Analysis
- max time kernel
149s - max time network
162s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 12:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe
- Size 173KB
- Sample260416-p3llcaax41
- SHA256 67ba53128d764ad0c8d8c0594b1745ae8603e83f547b8c9feb142199501d3ffb
- MD5 4ee315d279badb77b708b44b73abeeeb
- SHA1 0d946596f9df9cf4281cd22c7280f21c2a2448d4
- SHA512 bcecf389826f825fd34e15fca999b0d21a28fad148a3de4bb3c44c088ea8a87e87024d3241e3e23332b645b54de3ee2a4bf3609c871e3717dc9b2147ac58a33b
- SSDEEP 3072:gCSjGoLpWM6VsBEjxeZdi6r1Pg9uCRFRzsxeuPo10JOSdBkK:WXqoEupPmRFJs0ug1MOc5
- TLSH T1C2046C26B6ACF372D0E255B88E5CF2E16D3D7E300F2548C772982B9D9E712C15A38356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 5276 Logo1_.exe 5288 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4028 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCXA239.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.Exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXAF2A.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\GetHelp.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe File created C:\Windows\Logo1_.exe 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe 5276 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1108 wrote to memory of 1464 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 81 PID 1464 wrote to memory of 5216 1464 net.exe 83 PID 1108 wrote to memory of 5192 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 84 PID 1108 wrote to memory of 5276 1108 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 86 PID 5276 wrote to memory of 5360 5276 Logo1_.exe 88 PID 5192 wrote to memory of 5288 5192 cmd.exe 87 PID 5360 wrote to memory of 5496 5360 net.exe 90 PID 5276 wrote to memory of 704 5276 Logo1_.exe 93 PID 704 wrote to memory of 5664 704 net.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:5216
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a122B.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5288
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5496
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5664
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4028
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXAB83.tmp
- Size 156KB
- SHA256 a15fe0e3ed4e53655ff4c822b2af5d6d160786f6556e31a9e24aa04d88be281d
- MD5 335fb9816ed60b8a808c285703403d32
- SHA1 19484fc5928c0146c026011df93888db4201afd0
- SHA512 84ad993be47968bc760e4dce37572131d38c8b88c2f7909296768a385a2cee64b0efc40a0389f64e82e5653acaf66d37a8c5fd7b6227445ef7c570480e0e488d
- SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6HNz:hCSjGoLpWM6VsBEjx5ZdaZ
- TLSH T175F3B36EB18FB3F2D3E1597C8D1DF2A5ED28FE20CE19285B75993B0E9A760C31508191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXADA9.tmp
- Size 94KB
- SHA256 e093a064fc3ad7440bedd983429d8358b8b874fd5825f9b671805f1fad10c708
- MD5 539f0b95a332901532c4419fe3ecd04b
- SHA1 37ed20aa9a3c821c3aaf3b149d195d465ab6ed39
- SHA512 cb248968894a9388f6d7fa48f83abb7bb6a0a83953a2ae6c4aed0cc04ec2d4f7b204bfe5063e571e4d67a6090c87996ea37f9760b9e6f2d2e77dd2088deb079b
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6YND:gCSjGoLpWM6VsBEjx+Zd5p
- TLSH T180933A5AB18CB3B2D0E159BC8E0FF2E5BD297E200E1D189F759A2F0DEE761C1190C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXB0F6.tmp
- Size 103KB
- SHA256 076d8270d7ad5c2a377eee81ea500890afa3a7e11ba2fb686a444012a94b24bf
- MD5 069fd566849329f46c5218f65022202e
- SHA1 ee2e6b4922963c39bb76a7de0ae991dbe634080c
- SHA512 34f9e83d27e7c142dbcc00e43ef0cd29f7caa6b94053a3d1e1d978e0d9d1c57cb1feabe578d6c9ff1a637486729c71e653efc84fa1bd808e7d1475075f61dffd
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHiSNQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqDu
- TLSH T19DA36C6AB68DB372D0F149B88E0DF2E57D387E300F1A185FB69E1F0E9A765C1190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXB138.tmp
- Size 91KB
- SHA256 3f9ef42982a7d0ea1b08b6134f1031b29979692a7b6dfbe89880ceb2fa09d725
- MD5 9e3d7580c0d94ef7c38d202d970f9150
- SHA1 5c47e90ac686767a71a5a7e1899429cd882b6032
- SHA512 4573eee4c4b3cca8073ea940df05ce312aa1d67f020a0eb61650d7433b4c0957c28b9b3b0b825b721814dd10c5c9cb05557b9889bcd870b5fbd1f44809f3fdf5
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6nNT:YCSjGoLpWM6VsBEjxZZda5
- TLSH T165935C6AB28DB376D0F259B88E0DF2E5BD387E300E19185FB5AE2F0DDA761C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe
- Size 4.0MB
- SHA256 9f52db7a91d0f19ac5a59a6d6665053ed69f1e4ae45b96bbfb0ccce72d3323f0
- MD5 39b394c6c925293c74118fcfda757d44
