585982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 91a6e96473434e588067f99282553f5f56745dcf3747b4c8c1d76309ee9f3c53
MD5 dc9820a5070a171cac9c513d1061e2b8
SHA1 2408895467228b14ea69adb5982284b8122ab255
SHA512 d429d2c74fb5666331ac54e08f63ddafdf1a17bac5e0107bfa675a4ecdd5554ce54650ae1a722e29982c82750c6c252d432d8cff4d0825426433dd1be1719c1f
SSDEEP 12288:fVJXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:zfhOB95Dr47iJ0nQZo2vI3
TLSH
T1827523446FDC19D3F3B3C3B89FAB8702C4793CE496610B9B9E00512DAE316949279627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 1391003d621845ed0746c6140327823b1994f66f1e4f488fb7800268b4fd3fe0
MD5 c29972945fcbd2e739f8f666f83f122b
SHA1 67dc138e0fc7635b122202e28948a1d0813a1e64
SHA512 51d920384f0b51d865f3d701ba347cf31af44ce9d07ae776b2919bc04a98b17e3bcb2ab706cf4b6177d64cc3be1afdcd6867a2cff0c2b2d5486a90554f29b138
SSDEEP 12288:LBXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:LhfhOB95Dr47iJ0nQZo2vI3
TLSH
T1C7752388AECD5DA7F377C7F96F9B4B02C85D3DD8A4C10A53AD00A12CF53545982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 2996ac911cebe0f1eab005513f7565895310e07fa03e9d758879b211438b320f
MD5 4c8dc7ddeea6146710a76d8e2a01f5e9
SHA1 e91908dc88a93f8f16bea933f282b701477076b4
SHA512 1c1c08813a33c21762b71a5280a674f8e092b5e84983729f1be860c5fdc22da1e26561e62b2ea22aafa28f815fec57678051565a049628e1651828bf50919bab
SSDEEP 12288:UiXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:UYfhOB95Dr47iJ0nQZo2vI3
TLSH
T115752388AECC5DA7F377C7F96F9B4B02C85D3D99A4C10653AE00E12DF53585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 9ea10c9c100ce0cb1b8c71337f6007e5bcecf97882df429b67c10c9c69787e72
MD5 2158353f13995766983b1f090e000830
SHA1 6fc4904ff5054541a29edb44db8ed18621cfc06e
SHA512 dfc8df56f8a9ee1de2637fda12bb50dffc4fb8f01c8d36074f99cd7484aa7cafe96ac0ec7950ce1bd38c49b0ae60af5f702ad934dd75829aec178ccab309f2dc
SSDEEP 12288:F2XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:F0fhOB95Dr47iJ0nQZo2vI3
TLSH
T114752388AECD5DA7F377C7F96F9B8B02C85D3D98A4C10A53AE00D12DF635855826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 7d337758d83773ac9a5493da8c841927df2410b5c75a8a75e2f16e19c8a38248
MD5 f044124d53e6cc178460e7b0b3659b16
SHA1 b3f2d62bf25cdc72376a198e5798e9ff4dd8bd73
SHA512 8c85a0ae4cc84fb208ec3f465663655c9720546d6517157c058b4bde04939b2c7efa1bec0166adad127c5484f0a6e3b11528c0fdfb5a58640a5eac746747bc78
SSDEEP 12288:eiZwbVzzFEoS2cPvyeXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:BZMRzFVSOsfhOB95Dr47iJ0nQZo2vI3
TLSH
T146850294B3941CF5ED73827ECD568A06D6B23C5907A0C61F17A4322A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 54a9fb18fd342e65eeea42894cc3ea56d2e89fa774c89ae22af2d648a1fe35b4
MD5 10933ae34fc7539cfd9de63ff06e600b
SHA1 d4ca73f4622ecc0c4d4bd6d13dbe5058fcaa0c64
SHA512 a70e8fea2506e817fcdd4a4ab0509e864a225dea723c4e87fae78a8cfd535554740a9fb432486070a4d1ec35fa351dc56761c57f2ad1d461ccfc978d63bc756f
SSDEEP 12288:qvXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:qvfhOB95Dr47iJ0nQZo2vI3
TLSH
T14B752388AECC5DA7F377C7F96F9B8B02C85D3DD9A4C10A53AD00A12CF535859826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 65a57ca25f24ce388c97314afeb4309464c849d4d956bb4985a5ee8efed403c1
MD5 520c96d495c7cd41d7e6c41cf0eea961
SHA1 636b7185619f158325f4382dc25d3ba01f9e96d9
