27139382bdaa3dbf2c10ed83604d2f628523466b9fa928cf31a460beff6b13d4

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 705KB
Sample260701-lsdk7say8k
SHA256 27139382bdaa3dbf2c10ed83604d2f628523466b9fa928cf31a460beff6b13d4
MD5 567c85c73f49865702391d51ed820b03
SHA1 479744b32e26e2d19951123ff87d5b92907448ad
SHA512 e31f2ab77c777bc18abd79c923110cde5e8edf843e976a12ee60731e59fd5abcc21bd016dc5daddaf6f81419c9f6ac4233aea433933f39fd898b351a93409a52
SSDEEP 12288:ChA+ZFc2ms8R+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:C1ZoRyxknw4FYnshx8OfVe247
TLSH
T1EAE402287BC1C0B2C44A10720A35D7A6662DFE314F7591D3FB597B2EED705D0AA3A293
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5908	elevation_service.exe
5880	elevation_service.exe
5188	maintenanceservice.exe
3036	OSE.EXE
752	PerceptionSimulationService.exe
4424	perfhost.exe
5496	ReFsDedupSvc.exe
612	SensorDataService.exe
4404	ssh-agent.exe
3272	AgentService.exe
4160	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c3bc8aaa80095f6d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6e1beed3e09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072f4fca93e09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d35a8a93e09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019bec6aa3e09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8ccb5a93e09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000195b7ead3e09dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
5908	elevation_service.exe
5908	elevation_service.exe
5908	elevation_service.exe
5908	elevation_service.exe
5908	elevation_service.exe
5908	elevation_service.exe
5908	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeBackupPrivilege	5496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5496	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3272	AgentService.exe
Token: 33	4160	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4160	SearchIndexer.exe
Token: SeDebugPrivilege	2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	2864	2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	5908	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 5956	4160	SearchIndexer.exe	101
PID 4160 wrote to memory of 5344	4160	SearchIndexer.exe	102
PID 4160 wrote to memory of 2992	4160	SearchIndexer.exe	103
PID 4160 wrote to memory of 592	4160	SearchIndexer.exe	104
PID 4160 wrote to memory of 4972	4160	SearchIndexer.exe	108
PID 4160 wrote to memory of 804	4160	SearchIndexer.exe	109
PID 4160 wrote to memory of 2468	4160	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_567c85c73f49865702391d51ed820b03_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5880