- SHA1 edfcd7be451f0fdfaf04d88e74431f4ba704bf53
- SHA512 9d7fd7c1bfaeeacb7947209987d16440973205bead5ceea20fb34a48f702c39d5ad51c90ba0728b6f4938a9695a9005afa555862ae570b15f7cada5d4063a18f
- SSDEEP 49152:iudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:+ijnUdYd+RaAj
- TLSH T1AF164903B29D62D4D089C074CE5AA232AF617C8947F161EF3690B7DA2A73AD47B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 f11b437080a61c66202028d81b56285916b2179d8d94d452c26b1ea7f6570a91
- MD5 1707625293a696734e66eb7af9d38281
- SHA1 b8aba91aa31f01f35643b0c773e815cb61086f0a
- SHA512 422b46ed8bed9e462bf46bbe7f706cb852db6d0851f8f116fd20de405e81b9fa1679a0a3f4f712c8b9f74a90c6a1e387eaa8b5b58193fced20e12a7b1859ad8a
- SSDEEP 6144:WXqoEuoXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ8F:NXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T19CE40715F66CB331D0F2C0B9C9DEB68AED713C411B3089CB5286876C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCX9FC7.tmp
- Size 91KB
- SHA256 e3c22e073ff98515a2d2bea9a83d68eeb4a5fd8faf572d3546be33334fe98c0d
- MD5 fd2cd013abff72d7a968013c28d11c6d
- SHA1 f68add299bb4c4d4e682ef2436c2cfad385e1a8c
- SHA512 e961bdaa31ee39ff22aa536e1716c96b4ce96ad4823071392f79d0f5e9028cd81a3a52a4949e1b372d433467e4d9798b2a4d56b8fdd36432a9fd465d8fba6079
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6rNb:QCSjGoLpWM6VsBEjxGZd+B
- TLSH T193935B6AB68DB372D0E159B88E0DF2E5BD387E301F19185FB5AE2F0DDA761C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXA36D.tmp
- Size 91KB
- SHA256 600294bc258d81ae7f13a6f01a9380b048bbac6fbb62f453844a8e621f456262
- MD5 876ffff1e7006d102c36e57065a0c342
- SHA1 099ec20d85d199dcd64abd0c854cf138eb4a252e
- SHA512 d278a7d5db228004da4652ca3d536982c7086a8d9d752bf467d64b4752a6fc1e74a5d9461916f0d482837006711c02078bd6802205ffe420b3c6e3a4fe0beba8
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6FNL:YCSjGoLpWM6VsBEjxmZd8x
- TLSH T19F935C5AB29CB376D0F159B88E0DF2E5BD297E300F1A185BB5EE2F0DDA7A1C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\RCXA36F.tmp
- Size 100KB
- SHA256 9f9ce258018d0df5ae050da060a8e7c6c8db2bea312ebbe730e1f27048966a09
- MD5 7c8ec887570a252159e349c7106e31c9
- SHA1 4fb990e2099289d15ef8a26f0821e018c21db969
- SHA512 2cb9d78e78a19624eec4b03266776b565996245e7a1f3f943c7face1966ce7a2e279f00eb41b04bec9151b2f362908243c3bd0937d0e9723b5e3d3f20de4dca4
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3fNj:oCSjGoLpWM6VsBEjxQZdJUfJ
- TLSH T12AA35B5AB69CB3B2D0F189B89D0DF3E5BD397E300E59185BB2AD3B0E9A77181190C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXB754.tmp
- Size 92KB
- SHA256 67003bf1ca9c50294d7c52b746826a9136b2d85193afca966fd94cb1c93b7c8b
- MD5 8c3b5bd600a5b37886b0c37ede93c439
- SHA1 26f2c69d4ecbbe25ebfa41383840c462405811ec
- SHA512 fb5953513e04e9f0e3b04a2d719c1b3c4e5dd9721ee678328a2b70f97079ebb6d75f66504c8dd4639e483f14c5908fe7f48ef2c22eba62fca7329512cb8e45de
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CCND:YCSjGoLpWM6VsBEjx+ZdDCp
- TLSH T121935B2AF29CB376D0F199B88E0DF2E5BC287E304E19185B759E2F0EDA771C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a122B.bat
- Size 842B
- SHA256 fe38f7a89eaf2eeb2f47702fea847239180e173ba194cdb3205139832e2ca3c7
- MD5 3e0f3f3076b01f939401e9719210e481
- SHA1 3f98d4cc404718ff444bb546542348275efdccf4
- SHA512 e29e3b7a442ca6f7148a0deb118bdaf204b208928fd9a1b6773a6c0b69d7d4e452a6b7fdee76a0a267f4266cd2173e39e2d590cb7a1713fa9372f23cb371c489
- TLSH T10601E9445E6E143A0F57850F09F6FACF825696F417812B527F20870D23F6A08E5BB5F2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe.exe
- Size 80KB
- SHA256 06222f5319945568d31610d9397bad55125d7dce62f6cfcd3f0e4737324379e6
- MD5 51f9aa41b0bb9022c11c26559562443d
- SHA1 876e47c5bd34dd12805f8dc7548a08366cffa107
- SHA512 b49121fa0afe3a8b800ab6b26d80af2c2aa65e2c782a7bdd230aa22f9943d7fce1714eaa84d6471409881440f2a8adc6b300295fc50a4df37496368ddb22c621
- SSDEEP 1536:UlZ1PNq9uCUOFVSiHdq+sxne2FPo1065sPMgurHdCOSdBXke1:Ur1Pg9uCRFRzsxeuPo10JOSdBkK
- TLSH T193835B2179A0C132D8E355B449ECE2621A3E7A724B758CC3379413EE9EB03D19BB5367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 9f46acf000c40dbbcde70bde3cbfafea3dae71f2997665786d7bb17fea5d59c2
- MD5 09cd1b8c9a1334731ada1b70a4655328
- SHA1 71908d114eee3f2d7e12497daa8d691faa0368ac
- SHA512 40348402ba744a9868faff89ce50298d4d4143bcbdc7a7c0d4a525052a09281eaaf62b795d229093ed48d7e3d9f8c469c7191e0f3c0d37b496bd7d5dcf22c7bb
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6HN:gCSjGoLpWM6VsBEjxeZdi
- TLSH T1A9935C6AB29CB3B6D0F559B88E0DF2E5BD387E300F19185B75AE2F0DDA761C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH