252557c7d873a7d217b7c5f822819d799130e2c5ae97885fb1924b6b50151c3f

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 705KB
Sample260727-daaslavckg
SHA256 252557c7d873a7d217b7c5f822819d799130e2c5ae97885fb1924b6b50151c3f
MD5 4aa6bf1ab8c05e56e438eb2f08da51fc
SHA1 1d26f7de833d550332f5d4d6271c148e5d41a9d1
SHA512 3e3d9ce0d26c6c04214bc6b319079c435f1161305094385286b7583eb1aea95ee21da06a0a8a441b51fe2951be861d1a9bee2e6f914c0d0d1827f0cd8405376f
SSDEEP 12288:JhANZFc2ms8aTAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:JmZo0m2kxUlYtEjedEeQ16ywqmpv
TLSH
T13DE412117AC1D072D54245710879D7E2523EEE361FA8D0D3FB853B2ECD792C2AA7A287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4428	elevation_service.exe
3392	elevation_service.exe
2068	maintenanceservice.exe
4216	OSE.EXE
3152	PerceptionSimulationService.exe
5408	perfhost.exe
5968	ReFsDedupSvc.exe
5572	SensorDataService.exe
964	ssh-agent.exe
2992	AgentService.exe
1884	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cec05a26209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\java.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000279cd09d721ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a99aff9d721ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeBackupPrivilege	5968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5968	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2992	AgentService.exe
Token: 33	1884	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1884	SearchIndexer.exe
Token: SeDebugPrivilege	2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	2756	2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	4428	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 4076	1884	SearchIndexer.exe	100
PID 1884 wrote to memory of 4824	1884	SearchIndexer.exe	101
PID 1884 wrote to memory of 2812	1884	SearchIndexer.exe	102
PID 1884 wrote to memory of 2536	1884	SearchIndexer.exe	103
PID 1884 wrote to memory of 6116	1884	SearchIndexer.exe	107
PID 1884 wrote to memory of 4324	1884	SearchIndexer.exe	108
PID 1884 wrote to memory of 1588	1884	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_4aa6bf1ab8c05e56e438eb2f08da51fc_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3392

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2068

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3152

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5408

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5572

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:964

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2536
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8b7517142d2ea2d4f31493c74d9e4cdca09ca475894136898fcb08f0717757e8
MD5 273ca3be2eaf53472f64e8a262a853ff
SHA1 3dc051320ba99574fd3d93a4fe2582f65394ad92
SHA512 9acdbf83219097b56788a3202e956a8afcc8d0c8ebeb6c4b9cc6022d5adfa1207811605e64c7d58200f2e1c3a171538c98069c6af0109af8795757e2575b02d9
