Overview

overview

10

Static

static

3

2026-07-20...yn.exe

windows10-2004-x64

10

2026-07-20...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 16:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_e4d1d1464060667452a95e2449167403_amadey_elex_http-browser_manuscrypt_rhadamanthys_smoke-loader_stop_swisyn.exe
  • Size 13.2MB
  • Sample260720-vbc3sagv9j
  • SHA256 8ac9ed203e46decca31fa85f35694db3d968dde89e08a5b98000a71c519bbb61
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 32 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_e4d1d1464060667452a95e2449167403_amadey_elex_http-browser_manuscrypt_rhadamanthys_smoke-loader_stop_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_e4d1d1464060667452a95e2449167403_amadey_elex_http-browser_manuscrypt_rhadamanthys_smoke-loader_stop_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4300
    • \??\c:\users\admin\appdata\local\temp\2026-07-20_e4d1d1464060667452a95e2449167403_amadey_elex_http-browser_manuscrypt_rhadamanthys_smoke-loader_stop_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-07-20_e4d1d1464060667452a95e2449167403_amadey_elex_http-browser_manuscrypt_rhadamanthys_smoke-loader_stop_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5496
      • C:\Users\Admin\AppData\Local\Temp\SPR280_290_x64_654As\ENGLISH\WINVISTA_XP64\SETUP\SETUP64.EXE
        "C:\Users\Admin\AppData\Local\Temp\SPR280_290_x64_654As\ENGLISH\WINVISTA_XP64\SETUP\SETUP64.EXE"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1796
        • C:\Users\Admin\AppData\Local\Temp\SPR280_290_x64_654As\ENGLISH\WINVISTA_XP64\SETUP\DEVICEOP.EXE
          /W32:0x90242 /LANG:0x409 /MSG:2000 /MFG:"EPSON" /DES:"EPSON Stylus Photo R280 Series" /MDL:"Stylus Photo R280" /DRV:"EPSON Stylus Photo R280 Series" /PNP /INF:"C:\Windows\INF\oem1.inf" /SDP /P:"USB" /P:"LPT"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4480
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2648
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5796
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4324
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5840
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:264
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{bb077315-6a36-4449-9942-6c80bfe1b6cd}\E_GF1CKA.INF" "9" "46a45e2c3" "00000000000000DC" "WinSta0\Default" "00000000000000E0" "208" "C:\Users\Admin\AppData\Local\Temp\SPR280_290_x64_654As\ENGLISH\WINVISTA_XP64"
    1⤵
    • Manipulates Digital Signatures
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:6020
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{176A3CA0-9FEB-4942-818B-684765EDC5A3} Global\{F230D070-C6B8-46ED-9975-40D82887C91A} C:\Windows\System32\DriverStore\Temp\{b55460ba-2871-a847-b265-c49a93798559}\E_GF1CKA.INF C:\Windows\System32\DriverStore\Temp\{b55460ba-2871-a847-b265-c49a93798559}\E_GF1CKA.CAT
      2⤵
        PID:4456