SHA512 a56ad929f5d9bbec210a44e9314953f80a079b23781c324797d316be717cfaed0da4b9fc27ba5fbf6d113fc55aa5bdd601158e00001771f6a14fc2982911832d
SSDEEP 12288:17XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:1DfhOB95Dr47iJ0nQZo2vI3
TLSH
T1E57523886ECC5DA7F377C7F96F9B8B02C85D3E99A4C10653AE00E12DF53545982AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 0947c1a6bdb9ccf84487700485b6c8efcf664626c82025ff4da6102a05a7843f
MD5 c6f887c6dfc13b88daf56779d588ddb7
SHA1 fa9b539f5acdb6d33529ef029741cf006ad704af
SHA512 7a726028314b9e808842a7aaa3a8b64eab3323c8bea6462dc1fb91f658b00eae2a58eeefde9ad215a993b85408f9a112de2bd7a9adb8408743eff939e167a2d3
SSDEEP 12288:byPz5L8qXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:WzywfhOB95Dr47iJ0nQZo2vI3
TLSH
T17385024777A530F9E277C2788DA30A02E7763C7547608AAF5750437A6E336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 29246937770b9f28805bb136626552795b4e905cd2335cd0816852a0eb901e59
MD5 84143cc6e7dd8592316555c064bb967d
SHA1 d239380f2d0473f7ff3713e61b443c3af6e606d1
SHA512 66c90b2531cd87e2677ab53b2cb1733507e09f6e3afdb9722404f84921f50b088ea71bafa9b20425d93c117d3b74334adb2efd0928aea538b300c7a3c1d73fb6
SSDEEP 12288:bvXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:bvfhOB95Dr47iJ0nQZo2vI3
TLSH
T13A752388AECC5DA7F377C7F96F9B4B02C85D3D99A4C10A53AD00A12CF535859826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 044e27cd851c53b05c59a393c85873513194939501554798c7bd80891bf74224
MD5 f2bb498626f6e14fed54fee7d8add8b8
SHA1 f5b74ace79cfc2a954dfe5a59a32c12e9943f797
SHA512 af445ff6cc9e29a86529eb4bfd5ef393548df0e82aca04fcca7fb6b4fdead9bbd70e1963a3663278f94fff44b413a61b44cf577493d4cf5204978dff798ecf03
SSDEEP 12288:MvXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:MvfhOB95Dr47iJ0nQZo2vI3
TLSH
T136752388AECC5DA7F377C7F96F9B4B02C85D3DD9A4C10A53AD00A12CF935859826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 3c51b1e7606312a1230a661c125949990485a010be1b536decf1477d92a10834
MD5 182f618060ce68c1456fad8ac759466a
SHA1 1fa22e9190a2ff5216f23722ee94717a69d0b958
SHA512 976c504d9954bf7aaa3e1830a025baf64ba8954063b4c9ec49411015577e65fb1353a2d083592af2dfd03188777d24eb5fae8d6d21dca52031e8117bc72a4855
SSDEEP 12288:ayPz5L8qXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:HzywfhOB95Dr47iJ0nQZo2vI3
TLSH
T1AF85124777A530F9E277C2788DA30A02E7763C7547608AAF5750437A6E336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 b495d7859d8340a64ec908058aa3dcb156293c0bd67032f2f2ec273bbea9c652
MD5 0f7a701768cda1d07dcdb5d79e5c3064
SHA1 c25d0dee05587f803d3336ca433e2da228c9cd63
SHA512 f32b55c7b475ccaef3378f32c1d05342442fe8f7d5fdb830f90fe8ff7e4372351afe40e64665cc9e6ca65aa31d8f9ce537738009d6604a1baaf2e3191ad23a98
SSDEEP 24576:GTDaLl3z0zDqfhOB95Dr47iJ0nQZo2vI3:GTuLljZhOlciSexvI
TLSH
T147850294B3901CF9ED77827ECD568A06C5B23C5907A0C61F07A4366A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 d5d48cf977314624c3b297e6bd68957286421400547a66458e160d73482781fd
MD5 bd20124d698701391317f036cba7b5d1
SHA1 ca378695d0e9ba80871f46cf364e3e9f20ed6161
SHA512 fddd8e7b5f99b63c2f33331f405ba13e4189dcbd4099b0dd87a4a08d19d4c1755f154b88d924600b8926390a40202f491f078c2304c2a676b7a0afc0bdc6fb08
SSDEEP 24576:n3vd9CHKy7GZmfhOB95Dr47iJ0nQZo2vI3:3vd9CHKyaIhOlciSexvI
TLSH