SSDEEP 49152:ib+632BuPkFKRrdE6ohdstBhuXjfS4LWxnMuYtO2E8ywqev:E3q6mjBFuFJ8yHe
TLSH
T19AD59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 8dd811b9a26ee11685a83c31564d108de52c2d7b953c9366b2b8342b6956bcf0
MD5 508e6a20fd802aaa72383827ce38009f
SHA1 bbeb2746cecb5e3709b49aa594908d5fb8c8cce3
SHA512 15d0242af8db6b0f427ecbd5d913c2aac13e475db698ad3e588c194ebcfad3c2546a7978585393ba2077ce3bc19908bcde45eed8c25d5499098e2490ff6f080f
SSDEEP 24576:rXYfDtczAum2kxUlYtEjedEeQ16ywqmpv:utcSuYtO2E8ywqev
TLSH
T1C405012977E508F9ED67823CC8A2C512E633789547A4E7CB03E499690F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 66ebf08667795c0d3eb32af69ee17bd90510d4bebb4e253797143b5341bde540
MD5 9b012e0fef72b099722f17ab6af865cc
SHA1 9809a68844c2b3868a59f5f449da43ac1d854e14
SHA512 6d7981e947061d0617cd0b49bf4d4073e1c6383ccf702e646bb3c941b89835dd396ee3b82777030c7076ba9147f807e47bb8066adebab286f7128319d06db8b5
SSDEEP 24576:m0Le5ji0hmxhrMJm2kxUlYtEjedEeQ16ywqmpv:mPji0Az7uYtO2E8ywqev
TLSH
T1BB35AE16F6748335D073C0B9C5D2A69EE97230861B308ACB4286D77C7E676E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b68551993e6f228e662bf11f6029d4c9f06453c2c5f167875ab2bf28426090c2
MD5 edff3f227df3b0138c651b35e77c0b9a
SHA1 b0cb68f2300a58bd97ca7876dfe187fdc44d9078
SHA512 890b38440deda79af4d377687d883dc9e5181e1379808d5a6ef0ee53bd2ffbc7415f0bb2d781961550819bf1d93feac6a901d94b840c144ff132804aae2371eb
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWj6q8wyuvm2kxUlYtEjedEeQ16ywqmpv:X/ezSC6vUzPv+HjyXuYtO2E8ywqev
TLSH
T198755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 794b01f269905982fccb2d608bd25bd160c8ec4d80dd609ea3e1041c6a32579d
MD5 43db0c90dcad2c27f7d9c581e4780bb5
SHA1 22438e326952ec9ee90dfd7d570538cb8748159a
SHA512 3a150d9eb96f6378718a529b01595dfa80b965cceb8213a9678d5e8c11e0a8964e61f3d0eb1825eb7f0da03daec227ff6dac8b5afab890aebb40645c069d3f78
SSDEEP 24576:sVbqPb88hv/l+Bim2kxUlYtEjedEeQ16ywqmpv:sVO88hXl+buYtO2E8ywqev
TLSH
T170559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 78eecc5d29b1989476c8afea0028d2d77570ae118060ffd653035ce53c508910
MD5 41e76f05de476d16a258ffb1670fa3f5
SHA1 977f639935c359b0d322653a88e4dbcd274dee14
SHA512 2f39a3d5548b6df54508d6c2a1be6944e4918b20fc2dc3b0280fdf9502fc0c61d3950ffedf212aded5b9974d5dd86325d2e93c0e8678198cc25c3b49e43b0a0b
SSDEEP 12288:FG3tAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:FGdm2kxUlYtEjedEeQ16ywqmpv
TLSH
T162C423C3AA253188F7655E3424FAE96313564CFA34D8D5CBCBD2B75E80BC017D2EA182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 95cec2d86247d87fcbd4cbcaeb80dbf6c795a70b28f743032ad49fab1b2feb61
MD5 182a1008763bdb53e0ee0515912a4fc0
SHA1 8489c06b1ba9326f523868d4337558370872e4fc
SHA512 da5afcd6fe5f59f274908ec1ca891551434bd98ae8c7ba67c38ed0c1826081db5efa09d6557c4e0c3ba91ccacac7c035521cc291d4e7e7e5aed0132060819d2e
