74ea3a3ab0b1ea54ce1f6726eebaecec7220565bafabfe42084ebb2e0dc0cddc

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Size 7.7MB
Sample260716-nd61baft2t
SHA256 74ea3a3ab0b1ea54ce1f6726eebaecec7220565bafabfe42084ebb2e0dc0cddc
MD5 bda5e1f08f81a263779a9ee321f07f3d
SHA1 ff0157f79fbbfd5802b106a54716633fb986fdae
SHA512 db5de307a480c659a89207fbcba2cbcd5e2267bded65bb32046be097be680564be4bc43bc1110ba7aca8c8845f676979b37d7656f90b1a871a410ca5c1194084
SSDEEP 196608:9YnJNM0kRMIQ4B0N6EvjG0CUw53kxs2XRHlc4u2lcIW6YplTpL:9YjWMIizvqkwBEsQlc4uSfW6ET
TLSH
T1BF863302FDE7E831F5BA1FB088618BCA973BAD216875816F7F4C01567D752885A39383
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
560	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
3884	alg.exe
2104	DiagnosticsHub.StandardCollector.Service.exe
5008	fxssvc.exe
4284	elevation_service.exe
2116	elevation_service.exe
1648	maintenanceservice.exe
1224	msdtc.exe
2984	OSE.EXE
2876	PerceptionSimulationService.exe
3804	perfhost.exe
3744	locator.exe
4116	SensorDataService.exe
4892	snmptrap.exe
3944	spectrum.exe
4316	ssh-agent.exe
3152	TieringEngineService.exe
4348	AgentService.exe
2672	vds.exe
2352	vssvc.exe
3404	wbengine.exe
2592	WmiApSrv.exe
4916	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\68ec5643905883c7.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000558c17d21415dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3dfc8d11415dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d207b1d11415dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb2a9cd31415dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000181a6ad31415dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c317ad11415dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002eb5ffd11415dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2104	DiagnosticsHub.StandardCollector.Service.exe
2104	DiagnosticsHub.StandardCollector.Service.exe
2104	DiagnosticsHub.StandardCollector.Service.exe
2104	DiagnosticsHub.StandardCollector.Service.exe
2104	DiagnosticsHub.StandardCollector.Service.exe
2104	DiagnosticsHub.StandardCollector.Service.exe
2104	DiagnosticsHub.StandardCollector.Service.exe
4284	elevation_service.exe
4284	elevation_service.exe
4284	elevation_service.exe
4284	elevation_service.exe
4284	elevation_service.exe
4284	elevation_service.exe
4284	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	716	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	5008	fxssvc.exe
Token: SeRestorePrivilege	3152	TieringEngineService.exe
Token: SeManageVolumePrivilege	3152	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4348	AgentService.exe
Token: SeBackupPrivilege	2352	vssvc.exe
Token: SeRestorePrivilege	2352	vssvc.exe
Token: SeAuditPrivilege	2352	vssvc.exe
Token: SeBackupPrivilege	3404	wbengine.exe
Token: SeRestorePrivilege	3404	wbengine.exe
Token: SeSecurityPrivilege	3404	wbengine.exe
Token: 33	4916	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeDebugPrivilege	2104	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4284	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 560	716	2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe	85
PID 4916 wrote to memory of 4260	4916	SearchIndexer.exe	111
PID 4916 wrote to memory of 2180	4916	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:716
- C:\Users\Admin\AppData\Local\Temp\e583b7d\2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
  run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:560