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          FileCopy.avi
          • Path C:\ProgramData\Microsoft\Windows\Templates\FileCopy.avi
          • Size 684B
          • SHA256 97337c8513719a2bde6249321bd439b133f15e329e3e575c6adc7001de49c0a2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Install.avi
          • Path C:\ProgramData\Microsoft\Windows\Templates\Install.avi
          • Size 8KB
          • SHA256 8eddab93591333f7e58e5d4e5597c12fbe220095b4ecfc6e4a5a591a464e7ac8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          epstplog.txt
          • Path C:\ProgramData\epstplog.txt
          • Size 1KB
          • SHA256 dc0b50d3a67655860746dbf83048552d08967d667cfecf15e52a2796fed7c5c1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          epstplog.txt
          • Path C:\ProgramData\epstplog.txt
          • Size 6KB
          • SHA256 eb40c4cdb2048ad6976edacfb6efbd9941b2a0253971eeaaa4b26c6e3739b8db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-07-20_e4d1d1464060667452a95e2449167403_amadey_elex_http-browser_manuscrypt_rhadamanthys_smoke-loader_stop_swisyn.exe 
          • Path C:\Users\Admin\AppData\Local\Temp\2026-07-20_e4d1d1464060667452a95e2449167403_amadey_elex_http-browser_manuscrypt_rhadamanthys_smoke-loader_stop_swisyn.exe 
          • Size 13.0MB
          • SHA256 9ed892e95191280f46c9c60162a4a375575898680b89622ad622f6d29a640689
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DIFxAPI.dll
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280_290_x64_654As\ENGLISH\WINVISTA_XP64\SETUP\DIFxAPI.dll
          • Size 507KB
          • SHA256 bf0798d3a4540b15f45c5b329798a2ac532ff693764948b9b4757265e145216e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EPSETUP1.EIF
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280_290_x64_654As\ENGLISH\WINVISTA_XP64\SETUP\EPSETUP1.EIF
          • Size 2KB
          • SHA256 0cd7155e0198355efa8a0fc2c1cbff611599e01beae1ecac8a2f37ca32d02b3c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SETUP64.EXE
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280_290_x64_654As\ENGLISH\WINVISTA_XP64\SETUP\SETUP64.EXE
          • Size 1.3MB
          • SHA256 5e98b895e50155916351f73f20e72b410a874685cefc1d235c38b30147b42b38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SETUP64.dat
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280_290_x64_654As\ENGLISH\WINVISTA_XP64\SETUP\SETUP64.dat
          • Size 10KB
          • SHA256 e5b7d8781b8ba3c3ab6443a2c8f3c9bf49742def260e3f2914f48a60e6711bc2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          epsetup.eif
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280_290_x64_654As\ENGLISH\WINVISTA_XP64\SETUP\epsetup.eif
          • Size 2KB
          • SHA256 27a898d1f0f81a37879b49de594250b1f9bc14bbfd991810be0baf7edbd121ec
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          EBPBIDI6.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\EBPBIDI6.DL_
          • Size 27KB
          • SHA256 1129ce7b4f260505e0a36668730576abf0fa82c1ec8b2b67dd71f4827b0d51d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EBPMONB.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\EBPMONB.DL_
          • Size 47KB
          • SHA256 3d51f667dfac9e91c4817d00fa6ac335754a511e6d7a2ff661640dd3c5c39225
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ECBTEGB.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\ECBTEGB.DL_
          • Size 39KB
          • SHA256 73a50f5e69051d086dfa4cd90247e64cb9a1c37b31736ebab708d226d7999699
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EPIPGI30.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\EPIPGI30.DL_
          • Size 11KB
          • SHA256 6e70853bc76cf201f83ef67c27f0eb4c25053ddbabe1583adae74bc86287a53f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EPUTY48B.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\EPUTY48B.DL_
          • Size 123KB
          • SHA256 74685550256fc54377c76dc55cc9544f8d2983aee851964d64eab9673fa2f22a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_DD1CKA.CF_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_DD1CKA.CF_
          • Size 1KB
          • SHA256 495d2ee3c0b96dc716ee7377af69c23f2bf8ca9e0ddc45bcc580b30bf2fd10ae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          E_DM1CCX.LM_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_DM1CCX.LM_
          • Size 410B
          • SHA256 5d698edbc5ee869202f5cb2402ea312eac19319417d2cab948d32773b9586b81
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          E_DOKA02.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_DOKA02.DL_
          • Size 395KB
          • SHA256 cdce4a75994165d019ae9ac896f79b898bfd14efab87d535cef13ffe528e70f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_DP70CE.PR_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_DP70CE.PR_
          • Size 167B
          • SHA256 335db2c4236fcb214cb465f82b81084e49654552b49a9db7740d1d5a7e39b9bd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          E_GAUDF1.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GAUDF1.DL_
          • Size 52KB