SSDEEP 12288:NeBNUbTVO86UmtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:NJIUqm2kxUlYtEjedEeQ16ywqmpv
TLSH
T12005CF7BEE28FCD2C27A8D785A91C600977278704B61A3CBD165C30EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b9fcdaaa95f47be7d0bfa8c9448c509e332d9a7e9a0c594e7e1e8030e9644d43
MD5 15d455f55f6001174338bb1b8f7d5e4e
SHA1 5e2a4c8b91da03d098f72a1a6db874f99675a7a9
SHA512 ec64b93711dbf268ae175ea674e9a418b73b6be6dab578513c120cf0e3924597e8d16c59f4060faabdfd8d3184f54420414cebf1698e08c2508f502c28d55d88
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THH:rQvGAdlCEL8c/WRNw5CyuFJ8yHe
TLSH
T1C9267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 cc967246d34fb6a61f946c0e895efc5940d82d62738f7f0eb79888cc53212745
MD5 d0bb5fcd7ffd788ae1e40cbfc39c2b16
SHA1 008de7a9405360cec7759c68c39f799d19805f2e
SHA512 698dcebafd27f842b7a4bb8e7ec4812a18e55ee52b037bde350ccf0b2bf476efe85c2639cd89a84d6aeaa3b49ba55bbe8050a6423cf165e179a9aecdfeede11c
SSDEEP 12288:oAwSfxL/2Dc3mDLLmt0LDQewsAjAtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1E:NfewsAjIm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1BE15E031FE74E036D3BB0DB21B76C716142D79604BA11AC3E3E89E9E49342D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 66ec42ef767561585482b683e928c9dac30ca064f7e4ee5c2ec7a7100e49f083
MD5 5c459dd1d0d328d108255d2c10a36587
SHA1 e2f2538e96548f446d5ed04ed1f00d83856d90d9
SHA512 780170355c9a832989c51ecb1d6842df7ae622c745ba1d4be4f124b4a8a57d47bf0d651f32afaa6728f26bd4d5f032ab96ec5b21e0e38a193fa0a1f5970016aa
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHy0y:8UEtQevvqc2W1cpV20I32y7
TLSH
T142474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ddc4cf637bec9e4cdc17659f44090b50312df4c78b23994a62206465ae3f8016
MD5 e40c58f3b54f32b71922ea024db053db
SHA1 439cdc3b6f3d553afdaefd90a4d0ebae11b070cb
SHA512 1974c20625222ace00cb05a14ba2b4c1e50c444a38cdd360c093557a546ced749b00ae2b630c1f5d498d0d9039a3e2844cb1d5def170674a8af2d1bb5310b63d
SSDEEP 49152:WCbRquA/m2yL5zQfFiV+XenmE3/zruYtO2E8ywqev:boqtVjnmOuFJ8yHe
TLSH
T17AD58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0cf437be3ccf306f2b6d568501abbc7ddf5c416e138d555fde35978259a3dc49
MD5 c3f51df295dcd44982332ddce008b132
SHA1 a52e2695955caf474ec4e79fdf76fad9fe72bb1c
SHA512 092bd940436532c601f0c985b99ff6e6c349a9663ebfd1ea5558cb887e75f7847b398255cba28c15146853e8a79d5bfb581c940e5abea2388a281e17231a98dc
SSDEEP 24576:+AhGL6IFoiwtA5l7S53bm2kxUlYtEjedEeQ16ywqmpv:+AM5Foiq5euYtO2E8ywqev
TLSH
T1E735AD81E7F915D4F5B3AA7899B69571EA76BCAA5E30C20F2150D21F0E33A40DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a419d959db7107d09523b998c5a5a345efa6a888771534ddb510ed2569de84de
MD5 1ce47aae46eca6b9b0fac3e6e6f7beb3
SHA1 9ef3f53a5a38e2347816038bbedd86c205383b45
SHA512 7f04741ba5ad1e9281d7dfb20918f311d37ef97470a54f68a00dfc322f37f99c98f43454da046f7a6f1dbba30fa21d82d5be55db683ea6fd26f7432afe727365
SSDEEP 12288:dmw5HEjsChNEBFgl0WDm+CNtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/H:YwuROWUm2kxUlYtEjedEeQ16ywqmpv
TLSH
T14105F14676A51CF9E96786388597C532F3F2BC123A24C71F47A0C65B5F37221AE2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 706cb7f3fa93c67fb89043b57ee65303d0d54358d18ef75fc53e9a2773d4f6c1
MD5 f972a724eb0b6140890aef25cf91043d
SHA1 000c97db66a0adf2f466304be1a45b0724d5057a
SHA512 a4c9f74b0c104bb2230badf4c4232278157b9b0244da4753386a62121c2646984a77821bccd9864a0f986428353bdae57f7ae9db779132c1883e23e6c2f90010
SSDEEP 12288:wyZ1IywtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:VZuxm2kxUlYtEjedEeQ16ywqmpv
TLSH
T164E4128632A430F9F2A3563C98F19602D37278A7337483CF46A5525E5E776D29E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 346b32c8b1099523bef718b4eb6a5b83c17ebc4428352acc95572d2faa1a4579
MD5 0e092f37a51e7341a99975ed44c44dbe
SHA1 a12dfa48ba516d90991bd76dbef32c445d2b1531
SHA512 5106d2a5230a2b6b91052854f2494bc0d6617f53a0c9872a3b1502956847c79b1d64a937fd8d1c59a8698cd3a28e1b16a3e8c26b48309b079084b953e9137ba4
SSDEEP 98304:MQRQyi36YOcPDLvw2gAf+PN35uFJ8yHe:TQyiKanX+PNc0y
TLSH
T13A667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d930e833837470a77589a8e771897b12ae7e0d76a382c385c5eb376f6f1dd5bb
MD5 ea284b167e26df7b961cb18a97c7e8bd
SHA1 152a38af97b814c2d9607ff01f99933ed584163f
SHA512 c071847510495c77ea82366541d10cbcbf9a7fe982bb9960427d6acc4df804d7c029bf8f621b6c50ec8b5a1c2792bc40dc4d7c8998d569d96a0a3cdc57405f2f
SSDEEP 98304:dQRQyi36YOcPDLvw2gAf+PN35uFJ8yHe:UQyiKanX+PNc0y
TLSH
T160667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b93081a0a803408d8a948af4d3770243b8234aceceee88fd8d0b877e6e693536
MD5 fdc433ab7c347876fbde727cc9f14f88
SHA1 ee1dd80ddf3b38c4c5baf14133cb29abd2cf007c
SHA512 9d14704d48cca8d05a34e1c1d275c22ca48a56975a62c80983e8afd26680d6338a764e9133ad97a33edd9e91858c3a50360700b3111aad36ad3e67eeb3ba0520
SSDEEP 49152:N68Qg55nhkeWu7PNU3/7uYtO2E8ywqev:LthTRc/7uFJ8yHe
TLSH
T189B55A33B2F20099D44DE1769F4A873196D27C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8d09382abfa1b9f7fad04152896bb09bee8d85ffcaa0b6f10bca40c3d8459b73
MD5 30e25e15994e06b58793b0ea2dfe83b7
SHA1 7ce02ec860a09181220c2bcce7f57fe5ad757f87
SHA512 ca39581b83635e32ba18a3d7cc6d7958d373569547d03d8e129be1a149058482109c96224acf53c89b601e72d01532993dde0acaaec430d34f5c1703ae6b65ec
SSDEEP 98304:Dy5112gYy5azzVvU69nLKnhZouFJ8yHe:eLIHRWhj0y
TLSH
T1F4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 509ce95a64dcfa85467990e486baf20fc664d2dbb4cc585e1225673bf05f7be8
MD5 bfd6da68e301de27d84f01e786952218
SHA1 b05abeefa287070d49506a8262ede98d5c3a8571
SHA512 641191294a8c5ebbcd504d087f5f8f9b629ab933e05efb87ddc7d6d35f2be9dcbddf60ec37d6c76f1c7e7d543bb6c8523479b9f50ec4db25e5fde00fc9a77910
SSDEEP 49152:BB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glBuYtO2E8ywqev:Xu6JmIxd2dBuFJ8yHe