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3884

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3552

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2116

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1224

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2984

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2876

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3804

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3744

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4116

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3944

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1072

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2672

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2592

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9c96284d723b474f2833b5e5b6590bc453e6d52f33c9cdbf81c3544ff72e352c
MD5 b97a385532d43855f5aa51cd052da334
SHA1 77f10bf89271d885f12548488fcbb34b5be1d1bb
SHA512 72ef757e98654a98db33083ae71c30779a413149f689071e161f1eeb705e1a5852a2cdd4b522bd32818ad0037bc605aa9a9a77b08d04edda4056eb2073397a65
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnSQ/lFTjN4:l3q6HjBqLm
TLSH
T1E7D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 bd86bf1095c4a4a03c2351caa5dc3f1d1894e5d171f7f00b50e4386ab24c5d7e
MD5 bb7cbd8e080ee8fa6e1448691b84a2e8
SHA1 3c46bb9aa1a25c526f0e94826ac24d3d2052fa05
SHA512 51e7796bee33be7f8ec32f7eb9ff9d7a00271f233642aff77f059b45f0c35881af0257be0b748e3e3129a7546dffbab13b11db17ddda5fadda57657c44ccce80
SSDEEP 12288:i1XLsswWkxy2lRq2czAJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:oXYfDtczAZnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T16E65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 fc5c05f410f3d111fa35000a04e77b43867ec0fe7184faf6f6edf7c83dccf09a
MD5 99793af97c38ea1ab158643168e4db1d
SHA1 0b1d512370bb9b993503085ddeb91fa354c6ac9b
SHA512 b93fe560a8ffa7dcc68ec21f68d328d1ca1de0e01ecc1e7c8a97187224a4673b22ed2b31421217fef62369b18a8501de2ad31b4f001168590da88433372690be
SSDEEP 24576:X0Le5ji0hmxLrM6nQ/tbw/2Mkjy6Fr7g0oc:XPji0AlTQ/lFTjN4
TLSH
T111859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b0cb7416b91d31a650732ae853e085c03c209908422e65b5753b09d65c137893
MD5 eb37e1af9535a404df74f5e6964cc205
SHA1 ffa406ace4431766b8dce3f4cd9841556701973a
SHA512 3ed2d3b0e188cb32b01ed3366b9aa216b2f0f1df6a8d79e102e5769be023e3ff2bec79d3461bc3553fabb62996758e6544391ea2008837318f36aa74ccd27718
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWE6q8wyuYnQ/tbw/2Mkjy6Fr7g0oI:e/ezSC6vUzPvxHjyXQ/lFTjN4
TLSH
T1AB755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 581a6ed0f28c300f5a36796c2b5d87524bd8d8e5b4a8277c5d0807598edeb673
MD5 608885b2f75e43db3ec95b42d39352eb
SHA1 db6ec4350d4b2f2f7dfeaf187ff6f05cfe3da997
SHA512 704b155d2c3fa8fdf0f29b71033d6ab9b0e4a0af76714b00834902c62918ebff9070166825b894790ff660ad8eee903a59f5f43323486460691bcce19368ae84
SSDEEP 24576:MVbqPb88hv/l+6VnQ/tbw/2Mkjy6Fr7g0oa:MVO88hXl+eQ/lFTjN4
TLSH
T12B559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3d3f0808d9fa3b6ff8c44887a2e87987e75723bc7e12a0fb6e5056358b2ac993
MD5 e615edfccdf1c0752607b5d07551745f
SHA1 0db20ff1d5277813a194f19317a6343286e60efc
SHA512 637ce2551f14f0f285f1d2735a8af1e53c4a3ab7c7f99fb4030e7839dfcff44f24436a4b274ccf2e606fab050889e442018ba1942220d9401cd1863d5f6d913a
SSDEEP 12288:Fz2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:FzWnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1605523696A24F897FF2B06B55CC384826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8543d70375983ab84d418c19670d384be6e3b95a49268817ab6873bca0919a74
MD5 ed56c600b431150799c91357ec5b0392
SHA1 e4f75a2fe13b561bdf58a500e8f79a790eea9f70
SHA512 caa9d2d82f186d121257759dd5d77b231801931193e81d22bd7fb5a11a566e58898b80b87099c0f5cf25887dbb00eef964e774feab984aedc1f2608e8d8fc9f7
SSDEEP 12288:DeBNUbTVO86UdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:DJIU9nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1E775CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d78f331c7cc125825cc959e7beea52356c49525f093f56cc248fe6df73ee4e0c
MD5 87533b7df6dbf5c99c06f3e8b92a5f77
SHA1 c360250edd44e9994afefacd429d456ad59c1141
SHA512 ff57f1ec1e5d79892d5aa1183523118aa5019bf47e6a5dda6fb39403d5ed7aa96183f0d2235d12b960933f083f8a7996f081c8abf26f2ebe21ea67f7fe8166db
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THF:VQvGAdlCEL8c/yRNw5CLLm
TLSH
T1C6267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 dda79f9d0748abdbd540b7f273be26cd2f8e1a79ff19cb48eff08638ac87b6e4
MD5 d91b076a8a84a1a4c000c07bf1d7cdc5
SHA1 114bd21059928cc7c7551eefcd779ca4f2cf1336