          • SHA256 71c8c74e427ee645121223255ff7a2d5f48373706319efe8ad0ec7141f6dd6b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GCON04.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GCON04.DL_
          • Size 214KB
          • SHA256 2c771fb2bfccfab8a3cc6f992cf552352487d8e27c9ae83a70933385adb2ce17
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GDSP30.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GDSP30.DL_
          • Size 70KB
          • SHA256 f820e8f80ea6d50add81d2bcf0c0bb716a152337a42f5ed8f29f221d4e65f534
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GEPE30.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GEPE30.DL_
          • Size 88KB
          • SHA256 6091a36be37da2f61484e40ceed3b3e1409b1baf9acc792c90d0acf6f25b8dfd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GHA750.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GHA750.DL_
          • Size 83KB
          • SHA256 e39d23645b71382222cab182ca7d71edd3d522623e9f9dbe3298be9288ccf1ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GHMM69.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GHMM69.DL_
          • Size 375KB
          • SHA256 98be86c691399ec0fdd9d2b717aa80dbf78bc7edc39ac6face02eb6adf021d15
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GI0CCA.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GI0CCA.DL_
          • Size 27KB
          • SHA256 5991aa8f783d83cd8174530799b6ebca112e080176665a2e22e59902c55ada9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GI1CKE.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GI1CKE.DL_
          • Size 287KB
          • SHA256 b611e66e680210f728fd6ee8ad6f1678567e64e5c87f416311b9356b32702f16
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GIFX01.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GIFX01.DL_
          • Size 172KB
          • SHA256 3d1b8b539906b7a96c5bf25380ad76a769a524b69203e14358b87e946f7a2f84
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GIRCD4.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GIRCD4.DL_
          • Size 37KB
          • SHA256 94448f8f57583f69962b77239e20ba258fe51213e2aa539f0f5146e89824f089
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GJB724.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GJB724.DL_
          • Size 291KB
          • SHA256 0cac44833c317c25c331c91969d223c5b652c0b54aa9245bdee26c55cacdf7a8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GM1CKA.VI_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GM1CKA.VI_
          • Size 1KB
          • SHA256 6526d9a10695529209ec842d6137362447e204f55c9b1ed47627452471c3746c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          E_GMAI30.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GMAI30.DL_
          • Size 99KB
          • SHA256 fc8fbe8aca0ba5c83b6f107650cfeb3d56f3508c9b05d53288982f9bc6c63825
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GOKA02.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GOKA02.DL_
          • Size 402KB
          • SHA256 37d2277eb76c5d16fbea400e6e5d574795f4473cee2aa078b8906addc59f7ae1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GPPE06.EX_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GPPE06.EX_
          • Size 132KB
          • SHA256 79764cbe5889e09496d99abec164692661536c1286dae3b6e3b41e3c85720188
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GPUI04.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GPUI04.DL_
          • Size 326KB
          • SHA256 b10bd5cb18abde84220fcb5a2dadb8f597dae15c9b42968f120c4e5b9c4d3856
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GSC0KE.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GSC0KE.DL_
          • Size 1.3MB
          • SHA256 36d763897c8876af8db131db0037424df7fda66ab2b71410a6d752df7e28b771
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GUPA20.EX_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_GUPA20.EX_
          • Size 197KB
          • SHA256 19547d2d6ccc3e8008c0115f5af89513308002c46e0db5465f2653b91cbe40bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_H5UIAB.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_H5UIAB.DL_
          • Size 76KB
          • SHA256 50d988ceea21c9bb730a0bb2108d260e7cb7c2160ea5b92a55631c836a5ad4d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_H8B0KB.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_H8B0KB.DL_
          • Size 261KB
          • SHA256 c8bf43beb362302d80e3ddee2c52e5a30006478cb2aee70a24f9316ed35b1deb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_H8E0KB.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_H8E0KB.DL_
          • Size 5KB
          • SHA256 1e2b5b9db5e2034043b7e2ab956037bbfa7890673c920b92d5bbd4260d8fa22e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_QI121E.CH_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_QI121E.CH_
          • Size 117KB
          • SHA256 99fe992f3419bd6759ec3d54c0a2310bec4aa0df1fb96c93293dcf60f0bece02
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_S40MTB.EX_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_S40MTB.EX_
          • Size 92KB
          • SHA256 e6ecbcc9ed2fd193f67282b6b49eff947a8e8abfd28feb62e8a4cb417ebb947e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_S40RNB.EX_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_S40RNB.EX_