TLSH
T151D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 76bc8c60ae612277f023537cab5919b20750ad675d93610e9e4faed805a7cedb
MD5 c36fcb0166b39da35c108aa1d207a867
SHA1 bd38112c8221afd47cdd33f42c51c02b09a7e494
SHA512 82ca22205656ded707c09c25af09e6fd15ce68f7452992da05073331eb717eaf00106204df8e44713bd122cc0852ce138f12d10229bff47df153db9ecf50481e
SSDEEP 49152:+1hpsNoJpF1A67U44CwH7R4xduYtO2E8ywqev:+mifPqROuFJ8yHe
TLSH
T162B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7f4792fe8dba5d35762337e700699ba87c54bb10f07496f726c123e5c03fed6e
MD5 2cff9f38c4c2e6931491bc1039509977
SHA1 a15e5b0a3a48e8d0706365f3f4a9b452ff500295
SHA512 91e7b48e3f2af4f06dcff79ce9f23b57463f7240f4ffc70523a899a9630fe406cdf1b3578a4cd218214168fa52e3921b0be3db7faed0f9d0ad88556135a212ae
SSDEEP 49152:RSuZQIY0Be2KkRVtOnks6NMHqcuYtO2E8ywqev:/5dKqi61cuFJ8yHe
TLSH
T1DAC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0374413e2a7d1c388a800259f8cb24116b3efefa47e7f5a253393c8abe51c4a1
MD5 a876ee01221762fd99fa0a88e1717a96
SHA1 8dd08086f4905d7df1736ec7e6bbfef886bdd8c1
SHA512 f0064a0c3ae6899a1ab3ccd8602331f7d8b0fa700fd7755078ae9dc886f9ec22e700f37b39ece47e796f411c2f6a9025eafdac852aceed51eb26e28c06da059c
SSDEEP 49152:HhtSn8EApI0figjgiDn0AP5wRuYtO2E8ywqev:WX2iWphquFJ8yHe
TLSH
T17695BF13F2D901E8D05ED178C7568632EA62BC160B34B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 5f56f49e0b58b48c8ab354f02bf0c1ebc3d54f0aca46de9e1cf8843ddb122233
MD5 43fba9d1d0da89bd94b217f2c9fbc621
SHA1 5b51b452adfa7070b8cdd7d0ff4c639a4c8d3e6a
SHA512 d0ec34aae9892cdfb18ece41a3ee6c1bbb41b24c51fb5e1ec222dfec2372f293817f9ec5dd4d6b9fad9c33aed62b9b6486e6c187ad6624b542dc44e7c0da4def
SSDEEP 12288:iPtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:ilm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1A0C423C2A827358DF7119A3450F6E663125A1DFF76D8C1DBDBCAB21E80BD027D2DA085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f7e1ce470c07d4cc3cc18a37ad0d3c6374b5b5ad3c73dd3aaaad695be88961de
MD5 5d88f6ade09d825f0c89093612be41a4
SHA1 f3a6b5c3ea9f2aa15e23cb21cfc0a4a9d1366f8e
SHA512 893a1e925a4a69e858491d124a7138c78669ce5ce867e22d12e5d251254a278ff52035e226e2756a16432a7a319f931de6632957a08983661dcdd78333f806ee
SSDEEP 12288:VktAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Vsm2kxUlYtEjedEeQ16ywqmpv
TLSH
T181C423C2A8273589F3159A3450F6E663025A5DFF76D8C1DBDBCAB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 591b8c3e7e9aac20fccb7d7d2a84e397baa8a0dfd14c932f931442e4a8a58f6f
MD5 c45456ca5c4ca4c2b8f52bb1c9ae3664
SHA1 51b33d0b2d70721c76ebb141d9e54527763011e9
SHA512 1e767d336e11f0debd37191bfe266c875fdc2d93e4e2bfeeafe2485bd323d72056100f2366c00e3af0e866077acdb6f02f04b2e4f7ddf73e2a2f15651ec31ac0
SSDEEP 12288:/+tAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:/Sm2kxUlYtEjedEeQ16ywqmpv
TLSH