SHA512 19b62e4302936f087390a7d9d67a22f91fe0e5cfacea22c445721bf4002a54e55919fdedd2ad747e57a14d671a526114180b8d882901d4325010745587096c55
SSDEEP 12288:cAwSfxL/2Dc39DLLmt0LDQewsAjzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsge:BQewsAjjnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T19475E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 31b9dcfc9a0dc02d1489f6b7e37035e11ee3e863dae47b0b3d0af6e384d38f70
MD5 59d4261ae5bad344acd96dba1720b82b
SHA1 fe2ed110c0f8816833d3f6d63a47666c3b10ea3f
SHA512 94e1281d933ffea1065246f0bd9dd51558291a21c9940018e639af6e6c74fed38fd646add0947d852f1ced6ba6b3ea5e17a45746b9d08021f4ebaee73e16da28
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHwL:3UEtQevvqc2W1cpV2EI32
TLSH
T16A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0895088a42a602f6aa999004511238b05c80262d9a1050e2361060886037f29c
MD5 0f381a97e5b31970c550f87d81423d5f
SHA1 bc65b7e38e415c932e319732040ba04b686f8360
SHA512 8e99b2174e97712c2c0b9984f78bf9a2e67dbff6105794c3f7e7214aa13afd4a8424415eaf9f96c0c9005d2dadd28c17b5d8de10b6d8588da51c04301b87395e
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/zDQ/lFTjN4:0oqtVjnmvLm
TLSH
T1BDD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bab407c28c3a5b3f5cc809df6f16fe07e7c59a7f66e6784dd675e85af68278d0
MD5 7839454011483d625b6a75a8167d31bf
SHA1 279c82dad97c8ffd8d5e7ace787d3405ce326ab7
SHA512 b16d66955bd1b0366a9a5f90f6e4f9026e23bc94557443d11520cc4e6629d850642d124644842174840085624dcb76d949f661a7f3f2ebd97f768033a3960e14
SSDEEP 24576:FAhGLJIFoiwtA5l7S53snQ/tbw/2Mkjy6Fr7g0o2:FAMyFoiq5cQ/lFTjN4
TLSH
T1B435AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 aa5931490f154c34e21aa77441119d795f186823dc1e72a3059dcaaaf0ede69a
MD5 81929269b46268ea210404d5dd51e033
SHA1 a759f82e2f88f8a22a919547114bf70377a48ba9
SHA512 00a370b189ba8f58b0537fb4049800be7ac57dd545b34f5d13a94ab8144f4aad6dbd770ed8391217af9a1f15e40f8f8e708439f1f878725d86fc8acaa6fa68ae
SSDEEP 12288:cmw5HEjsChN2BFgl0WDm+C4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM/:ZwuHOW3nQ/tbw/2Mkjy6Fr7g0om
TLSH
T16F65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e7c77adeb769f53907076cd7d9b3a1def5c604b03100842ba6f100aeb16018b0
MD5 e6832067c67ffc87ade4a4d82345aa99
SHA1 01503c23b7be81ca81fb57515edc17182ea01d27
SHA512 dc3ff098da2090177b9e459b96b349bd66ba85e7d8db269bac042b280253cfab37425487c9bc191de2e7497aa343f3a23c452fa0dc083c453abd8f2b982dac46
SSDEEP 12288:+XZ1IyDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:OZuinQ/tbw/2Mkjy6Fr7g0of
TLSH
T1B755126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b5909608da5994223653a280ce91c2a4a3651845ad048ce26ec725a4a96351e6
MD5 b9f3da4a7799e43df9be5d24e9285085
SHA1 53ecd706ec1b58874931671ba6ef04ef2a0ed03c
SHA512 0a7f6dfe48e8ef122d04f1a2fc98de88576644d7e14c11c04c0eeafeab917f07a542fcb3736a4dc540b10e4a6f201f6a2d8ae2ea37174da8c0aee8df894e05b5
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:tQRQyi36YOcPQLvw2gAf+PN3GLm
TLSH
T12D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7c5550197fd3d16d9884be9e6d99434ca94c2192f949ebc420ea65656c79b414
MD5 bf2c65906ed88e0264424061f67c7af9
SHA1 4683899ca15baa1f152530538ae2ffa60f0c23b0
SHA512 3491812896c6344aaf4048af6b87b5add2958b055120edab66947061ded8393cdbbeb64916fbfa33432ad653b5329446e87ed1900f363244d5cf5e72ef8bd711
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:FQRQyi36YOcPQLvw2gAf+PN3GLm
TLSH
T17F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 79607a5a55ac5da90ac66849c07e2c8a9c0d1fbdfafb03004030a01c91a6be2d
MD5 0c30430c1d99d331963180d14a0b889f
SHA1 e7d30d784be70fece142d46b190c1673714cfce9
SHA512 de06fda277a41f4d53d066ee6503376e4a1a0e4693178b46c1b8d5584cc02fb450a849c6d8d451e9a1a5637bcef0d7e645d99ef7aa7d064abfe89f5f3e239731
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0SnQ/tbw/2Mkjy6S:U68Qg55nhheWu7PNU3/TQ/lFTjN4
TLSH
T190B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 831d04fe495d76422daac61d0dd65565f19ab9acd25051d65546dfe7d6991d87
MD5 880463b435c0755d1f566d4981b7b350
SHA1 02638d15cf6a5554e4940f0f7a98f0022ee3a0cf
SHA512 e050cd7aedd345882bf4c926b1dfd93b24c9b1edce409a1ec2796347e62f3a20dcbfa961563d664d412621f9ecad5479e26f78b81e0edb63bae59e4d3d85197d
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk997:Gy5112gYy5azzVvL69nLKnhZhLm
TLSH
T173167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 71192c1fdb0053a01669548071a14f5a663af129fc14e23c6663a21eb4b76278
MD5 b0dce5f9520b18c9a9916358835e0bc5
SHA1 2cdf0e3e1f43e457cfded42c98c6d267b12ffb38
SHA512 d72439c99d290079f5006edb26461443c6dce817a237563f05f6427fa8d16d8d4e8d4ad482ce1a48a4278fe2b001b9b288969b2f3a749c3417f3d5ccad1295d6
SSDEEP 49152:cB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glJQ/lFTjN4:2u6JmVxd2d+Lm