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5188

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:752

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4424

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5496

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:612

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4404

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f64de3d0fb0937aa6660fba12d531ee1c3ccb0a415813cdf9df0aba39b295cf6
MD5 7dba9933808582d88881363a4063a026
SHA1 15a8a4116b66fad8efc01036ca18cbe86b124757
SHA512 b23f2cbd5a42396ae9d75163f22decf64ec96336cfe2caad0e8c88fd89f76f7d447ab735a0d7b50e88666b70f7e03363ca2c3425a0ac0234e398f8df19efe098
SSDEEP 49152:9b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnm5x4x8EVep:D3q6HjBRix8EVy
TLSH
T115D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a8d43737a7ef3fcf0da193369905287e6310e8dc3e3f7f46c19f20b911e70685
MD5 ddb0c58b845ca187b1c6ff07808bb405
SHA1 61bcc135b05a8412747dd87390d3c7784793d75d
SHA512 b2b9793bf352e2176d3a2784c222fbcd0b9f290f5d9868975c5183ecbdb96914b7be2df5ab3e837511582128f007d5dfc53d82f8f928c659e7140e9e9e5a53cc
SSDEEP 12288:p1XLsswWkxy2lRq2czALG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxop:nXYfDtczALGyxknw4FYnshx8OfVe247
TLSH
T13F05012877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 edf413dc0af1277548e38e070b0cfc2f38cdf2f0979b7dcaad95349f2bb88677
MD5 d19c098cb405b559f960a64781606d86
SHA1 a04cbcaeb64b128ef3a4854ef70a00b83dc282b2
SHA512 a345dd1fe4b32f96463284ab8aef0503af91e92962de9e65ca2ebf2fc10dfb98cd8d48a0613811e9296193914a2f90bcd2279726f62d8cab2fdc1d6bc1662a47
SSDEEP 24576:k0Le5ji0hmxirMeGyxknw4FYnshx8OfVe247:kPji0Acp5x4x8EVep
TLSH
T12635AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cfe0600ccad2c87a1b152cdfc8a38d71b8fb5d703e495957253c9a70c27c04fb
MD5 313c791f12870c6c3c49c23ffda0852f
SHA1 3e01020225e815d16c57deb42fd5b16ba0136306
SHA512 521fc8450ab99bb89b9bee85f2d18294c3d19919b270f36a65ee5c4d907bcdb3af79ccc6d3e1cfbbab05b18ec9575533cf6be35e4e114edc7d1c1d64e8e282e7
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWE6q8wyuQGyxknw4FYnshx8OfVe247:r/ezSC6vUzPvxHjyV5x4x8EVep
TLSH
T199756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d1e25eca304be2de0c622652fec69d3b104a863732ea5233983e9c415c79b5f9
MD5 ce0259b38d54b144e85e882dde252774
SHA1 1b1d7be8a69bcf661d2dfdd643fad9077abe2fb9
SHA512 b4188406a0aea0de885f80a5805a8e639427e49baeadb0e95e862274367074c2442c43685586d247e48c469e6f8a00de9af8f32be5241eb95d33f57c6a98e32f
SSDEEP 24576:dVbqPb88hv/l+6PGyxknw4FYnshx8OfVe247:dVO88hXl+65x4x8EVep
TLSH
T162559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1a87ebb062f246b2a40068584f439cd8aa1ece7c3feef153919d3e27cfecc84e
MD5 8226807ca2b1aaac9928654bf326475d
SHA1 0b910a436fb4accfe4d24698fde3837b0355d63f
SHA512 08e876583aaf2fc0b174d6a43af15c5358c47fd7d8101dba64b3ea25719e2ead45066e970b60f365b4797e0bf817ac3b40c621d059ea9735a2844e46ea2acb96
SSDEEP 12288:NRCG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NRCGyxknw4FYnshx8OfVe247
TLSH
T160C4237CA7DDA4D1FA5E14335B7572623616B9A4DAB4C11BCB78B14EE0F0CA0E06E213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 def98936767b6ed6120b69f0227c7267eb43d966f95a7322225694aba902b5e5
MD5 507ed8084e1bdee7ec7832eceddabcf0
SHA1 2e20134565ec8f635bc20a49a67d3d1072dbc077
SHA512 27651cea95ec7053e17bb161539494e3d2f58a3a3fe5f2016fcef5adf01eb7412e283de588a8db9b14617b965d50b9c42134b3bc101bec7e944d2fdad1c5d2d9
SSDEEP 12288:LeBNUbTVO86UnG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:LJIUnGyxknw4FYnshx8OfVe247
TLSH
T1B105CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 37f9b411403797400df970ffe51d581703b7427a322641391726053fa2208724
MD5 af3e7ab5a60a8b6a9eb27c0378b84f9b
SHA1 a4d173c2195e0ab7f11cfc5045a3be9ca941d2f7
SHA512 93ec6bd231a451f3abf157626bc224b739870807c103409b10a16eefca342ad0d416bfcea80186fa71c85eddf2d4faa350bacbeca12efd6193e51c3fc5dbd64d
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:RQvGAdlCEL8c/yRNw5CIix8EVy
TLSH
T16E267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 3d3de3ad96aebc05871fd396d32b354f9642838e4b3103c5e162f5953e4da11e
MD5 241f61cc354abcf86d4082bbe3f573ee
SHA1 448b01130e1f7f1ce31171ee50ee3178da99d388
SHA512 ac9d43b9107c0768b446d309f57ea2ffc86782cdfe93062e5fcb85f4d02c35418911d68f95f56a562bfc5cd1fb676357c16e6767d00911c6363d0a3965da8c06
SSDEEP 12288:4AwSfxL/2Dc34DLLmt0LDQewsAj5G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGp:ddewsAj5Gyxknw4FYnshx8OfVe247
TLSH
T15115E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1a0f0724cb9430bb1251a44146724cd6ef6b45900f42e37740f61306f0e92d19
MD5 c22a8c3d66410d5556f5f110a74d52aa
SHA1 99cd2bdcfd8e93a00aacb11f9f89975a320bc128
SHA512 4d1f6cc300335bfda2284a1faeda0c7fe5b84bd9899b4ef25b14219d994f907f9b2fe0ab175e1d32ce26fd67e4aa322ab0d5f758cfff0b9b50998084a299a7b1
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHm:3UEtQevvqc2W1cpV2EI32
TLSH
T1CF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7a68ed8301152044cc51a9e120fe798f22dd821abb6957c850d13a16a66581f1
MD5 1aff019953820ee57918fcf547fbf717
SHA1 63ed56958af18a61f1cec7f9daf491ce8e351234
SHA512 b5209aff665bc7e82338ff80abb734ab64aebf090d0528c0f67a3860e648397716d4b5adad61668ef8b3642b131ab6f8f1ecb6499896be8987e97d01d378b3eb
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/zZ5x4x8EVep:OoqtVjnmsix8EVy
TLSH
T15ED58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b16151ebca3210266ad596ade1b4d192301c4d3a58858decfe495104e11f6c68
MD5 77d6274623291a2888993063709d96d2
SHA1 cd9265bd1987162c6f5f7c058e3f4abc726cfb49
SHA512 163e8904d045e27d8af06cce275eae83b4c08ed847a7ec9570e46fda7d6d8331ee81f4f495189e5c00918b2905f3bba4f9f88fadfbb895618a1c1b0f4c13dee1
SSDEEP 24576:YAhGLJIFoiwtA5l7S53cGyxknw4FYnshx8OfVe247:YAMyFoiq5M5x4x8EVep
TLSH
T10F35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 af8b3ebc353e1af86820aea0e0560442da54de152265bee95ffa052a9cb8676f
MD5 e161cb67ff0ff3af7e6726db4d3c1b79
SHA1 4d6da9de77458cc12804595d3429d34f2512b6e1
SHA512 60039790e51b6c3f152c39c9e617445af0e779d1870dbaa906b37ecf7d2f4fc0ad97c7dfd9184d6fd76a5f053fbee662a4403502f6a6695e3ec8318f8a04d97b
SSDEEP 12288:dmw5HEjsChNVBFgl0WDm+CwG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFC:YwuoOW1Gyxknw4FYnshx8OfVe247
TLSH
T16005F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 9b078c32fb8e838bba80fef6af8f02bfb647331cf62574d710ac40bb9fec6b68
MD5 c9a30ae68c6e1402bfc2b9fd1e89a41a
SHA1 bef779d3745023baa277462f937e0566a08a073d
SHA512 17a9212c9b0be86cc9d372356f31995bd955899f9c2ea70d94d73014dc0bac4c87425285e7798f21d7775cf5995f4ead7cc3bdd5c22afdfc1f5a3e5e08f7d4db
SSDEEP 12288:8BZ1IyJG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KZu2Gyxknw4FYnshx8OfVe247
TLSH
T1F0E412AC33E860F1E1A7113A89F15205E7627462677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2277c8fd50551325f264b61cc6354aaeca69476dd0396fe827322a4ffca18102
MD5 f3f813710f2dffa1345b40dc02aef209
SHA1 2469fae40144420b4c037a7937ebb84d85143c80
SHA512 7b8539ec8c7e383d28ffbc1536e859a08a5301f2b3696fb32fbb5c378e51067584d1bb012b55bddc08aa53f83f326b5e22dce22b21d3690bce4fbe98b988b0be
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:WQRQyi36YOcPQLvw2gAf+PN3Nix8EVy
TLSH
T128667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cf83b3a1b35df7e6055624e2c756e0646b3a211b64537eeb53d98fa9a491072d
MD5 3f355f9b8b05eccffebe67fa6697977a
SHA1 9f58097ba8bdae70329173e53f662777b9ddb7d9
SHA512 3c574bb38ce29a361f4a30041438dc48e4e707873b9e9768049331a0b4a73369126f7e8fd49de0315c209253223c8d406fdfb024b54016eb45bc72115d7a6fe8
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:mQRQyi36YOcPQLvw2gAf+PN3Nix8EVy
TLSH
T10F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1627403126009b05a0273475e9652d3a3543ad2f92d39724d6ef726c267e7598
MD5 a98d527f7fc5b662e80b4a565311e657
SHA1 f9c45b54417aaecc813ee77a53c1a10b305fd5e7
SHA512 6296206c9751021b5c9aa0c836704ec3e97de1066155a4e64e3c0b1ff50477e9c81ad4faf48a0d0e4f5d5f18a6eb277be06ea354db812b59f54aca28f692b9a3
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0mGyxknw4FYnshxa:b68Qg55nhheWu7PNU3/p5x4x8EVep
TLSH
T13FB55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 11571aebffeb672a819487a5021e3a6648260a1e6463d9d38f8c96176a713144
MD5 401a8fd64a58293a5601711cb735c9a6
SHA1 bdd359d142fcd6323186fc9e265c28bd39b9da47
SHA512 e6d6c35476d9174a92b32e70d009e098257e78600c9b0d4164ba1b0784ee6a7ea46e451de01b07d4b8458559ed42c0370fc83a8d60199539974cc87974cad237
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:gy5112gYy5azzVvL69nLKnhZKix8EVy
TLSH
T100167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cf7b85a619abbdb94ac5af4548e14d5fe5e0d8a716198965995f7da61bfe18bc
MD5 c9227539a7e2f3af8e881e01f7e0620f
SHA1 2d3a041721c861a65ef20f5d22bea2b11cc04710
SHA512 9f74b7e733cc75b74b12d6554efac99b29f0c4036f78050065b667e2453f0052fd781ada30807f6ed6c3d8d8519defc8dbdfbab3fd2d926a4c0a155d13933331
SSDEEP 49152:UB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl75x4x8EVep:Ou6JmVxd2dlix8EVy
TLSH
T106D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c642a752d7ef45800786938faf423d62a0625e4f77f407d66077c7cca2e3f62f
MD5 82d46f993f86a292be8211de9076020a
SHA1 42f648799a6435a8ca63f1746c0957e5cd8d4530
SHA512 08e667aaae56a22c394e9540953f8f90a0c15274d2194b6ae364dafd0a7cda94a7adbc08786247030dedb23df09ae6513786ab742aa973ac4683329b5a1b982d
SSDEEP 49152:Y1hpsNoJpF1A6UU44CwH7R4xH5x4x8EVep:YmifPbRsix8EVy
TLSH
T1F9B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1e760b297d9f92703897b6645611ca41d0effafd2492fcf3e583ab3dd186ba00
MD5 e51fd9ae104c59790bff9cfd02ab0149
SHA1 e1be49e877873fed9b5822b6c0b878ff736d0194
SHA512 099875e2e85992b0118d58c099cd2bd6149e60e0e239b6cbf41fbc56401fac75aaf01dbad1b884bb45adac0345c6cb651686bea44102ec126d61c4de240638a6
SSDEEP 49152:KSuZQIY0Be2KRRVtOnks6NMHq25x4x8EVep:U5dKTi61mix8EVy
TLSH
T131C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 50b8b57afa7c215c8b612238baee29505b02f7d76035364d569020be9229f454
MD5 438bc69016b43152d92bb3f5a5278caa
SHA1 d423b4909226210119ddb3857e0c1edc0b894916
SHA512 c00fa54f92f9001f97f06788242665f331fa449d447a58ca8e01e008d9c1b5f8104e2139fd0b184613d2fd592d7c25cf6554a8b2de1be4ca981aeab8bfc42e1a
SSDEEP 49152:UhtSn8EApI0figngiDn0AP5wL5x4x8EVep:1X2iyphQix8EVy
TLSH
T15995BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 375fe51aa27a1c3870e7e24250ec71864e66f2b6af97215b04391ef9452921c3
MD5 d8c0f345454db314aa6dd2458cfed0be
SHA1 55eafc61f669cab4f5d2725fbeafc3287c73743b
SHA512 f5333cad56779e8b38f4921e0116b349b9b2d552015670c34ecaedbd39f026f54affd15c4e3d1708df27ae5df9b3575b819584ea346342536065e2c9e7ace97a
SSDEEP 12288:Y6G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Y6Gyxknw4FYnshx8OfVe247
TLSH
T1ADC4237CBBDEA5D2F50D11734A7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 4e2686cb61bb34ca4d530bb8ad28962cfac985ec2663f2662e9d86bbf5481a91
MD5 3a565573f289caa238e7c5a6914206ae
SHA1 f968335fe09482fb84c2baf4e1cecd3a66761370
SHA512 bd1f35e436788ad6ad1eecb7eec10fd2cd7c59bd949ca4a347c7a0be055d2b709b39d87bc7949adbe55f9c57b49aa5f42bc19a9794640901bc9fe961e383b843
SSDEEP 12288:K9G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:K9Gyxknw4FYnshx8OfVe247
TLSH
T14CC4237CBBDE95D2F50D10734B7162626609B5A6EB71811BCB7DB00EF1F0CA0A06E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 069b3193c1e84aeec645d86d956bf804604dd8732cab02a0471d30a6ee87817c
MD5 7986982194e4d5565926d2a9cbe41385
SHA1 f1ffa8c2f64a984510abaaf921642749fd0b68e9
SHA512 d1b938e9ca342449079b171f3da80fba0a796650eeebf05df40b408c84cfb2e0fcdff01ba86a9f718e7cb5a8bf7abcb2d0cd6d8cbd30c3ae244b1a566779a101
SSDEEP 12288:6/G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6/Gyxknw4FYnshx8OfVe247
TLSH
T137C4237CBBDEA5D2F54D10734B7263626509B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4d4a328b6bfd0246db1e47db395879041d0da1763f921c27b05de40d5fe3bded
MD5 a6c5a084ffdd100f9f9f610e5aaba774
SHA1 7552715f5454ca11d3866d5a42c2beaef576abb7
SHA512 00c4e517338fad8ae138e3b284acb991e46f7e4707f433313423684061784eb252d241ced12326083c85390e3a940e0302e821f6657bd4a4b26a65b23a0b6a7a
SSDEEP 12288:NV8G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EGyxknw4FYnshx8OfVe247
TLSH
T187D4236C77DE50D1E85A5173CA726222B265B8E5EB31C35FCB24710EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 57e2c7c89fcf0a1fa2ca2898d24f1ffc3ee710655bb2d3fc4f7aa19d61565ee0
MD5 f6bff91dd7af19c032bf4e08b639acb7
SHA1 b4101b063285da05f9d935bd9c3db2b7a82b42a1
SHA512 119dc08c52efdac57267e44a0f245f1af286f2b8eb65ec068776b407fc1c8eb3bb043eba369e78d30824eb19fc03c40984b8205e0400f9fa9d03aaedbe13ac3e
SSDEEP 12288:xEG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xEGyxknw4FYnshx8OfVe247
TLSH
T18FC4237CBBDEA5D2F50D10734B7263626509B5A6EB71811BCB6DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 0bf69ef6e580738cae1dfbe2100bd8a7d1cc0b8d3c38d5753b3553c4722c2984
MD5 90dd42e7786e4c7ea42c849d2c47ab78
SHA1 96dcf9d2502ea31cf2c060c2fefe29fa6bd73f87
SHA512 b81dad3b8b71322f11b2594bf946b010e33c138b0c50a97999c66ac951b062e186c4b7b64089b282c0b4b383f5533d933e3330e65cd9599cdcbabc668ac4ea96
SSDEEP 12288:pxG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pxGyxknw4FYnshx8OfVe247
TLSH
T1A4C4237CBBDE95D2F50D10734B7162626609B5A5EB71821BCB7DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 426f6c110a0e89e4fddeb0b5bb9018c29871cfb8c7b9e50b589de89b73e0d34d
MD5 9dd95609500be5dbe84232c6504696a1
SHA1 81a0cdf43e436754a1d2ed813bb93803082a20b6
SHA512 85c6372b49a8cd7244c65657b125a5c5b6d23f9d6530f6b129d02e711a42c5da1756374af1e15c6c71cbc924fff2a909e2c5416c9ffe3bbee20f0cfe1a2570f0
SSDEEP 12288:xlG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xlGyxknw4FYnshx8OfVe247
TLSH
T171C4237CBBDE95D2F50D10734B7172626609B5A5EAB1821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 864c6575ae70d927351295e3ccff1fb1490e85053f7466815387009ddceea597
MD5 592977ae3ca247a39c945b88ff52e4d3
SHA1 ed0f9ca05bb76c7a38fdc72e9daca24a67457fda
SHA512 f1baaa5d699dced049eaf7bcff8f4b380aa06316ad737159ebc1e83eba92d02a75a7e128076262ea6dd3272a17e11380538e1a53ee842e5cab926fad8d5ab9ec
SSDEEP 12288:jiZwb6zzFEoS2cPvydG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpm:OZMSzFVSOdGyxknw4FYnshx8OfVe247
TLSH
T19E0501A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b85eee541f8129dbeaecfc4fe41c9a0d3b1664828c5e549ebefcc8f9feff3c0f
MD5 5d4ac7b4005091c354d136b534c28246
SHA1 d009f4587b2224c0d649ec335c3aa46e4341c4b8
SHA512 87c2c20dceea00334c8326859cd84a50ad6983030944d54f41ca86507de56f2bd1aa4b994174230970494671e28ec9f3ae3e50f72b9ec8dffa4a931bcd815e16
SSDEEP 12288:nGG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nGGyxknw4FYnshx8OfVe247
TLSH
T162C4237CBBDEA5D2F54D10734B7163626509B5A6FA71821BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a85c621780027e2a971c80ef81ca2012984849138aefd73118512570ec1bd5ee
MD5 16d0f72601c71c9ee775a660c803d105
SHA1 cdf99131549b1b68ea72bbaadb9aab28f66f6bce
SHA512 4aca26b42e3604b975ffc6c6383eee0db6e53240313796b2ba97d64ebe48c8a57614500bece324d4d8d241b6a1fa7da82f756a6ebcc43ef75906520f2ee31ce5
SSDEEP 12288:qSG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qSGyxknw4FYnshx8OfVe247
TLSH
T1B1C4237CBBDE95D2F50D10734B7162626609B5A6FA72821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 1be5bd14a7bc5c5f8b30aba592f414cbfc7742816a2fd338c2dd26fbb11e6e09
MD5 05e14bbc51c4841107d8bd1737b5f975
SHA1 e50c208ec52214bf5506e2d0b59151821e9a5e50
SHA512 9b75bffad625d84e020da4ea8c17c5fa5b337de59642732503debfa60767e14aec4b42a286bc2032ffb6faf1a352a979693345e802d82a39c83d12458d641faf
SSDEEP 12288:kyPz5L8JG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9zyJGyxknw4FYnshx8OfVe247
TLSH
T1AEF4125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E725E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7a006779dc47582980cae36f29c9cb41438127e3bc5d2b85e82a3956b7f19ca6
MD5 f0b22be76ffef8a9b92fb5a3209eb122
SHA1 9640aa090ce442229cde5fa62a6bc44d45a7b6db
SHA512 1ae534da95276135cb8dccba360b2d5b41f71fd537987804c38a7490b04289177499149918c2ff030330323618d95b2f7edb8500689c969a5edb31940ed85b0c
SSDEEP 12288:XGG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:XGGyxknw4FYnshx8OfVe247
TLSH
T15CC4237CBBDEA5D2F54D10734B7163626509B5A6FA71821BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 a4c06a40e4e627f714bc853f4ea327b442cb31e946b387ed6d673460dc479165
MD5 d38136a5ac174df9aa3b3db6753b457b
SHA1 9bfab4fc419f09305c5a911d403c24b541c23ba6
SHA512 8944183e3399443ecec14579ed8ddfaf396e5a53cfc638ce12f4382314998269f47202f5f34d5e91392f62ad2f17e6e608ad7a9330520a3259a695c049430da0
SSDEEP 12288:4GG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4GGyxknw4FYnshx8OfVe247
TLSH
T1DFC4237CBBDEA5D2F50D10734B7163626509B5A6FA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f84e9d81496e1f3c2cd038b38e9c4bf583a0c8ce57a5d9759d3365dcac64fde1
MD5 ee3ee215bf6c2e3076ba94cfe9fbb976
SHA1 41dd82c6d0d8744503a72657b4f24b18c18d77f5
SHA512 21c3b9f5818bd960782c30514bbf728762e8f5e90c89e7161d8f7680f20242123dd8f126a81cec07aac5f261ba795ac1c1b4741b834c8e4713dc793547d865a7
SSDEEP 12288:pyPz5L8JG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7t:IzyJGyxknw4FYnshx8OfVe247t
TLSH
T125F4121B73E530F5E12A4236C9621612F772B872473086AF87A4537A6E725E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 eec1808fb0df14f389faac5208a4f6c78bbbe0ce1936238963008bf0a815a015
MD5 e2c2cf0bd0d69fc4d505d285c3a96b36
SHA1 1622ec38bbb05e502dd8fa032d13a572453ae919
SHA512 4174fce7988c050b50d722373ba80f420d86b98675a6568cd2a961d51e20342bb621db3ba4a859a9c799c8a131c55f524dd0ab2f567a91f86bb9376e139bc00c
SSDEEP 24576:YTHaLl3z0zDvGyxknw4FYnshx8OfVe247:YT6LljQ5x4x8EVep
TLSH
T1980501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c80a89e6a7f2951e520013a87ce111f90fcf9b8217a631b9e594c35e427a4b33
MD5 a7edd5270c6766607e0a533301b0a397
SHA1 b6196c7357daba29e0a64b2164ef640aa1579b6b
SHA512 43d5ed1faa3539299f5c570d96f348e748927c1e68c713f442f7c03aed37716b70cfcfb5eeb91c6c2864208a8aea4c61f0a7a72e493b6cb007682ee2a9ffb54a
SSDEEP 24576:g37d9CHKy7GZjGyxknw4FYnshx8OfVe247:q7d9CHKyaB5x4x8EVep
TLSH
T13C25DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 4f2032366e4e1a1d2c528f9cf508ce6f5dbbbf319dc366df926386e13226d920
MD5 671f096bb1e9d362da6cf4dd473c5ce8
SHA1 203fe8e92c058de75e368944cb7cff48d5e0fcee
SHA512 d0f642ba3aeb61de76c605fa84472b9a97300b98c7ea710b26c9f76bc9d2867c5726c52bd0153c9582b0db3ec85ebcb915e3a22dc9b2ffd5c5a48b7e3a524260
SSDEEP 12288:KfG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KfGyxknw4FYnshx8OfVe247
TLSH
T1A6C4237CBBDEA5D2F50D10734B7163626509B5A6EA71811BCB6DB00EF1F0CA0A12E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 63010105a3289a9ef81ecd82fbfb21f907df58c5845c10cf996e459cc041b5ea
MD5 c9370d1b948da35c782decce85583291
SHA1 24d2c5d628f004bfe5ee060467a1b1aeadc2cf84
SHA512 b938fbcec0b4b4cc506afaa62d822436aaa18598c8d9efc64328c57d61d5d04a9e609cf2550ca365fe81471dff85ddc6408304a55825b83bc9aa138e8353df6a
SSDEEP 12288:NpG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NpGyxknw4FYnshx8OfVe247
TLSH
T1CCC4237CBBDA95E2F50D10734B7163626609B5A5EA71821BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 734da87ebaac9b70f0cc916dbc0ac973d80796a6eb4e8af6dc16ffce75f0621f
MD5 c32a81e7d085040d87cd09a603dd4669
SHA1 1296ad80a5482386c4d1afccddac626bf5f4ba43
SHA512 c281f14a9eb4cbe72da8d16ee964775b4fa4a4576960c5240daeb093ec3ef7c866a970f29a1a47b87579b3baea807941d543ab26f27f2d24cb3ea77aa4d16733
SSDEEP 12288:iYG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iYGyxknw4FYnshx8OfVe247
TLSH
T18FC4237CBBDE95D2F54D10734B7163626509B5A6FAB2811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 7f92cf907aef5baa18918b2602a9ab1ae69acdb09f8a2a9074a33257fc2c9508
MD5 cd4cfd768384932bdfa49e22747e1894
SHA1 185642a093eca0e5ca90da596e83d69b4cb6b504
SHA512 df3c7bde43346d1107efccdb587f63c02b996a59f7cee0677b40c69f9f9d7b31764f4bd2c47d2731e1ce48d76e2e33bf400763f3e59773c0ed79727658201463
SSDEEP 12288:RGG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:RGGyxknw4FYnshx8OfVe247
TLSH
T151C4237CBBDEA5D2F50D10734B7163626509B5A6EA71821BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 8bd1a65bfb7413c260635ac1d6ba8bdcdc086cae231ee1d68d35016978f94c48
MD5 40b40e6a4506efb73a5e0f416c6588f3
SHA1 14c0510dae90989a64bed35d4cce21a65afb1c99
SHA512 04dd84f6f532e6fb509c1680dfac176e32a68d96f383630052649789c3823f92aa4490231e7d9a9896084542aa1bc1dd8de4ea076279f9e0e5d06b6aeffe4a7e
SSDEEP 12288:xfG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xfGyxknw4FYnshx8OfVe247
TLSH
T1F9C4237CBBDFA5D2F50D10734B7163626509B5A6EA71811BCB6DB00EF5F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 96dd9a847e2eb63c68ef31fca81ae8c5ce96fd223a67f98bff099c1ef8bda824
MD5 9def0ebf52c2d26f96e9e713a371b1dc
SHA1 b556628e9759eb903664ab4efbe5336bdee975ac
SHA512 ad226ec51a565cd3c34de73908de366ce5b00b80e4b680bfaa6e2967b2e1f1f8b9ae9b07efb5cc875dd67e3c7508e922017b2b4f7ee7e34cd4c9d6d80392275c
SSDEEP 12288:1OG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1OGyxknw4FYnshx8OfVe247
TLSH
T1BCC4237CBBDE95D2E50D10734B7163626509B5A5EAB2821BCB7DB10EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 0159289595e513a3199a34b992a402b596c4cc92e4d5974c313db10404cd70d6
MD5 dddf05ef9f566d1680ac637a1ceefe68
SHA1 8634f02f5f0e58280f4681c75cabc4344434bd2b
SHA512 94f2e860b30c7ed3547057aa4b73174751de3cadcab640efb81209c7a40ac613deed2e6deee6fb93465dc5ccc5809c62893511211ccba7170dc093e8616450d9
SSDEEP 12288:+EG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+EGyxknw4FYnshx8OfVe247
TLSH
T155C4237CBBDEA5D2F50D10734B7163626509B5A6EA71811BCBADB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 09bbdd8831760b51e576cca6b036eaec6bb346fb1b1b2ea97e2aff96e4ae459d
MD5 16c770ceb8c1f60f5839344945330ab9
SHA1 0771760d486f4e3ef1f2da627424c2e6a6a8d728
SHA512 2ce1b9898d999ca78f6385ee9a6d5e2213dde821327cbc6af6ef81d351a7ad8952dbf45b5d07b197dfb341f5bcc0a3bb525006a4df89c192ea6eebcdaef6b664
SSDEEP 24576:6fwvok9RX6wkyAIiGyxknw4FYnshx8OfVe247:GMnYIi5x4x8EVep
TLSH
T1CB35CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bb1e4073e66c82e6f92f7dddd3b38f2499c86f5068ce14b533a36ea5fd47e3b5
MD5 25beb5b770c10106506fd48aaa9ab03c
SHA1 937c81f7eec6512ea4563dee53ebaf38fd188346
SHA512 61107d372379616a37edcc1ae51ee3413347d17ef0ad2297ea69ef636478247aec3565ca03e8c585237a18917e34db5baf08f91882e0899870d2409c3f4ea449
SSDEEP 49152:2YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0r5x4x8EVep:oySzPtix8EVy
TLSH
T196066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 106f83c29340bc9f234215928dea9df933916f1204c86c1bfabcbfe16d567fe3
MD5 7733e967282415d2cdb294a97dfb10ef
SHA1 e0ee6881d121dd87535958cdb87c58042842e23a
SHA512 8d15ada1f7373caf84387d3930963d43c60db569d743a512979533311544a4571e2ace0a85cefa5f04f307ed329a4ad6a866855ac9cd26d3debd7e0bbbea3c3b
SSDEEP 24576:s47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYtGyxknw4FYnshx8OfVe247:s47JUQj1irIhCnDHUPfF/75x4x8EVep
TLSH
T15365AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 d6a67c746c87506de778d9a953374e64d630388d8965ec87cae382ded94946dc
MD5 6995ed8e8d681e1c6e9b3f3cf0b2f646
SHA1 08653cd03f5898217a9b7b1dd788ae5244ed9afa
SHA512 3631c18b1959aa0d71d8fc845049dac9e13e8df3d25a1352491f7b31001691d74b7521fa9aebc071d58d2629ba616df620294130aff3a3be524087ec960e9a84
SSDEEP 12288:GNsf2G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:P2Gyxknw4FYnshx8OfVe247
TLSH
T150E4F028E29812E4D06E2176CB625641B3237C6597F1D3CB97D0F53E2F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 02b40f228ab909649cef67ef459197d87e3e8f1be4da467a85c4c10ee2a0b9cc
MD5 01f7f15e661b2d90b062fdc5825033eb
SHA1 a915cbaceeb04eabff47969158cafe50d08e14e4
SHA512 3a9f48c190fc4ce9276daa8386352b8c02b129c02a3a69e75dceb1b9283e39a3de27065fed281e17a28be2047ba55306fd1d33664fdbcc33dc788c2eeb701743
SSDEEP 12288:jMSEDU3flhWzxi019z/lFOyoQkv8eShMnWOyYbQP2CQg+NjEa+ih:jMSOUP2NXPFxaHSOnWbYbQPXL+NjET
TLSH
T192552801B626C78FC6A940321E76D6CCA7707D41EE04AF1773C9873F8576658BAE6382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 3c47bad2934d1d600e32874b1d4743f83f20047a0d191d749a69e3a9feba3c28
MD5 355f64cc1d8139ed3f47c5387e8fbf3f
SHA1 d6d4c4a839b263cde98150788596a393cf7b3753
SHA512 3a82c36080d2b239fb6131c5a0a24889fed2d9e6943569b5b8d3089619e03042ce759987dd5dde601ba35d802e019fe0fc476f3892e954ddb68202932123022d
SSDEEP 12288:ojNHxP+bEsFMozAMrQVc0deYOmgKpUMzEhDpJRVUluSMSZHPdpJoo:o99K7adeypz/MSFPd7N
TLSH
T1BA450900D5B7E35FCD6A9037173296CD7BB85C02BB453F04734489389867AAEB6E6392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 7c3528c5f503548be59172233abd3763eca5379c4b1622656a12cd0c4b57702f
MD5 c237e43e23fe8d03d3841f567b149f08
SHA1 0aeadf3376e1501f07f730e7dbdd23ecfa5f7a7c
SHA512 08a6473583c8f22068b2cf6a7e1dc8fe30e06f05f94034f885d1db10f0697fd16b9e40b0bf9d2fe8d1553ed5aa5a1892afb4e6d11940feca4ac7b5ca82f8a61f
SSDEEP 12288:RM7+G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:K+Gyxknw4FYnshx8OfVe247
TLSH
T137D4237CA7DDA892F86D11730676A231360AB5B49B70C1DBDB28B14EE0B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b41527fa83aafa7134471d7104c8fb87e44eeff203a7075b962ccb66af50a6f9
MD5 05230ed01d71b5a50a0160e231a99cd1
SHA1 6bbeea6d73e6d6c0d5d4c6bb431b28c054ae22b8
SHA512 fea4b3c39006b167b26bf3909bbcab114e6f2e65037012b1b6c17c0d731b7c3bd2437932131f48dc753c25734b81e8f78575d1c119fbd25214c78bf75705f82e
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYQGyxknw4FYnshx8OfVe247:Dgb4mBIBhGFt5x4x8EVep
TLSH
T10965AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 567fb82d59d8d6118722c8d13abad4a6cf57b26ac0019575763446674cadbbc0
MD5 16f7e40f11f9b51c7ef1b27b85b0c6a0
SHA1 3d82e5608576a245d1e70b86d9d496b6c1fe633a
SHA512 7c65b32a1d4a0593e6ef8af9477560ae8dbf2e6a37b2fecf2614f96530113194f3c100f39c5de17fe83566d73adfcb6d63f961d528a0714698228e0e318adcf0
SSDEEP 24576:YG88u8FpJqH1bzria7/mdGyxknw4FYnshx8OfVe247:b7ZFPqVea7/45x4x8EVep
TLSH
T18B35F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 45d6f39837c7a3dbd3739abc592ec2f174f665559a1700cabd11009400285cd1
MD5 673a505fccfb916597d1ea13b3f56dd2
SHA1 b55cd5cf33a32d0560dbe578847fb6c90cb772bb
SHA512 4529a28dd8ad9c5e5e3edd0263b5440656a0748d0fb56a752acc9b2561615ed7d779941b2dd69af7f6739831bd689492a019421d24206963193360df62a35a5e
SSDEEP 12288:1HvUrBFrEjwaQBG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1PUr+NQBGyxknw4FYnshx8OfVe247
TLSH
T1A705F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 40dce4aa4919be70462425976fc49b9bc55a428fa159094b445a108632b09dc6
MD5 f49450d926634349741f2ddf146e1228
SHA1 53f68026a8b6994874d1425d33b70161d62ea09c
SHA512 a6e15f0a695dbef0ba88d9596874f4313581bc0d104624222eac202725983cbd775458bd6503c3a285a3c00ee36a194764416ee81671a3f32fbc9086ed5d8295
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjx5x4x8EVep:QG05lO43byix8EVy
TLSH
T190D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6250b4d5c982e2dffcfb701fb12d578b95f2ac9a2f15c0e6d1d44e0a0fe54957
MD5 ad3890c1bff3d9b72ef99d1058bd94ff
SHA1 55026a171d27cc3a879b86292fb5215c1264e705
SHA512 1e9711213cedb63592e814a5c99d078abe60eaee0dd69a1e64fe5c9d463ad2f512fce22d70a684584bc331986c57ab0e5fbe287915fff4412ec91118664edd5d
SSDEEP 24576:4fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnrGyxknw4FYnshx8OfVe247:Aa5POZ3+Jt2pasx2+mp5x4x8EVep
TLSH
T1FC65AF5DA6FC01D5E5B9D17DC583461AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 607c97590b6dc6ec63564c4cac9fa71d91f8fec82f38503861f41878981e06cb
MD5 d5c0ad747cf7a74e82f46c2235ae2b6c
SHA1 d5fb26cfb1ff0a2cf44db75a9ffa6ca85d2c5086
SHA512 049c8c34b62d150d05a0ff93d2f8bf1d6c1d70bc4197756e0da426b53de1f15c6f047fa090773b5bd5907e3a98b798fcf85ed45db36cc67bc798d29557379d89
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FkVGyxknw4FYnshx8OfVe247:ANc/zEOVHFY5x4x8EVep
TLSH