T16295CF90F3E814E9F1B7CA358D764512CA767C991B61CE8F03A4661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 b49c8378e631a4cdc14fa1ab4fbc5728ed95cd5dd475ec9999a9a31d99cefffe
MD5 fcc21c8b77e5556d44999dd9d4b0fb95
SHA1 b2b1c2bb7bdfb80c6628f1bb4f130169c18f0a92
SHA512 cc21259fe6a37c9f9d1e96f321ba82e10fd93525a66cf250098a1ea4bd7bdbb3f87aa27e4f5b182928c42b8d22b9a45bfe0f32a5bb98e40273e6418aae1f5a72
SSDEEP 24576:XfwvUk9RX6wkyAITfhOB95Dr47iJ0nQZo2vI3:FMnYIbhOlciSexvI
TLSH
T16A95CF29EBDC08E5E1B7923C9DA7460AF6B178681B31C6CF0259536D0E33ED45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a02933aadca4daf8c17edf87813eea8954f09a08c962caf1f40f4fdf393722bf
MD5 1fcb9785fb41ceb133f60c927cb4daac
SHA1 f0204af0a41ca0c6dbc08d4589246be7ce28e2bd
SHA512 5272e8db6f113978c78a155084f0b872131183b47b1fef638328e651e8bbed8dfb557a93718b1a8a518fcc0f722d4d927b0330c05b10db3ea621e2907341cfc9
SSDEEP 49152:hYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06hOlciSexvI:sySzPC8rSex
TLSH
T19B067C96A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2b2cdd5b4325604cbba05effc50ae96753150e6349e4ec85ca0f97677e3f0601
MD5 07ca112400bf296a52ffed5e560b1d4f
SHA1 78a3e6705578a7768c72e757e7ced02ab5dce075
SHA512 e1ba4a40a18fc3b62d58948b8173bcc85a7b74dd12a0f95844720fde4f361f301b7f29c6ba86b9378acb5cc75f85a399bd006aa6f93b5bcb5c0950b7580dceb8
SSDEEP 24576:l47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY8fhOB95Dr47iJ0nQZo2vI3:l47JUQjTirIhCnDHUPfF/KhOlciSexvI
TLSH
T1E265AE1DA3EC01E5E1BAD27889154A5AEA71782D1B31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 be5ac85b0be1b91b8e081bb1d534ec1d398bad50f4c9a67a7e10bf5df8bfdba9
MD5 78389a7cbbd2fe8a444d3ecd5c3635ee
SHA1 3a2193c376cadce414139a0387ab331fcc99c5dc
SHA512 6a25a75787cb17b9c5a040fad7c4a85c8af79f603238e64ec106bd1a73ff13471024e7ebba59d21e4636cdf97081384671fd6f4abf209ff0807c6f76b36c4ed2
SSDEEP 12288:PbsffXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97i:iffhOB95Dr47iJ0nQZo2vI3
TLSH
T110750149D29802E9D16E92B9CB568A01F7373C6483E1D3CB57C0F53E1F366909EEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 32424db327815d8e3a07b294d73bc9040b838801be51b56ff9d642c1b0fd6013
MD5 0a88922341881dd6920453a5022ed01d
SHA1 2c2f2f97c84a4a882d79989d7d31ed72b122cfd0
SHA512 fed110fabc84c6b29e52db8f926fd80c1bc2153c0ee671e6d1299629613bbea124c1f67325561d7ae5b9ac37c2b7ae56d318793f22cb38d9e9ba32110f705753
SSDEEP 12288:0KcE/BBqa6Nnq/BAPSVDsCdyH9XDUEXsRtGmH:0KZBI5VKDswa9XwEXsDG
TLSH
T1ED4518107626DB4FC6A940325E37D6CCAB707D01EE056B0373C98B3FD576659BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 e55ae59bfeb4e052363f9f361b9d5e896bca8eed418bc34d008ff70fbbc7f935
MD5 a75e934722821f223ed852fbddc12a38
SHA1 44168dd16e2c0788f14184f4577e8a58296b0a78
SHA512 99dc49479b3c5cf2513638bd0bf0cee5d9ba7b83fe99f209f0cddca6836bf550388b59fb7f34ce24899cbff7f66dd601c96f4b7b78b86741da783d092d0f2e60
SSDEEP 48:mGv7tqdZnvcllxllT7UREK0kENRu+UKn88XY:zJQZvcllxll0+LRTX80
TLSH
T1A40220A1F790F532C89280B2DDA0B79D5F65F4301D100323BA49099ECC6D5C30DEAE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e80bedbe0ab24b77eb29bd9f1345923e29baa58632c988a3ff8ea4829807a0d3
MD5 8b22b075248055c9f78b7fc0a441dfbf
SHA1 b440d0f7d56daedba707a314a5a0d8be313d2f68
SHA512 b0103d21ea1d4b54f2875d09d7ba4b5fad236016af1083559e6f01ea76756e64700a64236452a8aafe5d036279eea15532e6ba51cd8f2e07eeb0025e42a3f3bd
SSDEEP 6144:HII+huZ2kfxxydyr/9oSKDeoH+SKDeoH/cpA8nqitoQi:/9Z2kpxydyjmefc1toQi
TLSH
T128550A409536A7CFD1B76032072A6B8DFBB4EC07B7056F16B3C9047AD86A745A0B93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 178B
SHA256 e4db4b612383615344a0a693d186d5c25ae42d0069306d06f2330cb840de1246
MD5 3b15849ccf5aa877e76b8f318ba95bae
SHA1 2922f70ed439b34d45b055f1a2dad122b272312f
SHA512 e870355e1e353df4627a93d4e84c1b658f2fe498569f6bf723889d59be73e3d4cf10f0d82abdd5c828a48bc244c90788306576c70eb0703c67fd172a4ab6a380
TLSH
T18FC08C23032F51A9072D008A39AF3F90109269B0C3628AB97270FF87F220C27081B82C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp34F.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp34F.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpE8A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpE8A1.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 0ce6d01a09b33ec10302588929792984aa6a5ee7ef9c2ad1f8dd838130aec1e3
MD5 14d5883e4a12f240c2c829db0a30c37e
SHA1 d5ad0a1a6afa10a02f8eb7ba71c69883cc3e0c3c
SHA512 3605f8d220fa3c49a5f7b5ddb3f0e6341fadfc15311a3df63448dcfb92377b10acc72f7c547236a3c3fce78629cfe11395b0c15c59e87695867da7e8e0e65c27
SSDEEP 12288:4F7XXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:cHfhOB95Dr47iJ0nQZo2vI3
TLSH
T1E8752344ABCC5D97F3B6C7B42E9F8712C41E3DA89B8045D3E900A26DF5318D5CABA11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f722fc8f1e821ed46c7a145d482565f892bb772614c8fcdf49fcb9ada8c0cac7
MD5 6b6c487f1c76f8f4a0db1da3fcddb860
SHA1 4c8f0f4a9bb62cdc962e031ccbf697d955ff7074
SHA512 1c2d94b9fd39854ab1ea3f87c4845baeb53233a463b0420f35b1f779f734646c51f7ffcf02d55e2d756f7cbb9e457ad954ed50b1bca1f94ea6798ff5e4f28915
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYlfhOB95Dr47iJ0nQZo2vI3:Sgb4mBIBhGF8hOlciSexvI
TLSH
T14065AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 32f41fcc656d36b76d22cf8c18f97021dc94698c7f55410fd6c203a1dee75351
MD5 504bf03e10b9ed62bc9fb729b4708354
SHA1 939aef5a52d780f25b892f48b8407cc873484879
SHA512 6f6eff47150c12fe9745de213da4ae756055876a87af3577f7b14bc580c906c4467ccb9142ff6c34e76e525b8b97280136ef076f44cb2688314e1d6c3d726efa
SSDEEP 24576:HG88u8FpJqH1bzria7/msfhOB95Dr47iJ0nQZo2vI3:m7ZFPqVea7/RhOlciSexvI
TLSH
T14EA5F16577E401F1D077D1388A864663F6B2B8250360EFDF0BA88B551F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9c10931fd82ddb986747d71f4eb39046083950720330429a93619d770cc435e9
MD5 e66faa15136766af03a537002de2d788
SHA1 b676387f21ec70494d61b6700fde6876e02cea7d
SHA512 b3795cd127d87dca0b37e3a17ec0d41f6f36d457290c69fd0d0c837f8de51edaba0f7ce988f1c294bb3de7f537fac84e3bd4fc04c8504eea8ff81bb8e39fc8c2
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4hOlciSexvI:TG05lO43bz8rSex
TLSH
T1E7D5C06E62EC11F9D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 891cabb997a34c9309322a5f622bc34fe8156ad3b2fc9712601ad0b592537424
MD5 fc34b5f6bbcb1b12ea5381eacaf7c367
SHA1 96a4346d5798d32e00eeaa2e74e8b0093dbe4921
SHA512 ee003fcd09ef7c37fe4197ba7bb451efd55dc2b4c133119899404002d87b9d5a9fefd93d56f50cb573d9ea96ce53054c9ba7cc58fc5478ca13f19ecf30d87c45
SSDEEP 24576:afa5POZ3dpuWVM50JicR2hG0lasx2+47eidnufhOB95Dr47iJ0nQZo2vI3:ya5POZ3BJt2pasx2+mghOlciSexvI
TLSH
T1F565BF5DA7FC01D5E1B9D17DC583861AE5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dc87012079aabd464bfb64f00828c35689d15cbdf2bd24476a88a00d12638c6d
MD5 2d6cfacf0bcdeab5dcb7f0bbb328e44d
SHA1 73b0af3dffc6dcd3ecdf8b66434b381a2c29f48f
SHA512 e4e769a1a07bedeec815b8054ffc9233a88aec9cfb672df87073613bc2f5de1066f9efafb4cc7163f1dc2f677b33acf0dae61643fd399cf71480c3eab9112a98
SSDEEP 24576:ZNcwHdjbyQ4nLC18lb/EOjowL7FkkfhOB95Dr47iJ0nQZo2vI3:ZNc/zEOVHFxhOlciSexvI
TLSH
T1D6857B5623E901E4F1BBE1BE89679646FA71786553308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 415b7b6ad8210b079d4e7a4ade9c29c921ace9b64df7418175cb98790a76f1b2
MD5 8890631b2cbe29195d7d8c384db8d6a1
SHA1 eb006a002bdc4a02710ce390ff71d9e122401748
SHA512 230f82402ff91851e82b9415c671e6e97ae40d5177aa1b459491345895811cdf0c995cb363cee13558e033d38cc0753ee90012fa46f268722223b133d713a62f
SSDEEP 24576:ITkNvNnaFeYhJNtmZBmlfhOB95Dr47iJ0nQZo2vI3:ITMwBtOmZhOlciSexvI
TLSH
T10C55AF6EBAF806E4D1FEC6B4CE238512E6727861073253CB5290C13E5E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 3f9b54c87fb83db45dc1385afa964b6a48b4cd2639b656aff8b88abbbc45150f
MD5 960aad029067f14342f0140480917c8a
SHA1 68015753db1ed628840aa7bac835168afe18bde7
SHA512 8c368f573af406ce073b277d11c2daa9151f4bf9be60a137b49b1ffac420aff7c68287fcde1e2d6621d867be545cb7b2bb579f0ba5964408e766873478080fa7
SSDEEP 12288:wHvUrBFrEjwaQyXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:wPUr+NQofhOB95Dr47iJ0nQZo2vI3
TLSH
T11B85F11E26EC1CE5F676E17D8A868709E7717862131292CF0290817E5F37DE8AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 208bb83be0b97ee940d6765f35365cd75122a5a316efdc5e7b6111872f1646ec
MD5 3a5cadc561041fea362945f35e4840f6
SHA1 24260a5a31edccfa239cb8ebacd904fe005f7233
SHA512 0da645c12c1d6787621f4cf798130b072150624b300f3a1e52b05225bc2d2f0ec0309899bef5fa6d8b7cd42e12f9896625c97926e5a80a18b0799b475c83c7fe
SSDEEP 24576:rD3FHshBIYQgArfhOB95Dr47iJ0nQZo2vI3:rDVHeBIAADhOlciSexvI
TLSH
T1F295E17DEB9C04E4E57BC2BCDA538A06E67138A9032156CB0690C1B95F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1548-399-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1548-177-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1548-178-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1548-597-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1548-598-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1548-184-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1956-211-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/1956-202-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/1956-405-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/1956-205-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2304-215-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2304-216-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2304-222-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2304-224-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2304-227-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2568-147-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2568-153-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2568-151-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2568-138-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2568-139-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2712-448-0x0000011C23290000-0x0000011C2345A000-memory.dmp