TLSH
T1DED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1bfed2cfca900f9760b0b3877b049eaabba959a33a498e92663493d3db62d3d2
MD5 d4d7fb5f39cbf71eb30030cd89134dbc
SHA1 ba924daf69912399cb3cbd274da8fcd4ba357672
SHA512 2545d5a511a409742a62d803a9675c4355279a9e034a1ac1f327597c5a4323296f7b1a925c5e90081e1fbc6a09db121c31ecaccbfb056310ddcf64e486dc86b6
SSDEEP 49152:21hpsNoJpF1A6UU44CwH7R4xdQ/lFTjN4:2mifPbRvLm
TLSH
T14BB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7256c96a2708fde88e661ca590242fb7d81544b2001c94e1c08ae641011a84da
MD5 09caee46535502d61939db4f5a4e8782
SHA1 de6b685956bf1cc712170e4c18daa2a0b5195726
SHA512 e28ac3c5e274e71275c5cd36efe36db784332127d4fd63109d95ad5f3bd488e2839156a656db72934665da2f919989d556e8467fff20c5a83d832d63c3f5f71a
SSDEEP 49152:iSuZQIY0Be2KRRVtOnks6NMHqiQ/lFTjN4:85dKTi61tLm
TLSH
T1A0C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 836bfa5828d10ef5f8169d3c6e2e403aaf5ad61508d78143ee7c05addd444610
MD5 8fb4a989f2215837a5bb00a1c02f2a16
SHA1 b4df2c63867a1ebfcad1e87775245b6e599bc300
SHA512 d7e1577e4b56667bd6f5d18c535811b9a183d65b7cc62c3eb806ebdb95d73d3c2fce18f00a8edf2ab1dd46cd506c058756826c546465e223dbd364d4be145621
SSDEEP 49152:whtSn8EApI0figngiDn0AP5wZQ/lFTjN4:hX2iyphTLm
TLSH
T1A495BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2855820369fad2ae58a6f34cbb9536cf5f02055db7c961307a12f9e74713265a
MD5 dad388ae3b2df76dc7b279cf3a9898ac
SHA1 d54d878fbd5025878c0f21ca56b954fb17a630d5
SHA512 15d9c50ef4fc4c58e11bd5fd101326ee53e4b47bea3a2b59b07b714c3166d7a92699a111dbbcf94ed70c9d5ba8e32bdd8e6702aa5b74b476dde32cde73f85dbc
SSDEEP 12288:qeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:qenQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1655523697964F98BFB1706F18C828182973F0EC6BFD1A38F77482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2559d739930fd95b1a777ea6b8624d3690133be028a9b646235169b849a685dd
MD5 8ac1c2709cff4108a20e82f8bb2f96d1
SHA1 6fb9bb95521bcc5bb02bd08397762a2d58f5c70e
SHA512 cd1d54d7707ddd5e79e5c663ccce34db35b3f01609a8cc034946ceec76a7516202645073afd56ab28fe8df6a4c780a4a3a56e9cfead3405127f99b4a53acc3cc
SSDEEP 12288:DPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:DvnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1585523697964F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 10f210f759fc9343c8f3d382d17391d89983e1079c595cf31b9b2ae936d33aed
MD5 618c848d33bcbcf67932feaf45f8cbb6
SHA1 5ce7d1e8996f2a0adcff6bd4fd872a5a109a71de
SHA512 af435f9d4e85312a99fd4c029f6f7d124a0434a7562365e0c530b30bc63382b10e9a0969d251c92829539170097b725a146f68d0bf7a4124b15822b8c210cbc7
SSDEEP 12288:ylGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:yFnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1BC5523697965F98BFB1706F1488381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c666cdff93a5fb05502afe8922b40dd3c86e16d843294ce3ed74e4af09164e54
MD5 dc9160d92bf3758e7464402cf01aac61
SHA1 eac2524907d7cc7ff6e7e202f566553a906c5da7
SHA512 d841200a58344bf6dabbf92447b35bdb35fa99f6bceedc8be85648915aa87664f4b959252902c89433feda78c1f088079496932a66c5b2ef057825e5e29edaac
SSDEEP 12288:zVMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:KnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1C05523693A69F4C7F92742B4CC938142E77B3DC6BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 286ce400187db93362da827693e8afec7455f22efb72a369f375ca76aadd29b8
MD5 83c8a01b17a14ea1a73835d45e39cfcd
SHA1 c407500e10c1b5b0b59561857649edba128df12c
SHA512 7b033eda26b19d8559a6f764d93cfd65cc3e3954ebc61aa108e8a231c94d54a40a1f3f2b375408bd61f9164c2eff0f09b308c0b94b4e77c0fe5038276c88b320
SSDEEP 12288:rkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:rEnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T17A5523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7d1096a5aa2c51c778f5f3f1e5642c281c3763b7176cc96d44b53594dfbc8fc4
MD5 3c919d255452b6951ec941d7b97987f5
SHA1 cad83a36ac8e05954b5f957e36909581499d3285
SHA512 2e07a8a9c157d00c074395985e408e7633d20901a490636414ce4e2944e26e837aef5f4026839979cf85e1af263a9602494a86363ecefd787bf7ee3a996cfe81
SSDEEP 12288:9bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:9LnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1045523697964F99BFB2706F14C828182973B0EC7BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 806a144b9054d6a2b61ba1c2181bc75e03f316278c3848bb04c2eff9222ee9f2
MD5 60fc6090cc3cb2fbb2026d3ba544e584
SHA1 fa5b8fa643143854ed05e0a0beb3ac8a71f18d49
SHA512 3c7c63e994a1b97d819082bf3abed29649dfdecd134360bd7faa32a5f6c505f0deb0c716fc79550c096fabc444b8a19d8c3b8e7914bc679b5cf197f06320c50e
SSDEEP 12288:gHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:gnnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T16D5523697964F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 30e53108d6a74342591431c35f46f87769d524b8d5665b410520207560069820
MD5 1a1b7fd009866c57121dbd3ae3689ba3
SHA1 b4ca14ba24469d77cf2b36dfb5d26641a1d59e69
SHA512 13936ab8e16373a12e405d7d27a2eb6abaaef630083177ac4ed5ac30ecac8eca6dd601428c041e99cbd99147b23f23c160297f4cb7d51341c07c50d49356ecff
SSDEEP 12288:NiZwbDzzFEoS2cPvyvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:QZM3zFVSOPnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T19A7501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A4362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3fbda46dfc792270eaee9647cfd33292581804a8c088c5840cc56bc8922c0cc7
MD5 d0e543ba431c16ad5f42cd6321c5c56b
SHA1 e61b5b42975db50d8a78f904b756e11fb0e680a6
SHA512 42898fd5e7c6e46cbe716731aacd7907f388d663b04d87b0d0b1be4d78a6b27b23cac62dcf42de4de43cace3707b6a293b7c35d05c04d4cbddb361b39a0a99b0
SSDEEP 12288:fyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:fynQ/tbw/2Mkjy6Fr7g0or
TLSH
T18E5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 bfd91984a0b962520b5593b7e80c36af1220565a15e17e672e62fc214c371f9f
MD5 80e97c91468e925138e0cdc041487853
SHA1 7748575be0369d176ad4e27252c1b3aa86e19550
SHA512 45a464be956380b52f89c6a2f18511c02b34fe1e7a27bd67407d294f43b51b78e023d3fb10e15bb87c7738aa5ab8571584759f55d476db4ca92f8129df918027
SSDEEP 12288:UGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:UmnQ/tbw/2Mkjy6Fr7g0or
TLSH
T16F5523697964F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 417dfd79294cf5f12d5dfb6b2224d91b663f004e7f2e755bde0720192f9ca73f
MD5 0295f39773aab6f80b9fc21be5e2a6f3
SHA1 35b3ea80898738280ab5db74e64c029eaf71e496
SHA512 a3b3c13a7dd7b778ceff6d6e82c746af2dbde842fd243a945cb797b3163e12eb7c0e07f7d4bf06322b8b6d5b96f5b27ce3f1c6580d2321c7f62a0e6ca8d70dc5
SSDEEP 12288:RyPz5L8DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:AzyznQ/tbw/2Mkjy6Fr7g0og
TLSH
T14E65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f03dc9a525f67e3d6270ceec1b7e20e1d27610dfd6c2b640fafd4de8a4204589
MD5 995727ae468d5642db531288d3dbb088
SHA1 5fb882c6a743720f3302ee987d6ceb0b9cb9f831
SHA512 ab034bbf3216aeba5468bc4416684b597016ee2d38a0341983277a2a588b582a8ba9ca1c4ab075202ae833c087567afaf91f635614e6081d4ebad191b28dbdbd
SSDEEP 12288:WyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:WynQ/tbw/2Mkjy6Fr7g0oB
TLSH
T14D5523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0a1b597c973e8982589dd760afa6a42f84741c17bc09b48e0825166482d9167f
MD5 c390390f312c3dc65c69a6dacb36a2e8
SHA1 ce2e9e05d0a6e895fccec3c9034c31c3131e1442
SHA512 3983dfa1ac0afa32cbf6b63db0182b313dbc0dc7fda9ac93e902da07e43bd97201ec42b1ac58f1d3bb86adcc19778d0b6a3737046fb60dbad94fd10426b04c02
SSDEEP 24576:NcP4mcvIjkGOxhKP2l71nNKbrh/8KBqnQ/tbw/2Mkjy6Fr7g0ob:yP4m4IpOO67W8KoQ/lFTjN4
TLSH
T1D365AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 87ac51310ddae047bf80522f2167132aaf848616c711ecd417f19d03493c5cff
MD5 940eee0fa1a9f796d998aa074c91b7e3
SHA1 1143c75f3b1bb9b7d241cad1b2b0d9f3e457be70
SHA512 ff3e2b2312240435312aa2d24562c01385337fbe21b6d5831cdf31d76ba92027e7c5186faf6754d7f8a910a4ff258a256c514a79dfea3b322b74c61e53d3e5a9
SSDEEP 12288:SssfiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:EinQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T19365F119E29852E9D02E5279CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\e583b7d\2026-07-16_bda5e1f08f81a263779a9ee321f07f3d_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Size 7.7MB
SHA256 74ea3a3ab0b1ea54ce1f6726eebaecec7220565bafabfe42084ebb2e0dc0cddc
MD5 bda5e1f08f81a263779a9ee321f07f3d
SHA1 ff0157f79fbbfd5802b106a54716633fb986fdae
SHA512 db5de307a480c659a89207fbcba2cbcd5e2267bded65bb32046be097be680564be4bc43bc1110ba7aca8c8845f676979b37d7656f90b1a871a410ca5c1194084
SSDEEP 196608:9YnJNM0kRMIQ4B0N6EvjG0CUw53kxs2XRHlc4u2lcIW6YplTpL:9YjWMIizvqkwBEsQlc4uSfW6ET
TLSH
T1BF863302FDE7E831F5BA1FB088618BCA973BAD216875816F7F4C01567D752885A39383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6a0c21fd6f5127d22e87e90da4b9ae75da9925bb4fc16f19e7b60eb0ae0fdd06
MD5 5d33d6ef60ea6a24e092741d33360e64
SHA1 0b93ce2aa14a9ea4a7bfb387c565b77b06e98a9a
SHA512 94c4ef2ea6d48aeeb56bbc3d9a43da074ea951fb456f4ba85ca567a21ae9b2a7e9e4005431cc25fcd4bfdc24287dabe79d4d2f57d849a8bd04a01d3f4ccb9f14
SSDEEP 12288:3CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:3CnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1B15523296768F94BFA3B06B05882C151673F0EC5BF90D38FBB08222D957C3D41EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1f0845f98302127772d1fa5130daf57a245dab6f9d22e3773765c9dc14ff21f0
MD5 6c0eb43204e26ac8fc3c8fdf64f4f4f9
SHA1 4645168c29084d818105e920c52a6d152525b737
SHA512 1150c1dc7bf81f97f44ccf84c8fbc68bd3fc9f02b8d51cd14bc71ca7f68375de2ac4c63d8fc64d92f96bf385105074a87ed077297e62404f13dfbbb878dc1b07
SSDEEP 49152:ia0h2GEkuAe73q3pp46zwwQEQ/lFTjN4:ia0hNYG4JwwLm
TLSH
T1D1859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d8ec7165ef92cc652e98e9bc00f35222209466446eb8babc10fc3220f83cbab3
MD5 69d3d3144886b882aaa7c3c973cfc094
SHA1 bea20381ee82623e2f968eaa4010c1ec8ef37dc7
SHA512 54e6f94aa81ad06d774906efdb48cbb2f28293824a448a5bf2a975a27df203f8c22767635f46e333758ad7d74b4ab164b8f95fa7f22264e8304e5e9aa2f01613
SSDEEP 12288:ShbHjfX/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:ShbHjPfnQ/tbw/2Mkjy6Fr7g0os
TLSH
T13455027D26AC30DAF63692BD88928546D7327C552B11A3DF2381823D4F3BBE41D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b0bb9d1bdbc46e4b8dcadd7b8b8df61fecbc8bc1c4cba6d426d0cd002b3d030a
MD5 10fdf2b7b147b08cc94e5146f9b1b6c2
SHA1 d289379a653f54fbe73bd713247d01e3f14acb83
SHA512 cfea9ce1dd8a53a859471f627518374bd0c0ec02f1fceb65fd763609b397c51292de7c27a7ac009fa9eb0ecb89c3836061c328e498014642d99078a60c1e655f
SSDEEP 24576:U3YgnJcRTk4yti+R5dBR/3nQ/tbw/2Mkjy6Fr7g0oA:UIgnaTk46pBR/3Q/lFTjN4
TLSH
T1DB45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 74194974f0d2fdb0b03d964485ff5b9b2f8de06781895fd5136068c6abaf6929
MD5 3a75884c4c1c18b58075af1b2735202d
SHA1 dbff80be4cf7519d15f263d61a8b3c2d3705c680
SHA512 da2620681167a960b9fa8d6821355e49e5c34cfac2176ee92697fd511ec55c5ecbf25a41ec0cc8a6b3ace3b4b576af0f1eac25f0e907aed321df5b6f07d8ff2a
SSDEEP 12288:JWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:J2nQ/tbw/2Mkjy6Fr7g0od
TLSH
T1645523687654F98BFA2706F54C838146673B0EC17FA1A3CF7B482129967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 a10f6ead03dbd6b8d777f90bbdd0e7c11ee5741a001a3597a318bd5f0d6ba728
MD5 251dfb284abc0bb1d836d57d23e0216f
SHA1 749c0263649ca0e89bedeb180c8b32aaf01fc7ad
SHA512 2530064123212590ae5db1706191f2e7e5602e221ef258507ee0a8d6b2981034c3d5368fc30b6fc856a29aa84fb691c2124692df6deae1e104c31d5890bd6fe0
SSDEEP 12288:mOb4A4LWOsvAYFTJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:PwL3UTZnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1B575F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 5b1560c190218bb8eaee0071a0baee17425c482a4b26a5eca496ca2491695f1d
MD5 f0b8a83dd0724b5f010c536d5fe64482
SHA1 cf6f6add239974823b07386b6fa076ebed0bc816
SHA512 29861e73aa119acc2c28c6ed8614e1325e6a45b1c212724112c9548f266a6c3a39fed0c5430df5a831330d1fde9c3f8dd453a4abc808c0e4f20e5685399e4ec7
SSDEEP 12288:RpFtCO9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:KOdnQ/tbw/2Mkjy6Fr7g0of
TLSH
T17A55022D36EC60E6E536527C89838249D37278961B6253DF0780817E5F7BBF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8f84cb2997c2631b7920df148b22d003bc79cde2031108fc14181e6d98e55287
MD5 3d77b2f76bd026ddd48b20ad99ed64d9
SHA1 a6ed75b31117dfeaeaa5c2605e403e2fbca2521f
SHA512 1a7983be096122f2c311b3da499afff119e1c5697581c7e6ed56db6aa4153f548d3e84a4a6a4e5fbe9c8f4bbf69a030860a15b1bbcd6636490b03857184ff216
SSDEEP 24576:97NM9YqZqmWMUkPjZM48Mv6bEhsynQ/tbw/2Mkjy6Fr7g0o1:97cBWMpPjN8DbEh/Q/lFTjN4
TLSH
T133659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f9a8267c1265a6d285ce6cb4fc6a480a9bfd90d582e5dc6bf76f606c72689b59
MD5 8a58ede9fe4ae32e4a4ff3ef76f76a14
SHA1 db33ce29d2d3d59461675d9c0a0dab70f54dcb28
SHA512 9dead3106df19472fb8824ea4991297acea3e34a1541b7651112610b625b9ddb8aaa5486189460c6321c989a550cb20df79fe272de556e4ff2f7967be2c76e7e
SSDEEP 24576:eW6BApg2YuyuNDYTabvcdvNYf8km1wnQ/tbw/2Mkjy6Fr7g0of:eF2YuHNETovAvNYf8kmSQ/lFTjN4
TLSH
T190857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9f6746ef59ae26773c62313ac03b990180b0b3b2badbc9aec1dd04205b0225ef
MD5 1ef2dbac4e072864595ce876b846154c
SHA1 8eee5520379b44766974a2e02adf5941760a8b05
SHA512 b95becc1a95873160d643c126cdd51592aa59f9bae2bd14af0c529b66ea66671138d41b55adaf021ab5f1f854d1122c55e3361a015d3d03defc0d2f45c81b148
SSDEEP 24576:BAFs06+Omlf3NXEbToBnQ/tbw/2Mkjy6Fr7g0ol:WFs060lVXukQ/lFTjN4
TLSH
T1BC65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 4efa7c9761bee324fd9a1494318ce9d5cda90cb11cddef82af405f5718ba212f
MD5 8487a06364f5014950f49e5da365a618
SHA1 f2543b789249061db873a72d5ea7669cfa9baa54
SHA512 0248fa2853b809b224bc11ffba0265fb69d93dfa4cb80a9a925c5b4270a85e0db92132119378123cea9ad48df3e5ea15231f2e7067baa3f3749792d01fe5ff14
SSDEEP 12288:QCJnJ5D3VkrqzxSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:lJnJ5D3WaknQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1E875D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c61c62f20f06ad3a773b494268c6f099b986b18c685cb817093c740efb8fb17c
MD5 2348c86028c5b0ec779b875724c2b1d5
SHA1 518de016dd5f6a2a7af6b0c47d1ba491b0d80503
SHA512 fa75e82d55c738b21fbf04480c626f03a154da33332dcd898fff513b88bed478d5027c0e1bee5c71669fbc46c44bc4190f290b35cc501ed5eb991db2dc43c03f
SSDEEP 24576:DjEPghm6/7IIXdwcXrif7qQncjlP65i3Vu3nQ/tbw/2Mkjy6Fr7g0oN:og06DIKdwc+eQnSt65aVeQ/lFTjN4
TLSH
T1E9955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 c3f1a1f6c75c2425436f7e280a65109a492e1237f26d800eb229ba94cf9470ba
MD5 8a5d0cb022868d1118b2fc45f040b638
SHA1 ef519c5bda575944cc7282f0b88f2d6ff6438245
SHA512 4b1ae8a781cc2adb04188388c120edf5f2a69dd24d27ea971d2e1cb31882347584e3292b450561f31f67e7bdf09a1af66b6d9f3f165f78c9271d0ed5ee8f83b6
SSDEEP 12288:jEP3RS4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:oS4nQ/tbw/2Mkjy6Fr7g0od
TLSH
T14155126D37ACB0EAE52A517D84918145D373F4A12B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 6fbdb54914b2720ffbafeefb5e0e0221e559441a4bb041b006e816b9dce46869
MD5 577f8a3bf9b30ffe39512726a23a3088
SHA1 de1d3806173ff73086f40aed0bd468e566771263
SHA512 787e6a815302183b298efd7469beb0bb009c6cdfac191039556d2ffbc4711e8eb4fa5868436cb0e91550da69eb638f1e115b86c8378a843731dd58d582d7c83f
SSDEEP 12288:MjkyPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:MIyvnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T16B6512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 c17d4be05d03fdc06ec3fc6c10a76dc2e64efe036809661da6529c7552b3a8a2
MD5 111b96566309b5e424893d2b9fd8ccd3
SHA1 526c1d6747abb56dfa257b823c39ff1128b851c7
SHA512 64e62fac9e1c4190c29320a0dcf031a4035d8eb1f380afd7eb3c0762a8a9b27c4c77b28233b5f74a0f0338a4dbb3d9f38e74d8f652e22fc6a13b36cad551a486
SSDEEP 12288:/0NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:ctnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T18755236C3665F89BFE2706F448928542973B09C17F9163EF3684A239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 103a101422cf76b4f6a049fe05ed5de7fbd45f50897b5d0c5bce2c1a13c4aad4
MD5 c95096d8341be9ce8a331869e5802a2d
SHA1 be31b3e9167172a8b3e055953d963b42ac068f48
SHA512 1a0af23114ff20d796e8b1aa89acbcd95a001f66cd7abf3d6701242ee60cf718292ea355f51c8031310fc70d561ef1ff0c8841ba740126fba6b8f7fd77107c1e
SSDEEP 24576:OQ9MxZKdcz9dw3anQ/tbw/2Mkjy6Fr7g0os:OVKZaQ/lFTjN4
TLSH
T1ED558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 c0d5bb315603f16b390e1a4bd84c932dd4a016825b1d585a76f08b0094519a1d
MD5 87e6299e22aa1a9aebe34afca44e7778
SHA1 780c24f8f736ca71921f81315ae171d6929e5853
SHA512 f2af3f98a6ef3c23d01f511a4b163543b66ef15f0de7feb454a0327d1afee6633de5a7d9732f34924dd822b945ad017a25e64da562c180e0a032308018dc0669
SSDEEP 12288:3yoKo20Rple9pzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:3yocSApjnQ/tbw/2Mkjy6Fr7g0om
TLSH
T12565E01FBB6990A2E136813C89818745E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3c01c668642a4bba64db59fa384ecacaf50299e63017ea07c50b38fc6b5fd15a
MD5 a2361d69cda71132417cbf5f99617f73
SHA1 5bf9c17f95ad9a280b4cc050852c586b8cf8710b
SHA512 353dc962fcb028215612a7bfdec3885dc69d2fb07c8dae388c28b22c1a31b1d7f563eef278b7aef3cc072d55ab33b05e6724b8c8ccf5f6c1e2cc4b9ba440c444
SSDEEP 49152:ZWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKjQ/lFTjN4:B0zuNIOLm
TLSH
T111A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3b0060c30c00816d9f2019b53fb1bb25b88dda932f4d0a8e4fa049513b83b971
MD5 c4f3aa4ca04595e99d7a023be9592afd
SHA1 5fc96c31705df3b08a1001e3d38219bfd823be7a
SHA512 471066ddaa8a9fa9d3bce4aec45a9f772df8ba2bc87d355cbf67e7502b97e0cddaf528eb578bf9440e424b15e77c09ba3ec52e48ccc3ca200bf27d0214641303
SSDEEP 24576:31QT7EcpfxR+N5AWAz3ooiYtjMqb4nQ/tbw/2Mkjy6Fr7g0og:KTDxR+N5YzTfjM9Q/lFTjN4
TLSH
T1CF55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 3879b7549124f298c9a7d7a63b99287db881a79c48d04d7c78020f1dd0e6b69b
MD5 bb23664223484867c035d57af336bbe6
SHA1 67d8c19c51afc285688b873b48af2cd4079410d1
SHA512 7917a1e6cc7b1cd5781b6dfa4434f6b47b829e7ca0992b654ba3efae91d641ed9b4d924199fe4fd89d77d035718bbad1828b79784e03b52842fcad9e8f2c2c61
SSDEEP 24576:BTMdOz0FFS+1mSLMnQ/tbw/2Mkjy6Fr7g0oV:r0K+1mSLMQ/lFTjN4
TLSH
T14A75E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 4c1212cfed2613dce062069e00d02308dd4247ed72574e182ad34bea363a2f59
MD5 75c2ae1068f272807a1dce9e90924835
SHA1 c5b0979c617c029e5fa23453518496a59d3ef9ec
SHA512 621592cff41e2cf16680a36c7a02d7d0367a288bac47ca18aa140734c1f1a92e31da1f0194190122128a6b5912254006a4b087ae3079e2ca97bef1bc25b95ea2
SSDEEP 12288:B4TJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:0ZnQ/tbw/2Mkjy6Fr7g0om
TLSH
T14555122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-14-0x00000000025F0000-0x0000000002656000-memory.dmp