T1AA857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 235700f4ce83f4553157db113a4c1e85de622042d086e9744a697c810c27febd
MD5 8456a67ad043ecd4a261f06106bea214
SHA1 af817003521f38d9d6b6d03cbba457a78ed167eb
SHA512 83ed8a100bf345f9e6fc81ae39e14abecd3fb4235c8aca019c0f93e092d2fc02e197e8ac328363fb51a9d05b7e0d8f909881cc624e105cc526094dceb0b673ce
SSDEEP 24576:C8kNvNnaFeYhJNtmZBm3Gyxknw4FYnshx8OfVe247:C8MwBtOm35x4x8EVep
TLSH
T12E55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 c817ac149a57ea677779e35c8404399f32b1523809e892980d71e1f14f3dd51a
MD5 77bec877139c081ffdcfd0c7559d4db0
SHA1 283d0b796505b1b429416d7162223152beb61dc0
SHA512 f2dae6b20f75855492c53b136ecfda54a785f937553a10d2ff8e55eb8dd6a7e809d5b0a67dcf8472c28e44f9c6ec749d4800df6e6aefe764af6a6da5f13672b3
SSDEEP 24576:2D3FHshBIYQgAaGyxknw4FYnshx8OfVe247:2DVHeBIAAa5x4x8EVep
TLSH
T10A25E17DE79C04E4E57AC1BC8A638606E77138A9033256CB029491BA5F67EE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-409-0x000001B80C990000-0x000001B80D010000-memory.dmp

Download

memory/592-322-0x000001B80C990000-0x000001B80D010000-memory.dmp

Download

memory/612-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/612-108-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/612-314-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/612-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/612-102-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/612-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/752-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/752-309-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/752-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/752-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2864-77-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/2864-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/2864-6-0x0000000002230000-0x0000000002296000-memory.dmp

Download

memory/2864-8-0x0000000002230000-0x0000000002296000-memory.dmp

Download

memory/2864-1-0x0000000002230000-0x0000000002296000-memory.dmp

Download

memory/3036-55-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3036-61-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3036-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3036-288-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3272-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3272-133-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3272-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3272-135-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3272-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4160-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4160-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4160-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4160-317-0x0000000003000000-0x000000000329E000-memory.dmp

Download

memory/4160-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4404-114-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4404-122-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4404-121-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4404-313-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4424-84-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/4424-310-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4424-79-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/4424-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5188-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5188-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5188-39-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5188-47-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5188-50-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5496-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5496-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5496-332-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5496-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5496-89-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5496-95-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5880-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5880-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5880-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5880-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5880-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5908-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5908-22-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5908-14-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5908-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download