          • Size 89KB
          • SHA256 aa01bdbee56994c24c5e735f95b497cf0d1ed7d09c6f19e172704fdabf625685
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_S40RPB.EX_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_S40RPB.EX_
          • Size 60KB
          • SHA256 f14c5ffab31215f1743b084356f01e3d9451f3ab72f54ae9ed3123bbf284e826
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_S40SOB.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_S40SOB.DL_
          • Size 400KB
          • SHA256 8ff11570881e455e341461dd71af3b345927cdebdfa09be62f38315de9d9aad8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_S890KB.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_S890KB.DL_
          • Size 382KB
          • SHA256 002341290e18fceaaa768eef7403220234eaac42ea4416704efce0f1795d79c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_S8B2KB.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_S8B2KB.DL_
          • Size 40KB
          • SHA256 2f4510aa0eee9f1e45b87553ff5c1af20a75b11bec81337b919263fe3e612eb8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_S8E2KB.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_S8E2KB.DL_
          • Size 12KB
          • SHA256 a586295cdb95d002ca20903f8d962d7f6dfdbf54c6ec85705144ff4b27b7a64d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_S8I0KB.EX_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_S8I0KB.EX_
          • Size 98KB
          • SHA256 09463f81d4ba546488f06d313ff83bd5666a746dd9d266b5a77e08b8374f3077
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_S8X2KB.DA_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_S8X2KB.DA_
          • Size 1KB
          • SHA256 c0e9b15748e13d1651b633cc65bc25168419582d67f2f967087c3a01b2e451b3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          E_SKU64B.DL_
          • Path C:\Users\Admin\AppData\Local\Temp\SPR280~1\ENGLISH\WINVIS~1\E_SKU64B.DL_
          • Size 72KB
          • SHA256 6156a335684d5c8ad05291414624af2cb936415dc12384df61ed01cd4c6dc338
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          explorer.exe
          • Path C:\Windows\Resources\Themes\explorer.exe
          • Size 135KB
          • SHA256 0036a1f731fb64ac9a53ef5ee415c6b2b11158a71ecb612ddb9a0bb965956695
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icsys.icn.exe
          • Path C:\Windows\Resources\Themes\icsys.icn.exe
          • Size 135KB
          • SHA256 692085e5e8088e0336be67645566cd2605910c76b4aead43b2bd373aee1bcaae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spoolsv.exe
          • Path C:\Windows\Resources\spoolsv.exe
          • Size 135KB
          • SHA256 b9023d7802d8818b5174bfb33b9500af7276af3f66fbd46700f9e3b05a9a6180
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          svchost.exe
          • Path C:\Windows\Resources\svchost.exe
          • Size 135KB
          • SHA256 20948686022702fc674dc74ecc5dc31625a63c368afccade3e1309eaca3f4efd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e_gf1cka.inf_amd64_1409ff6e0edb7ba9.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\e_gf1cka.inf_amd64_1409ff6e0edb7ba9.ini
          • Size 4KB
          • SHA256 5cc21647060e32b2bd8edccef2521c50be6bfad15066d0e31e3554300086d00b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e_gf1cka.inf_amd64_1409ff6e0edb7ba9.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\e_gf1cka.inf_amd64_1409ff6e0edb7ba9.ini
          • Size 7KB
          • SHA256 6c82436ca9aaa1701b81d1f24f126b5c4fa73c835094188036c16c987c2a0894
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GF1CKA.CAT
          • Path \??\c:\users\admin\appdata\local\temp\spr280_290_x64_654as\english\winvista_xp64\E_GF1CKA.CAT
          • Size 36KB
          • SHA256 ca8640b911e48f2581ffdc92df7213028a237ace30a46e758e9838bae6e591c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E_GF1CKL.CAT
          • Path \??\c:\users\admin\appdata\local\temp\spr280_290_x64_654as\english\winvista_xp64\E_GF1CKL.CAT
          • Size 36KB
          • SHA256 685037f5d828fcd0a80fefe556c604f8bc4845d42f478f3ef6b7998734b0765f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e_gf1cka.inf
          • Path \??\c:\users\admin\appdata\local\temp\spr280_290_x64_654as\english\winvista_xp64\e_gf1cka.inf
          • Size 9KB
          • SHA256 b7ee1b0e9ee73c65fefbcda3cfaacfdb42e39cb6ee941189af090b5264461d6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e_gf1ckl.inf
          • Path \??\c:\users\admin\appdata\local\temp\spr280_290_x64_654as\english\winvista_xp64\e_gf1ckl.inf
          • Size 9KB
          • SHA256 86d63d0882272d5f258f93290c2cf9ea182607146f41ba6e4497f3ed5eaffb10
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/264-175-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/2648-176-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4300-0-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4300-178-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4324-177-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/5796-796-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/5840-797-0x0000000000400000-0x000000000041F000-memory.dmp
          Download