Download

memory/560-378-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/560-19-0x00000000025F0000-0x0000000002656000-memory.dmp

Download

memory/560-22-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/560-94-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/716-389-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/716-0-0x0000000002620000-0x0000000002686000-memory.dmp

Download

memory/716-5-0x0000000002620000-0x0000000002686000-memory.dmp

Download

memory/716-9-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/716-92-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/1224-160-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1224-80-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1648-75-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1648-70-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1648-77-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1648-72-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1648-64-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2104-36-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2104-33-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2104-27-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2116-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2116-153-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2116-61-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2116-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2180-445-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-427-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-457-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-460-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-443-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-444-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-447-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-448-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-449-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-426-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-430-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-450-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-429-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-451-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-452-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-453-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-455-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-456-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-454-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-425-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-446-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-438-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-442-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-440-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-441-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-458-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-459-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-461-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-428-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-431-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-439-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-432-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-433-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-434-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-436-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-435-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2180-437-0x0000018B6CCD0000-0x0000018B6CCE0000-memory.dmp

Download

memory/2352-169-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2352-380-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2592-423-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/2592-178-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/2672-165-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2672-375-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2876-97-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/2876-108-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2876-168-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2876-105-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/2984-84-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2984-90-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2984-95-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3152-157-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3152-374-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3404-173-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3404-405-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3744-177-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3744-122-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3804-119-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3804-112-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/3804-172-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3804-117-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/3884-107-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3884-25-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3944-132-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3944-138-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3944-141-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3944-344-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4116-125-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4116-181-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4116-328-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4284-42-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4284-48-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4284-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4284-140-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4316-368-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4316-145-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4316-151-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4316-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4348-163-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4348-161-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4892-324-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4892-129-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4916-424-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4916-372-0x000000000CD90000-0x000000000CD98000-memory.dmp

Download

memory/4916-191-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4916-223-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4916-207-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4916-182-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5008-78-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5008-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download