Download

memory/2712-669-0x0000011C23290000-0x0000011C2345A000-memory.dmp

Download

memory/2800-173-0x0000000000AB0000-0x0000000000B17000-memory.dmp

Download

memory/2800-398-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/2800-167-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/2800-168-0x0000000000AB0000-0x0000000000B17000-memory.dmp

Download

memory/2976-110-0x0000000000400000-0x00000000006D9000-memory.dmp

Download

memory/2976-0-0x0000000000400000-0x00000000006D9000-memory.dmp

Download

memory/2976-1-0x00000000026F0000-0x0000000002757000-memory.dmp

Download

memory/2976-6-0x00000000026F0000-0x0000000002757000-memory.dmp

Download

memory/2976-7-0x00000000026F0000-0x0000000002757000-memory.dmp

Download

memory/4256-196-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4256-189-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4256-190-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4256-404-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4256-402-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4256-401-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4796-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4796-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4796-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4796-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4796-231-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5300-239-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5300-406-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5300-232-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5300-233-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5388-145-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5388-130-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/5388-131-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5388-304-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/5788-547-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/5788-614-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/5788-599-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/5956-22-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/5956-20-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/5956-400-0x00000000007A0000-0x00000000009E1000-memory.dmp

Download

memory/5956-14-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/5956-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5956-201-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6064-163-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/6064-388-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/6064-155-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/6064-157-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download