T10EC423C2A8273589F2149A3460E6E662125A4DFF75D8D1DBDBCBB21E80BD017D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4d98f86f6a440455f575959f61af821642149caf4377fecdfb1dcbd42e3701bf
MD5 cde1f743aeef13bf62f23c0f22c7ae9e
SHA1 971b10a07fdcac74103cd0d8dc5d0116bde463c9
SHA512 a76eaa2e151de6eab9792c159e80cc04d14dec1e3fb51ed780fa844faee4c2b853bb911445ae9f3aac47c8a94c49aeb0e8f8952d961d3fe607f0cfa2d3be5a40
SSDEEP 12288:dVJtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Dm2kxUlYtEjedEeQ16ywqmpv
TLSH
T10FD42382766A30C9F521D63484F2D52393B67CFB77B4D2DFCB81560E0CB9252D6B9281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a252e2d0aab286707d7be0cadb11ff6ee02dafb57cbc2fcaf61991f98742629f
MD5 8bee3fef5f413808d52b21bc0ffc4bda
SHA1 7c6407ff55719db48bd1f6899778ed84b163a9e0
SHA512 8aca13ed5151fa1b300323eff355eed7fab52635943035912929a1c98d4d790f8b1d22bc31cb0f28de95777fbb73a18319cd2a12f74c9a6981f55f2b5a6a4b1c
SSDEEP 12288:/xtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:/zm2kxUlYtEjedEeQ16ywqmpv
TLSH
T129C423C2A8273589F3149A3450E6D6A2125A0DFF75D8D1DBDBCBB21E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 18645751ff376d4cea115b2dbfe352d6293a20f3897a8732562bc60c14545c75
MD5 541604b856377b942ac97109ff762ef4
SHA1 516f1410fdab648063b998ef9d013e2bd2e0ef94
SHA512 a7ab7b46591be235f3231ecbb7fd6c96dd652b6e603183e654e3d775039faaf9e2139b3300fe651cb73cb2934f91a5b4c0ce9df4a1478a6de8642fcb8be13407
SSDEEP 12288:54tAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:5Qm2kxUlYtEjedEeQ16ywqmpv
TLSH
T12FC423C2A827358DF3159A3454F6E663025A1DFF75D8C1DBDBCAB21E80BD027D2DA085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 439f27c29f57a80e5c933f9ca3db1e939211d4ffea74a4efcd7b892a2b1cd892
MD5 511652cddc1df46723687c4c1bd7461d
SHA1 76d733d116b90446be02b0b214eb83ba265686a9
SHA512 83baf3412960a58afc4d902ab60e3368e69fb2bb4cb0e76ef6739741dfb8663a623b604fcfb588bc04f8bf5d8520ed10cfa913036830ad4cbde88133bb14520b
SSDEEP 12288:hMtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:hEm2kxUlYtEjedEeQ16ywqmpv
TLSH
T126C423C2A827358DF3159A3464E6E662025A1DFF75D8C1DBDBCBB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 985ca945e10a5cf228d964a89bf383ae0c30d2d7699b7aa973ce56b35f0627e8
MD5 1e75a1acf01b7b31cb7f5b9a7785c01f
SHA1 5fb4e9525df8dd0f16c8d92ab8f7ede700b15f9a
SHA512 1c2c3bb7179e732922fdf5b364003e6d51920d5da6271b7d667b5deddebe066af4ed3642ddf1a7e688572ed78738285696d1b2fcb4d9ef155f8fcaa41ee2cd5a
SSDEEP 24576:BZM3zFVSOMm2kxUlYtEjedEeQ16ywqmpv:BZM3zfjuYtO2E8ywqev
TLSH
T193050295B35018F8EC63823EC8658916D2B27C6A17B0C65F03E4362B5F373A15D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 49e589f0e1cfdaa2dd4bfc502c5f09b25675fb01950a601641f0f51eab3c85be
MD5 f34d061fb02c23e0b85ecc01dc4a541a
SHA1 bdcbb6420785181e672a8b5ee1ef3d1c61d6ad64
SHA512 00ba06c8059e78a62e68099aa4a922bde27efa89f8f7a9b58b6a0aa7c547dae31c41cc0ccf8823971f487f7a953010854cee13d245759ff29c35d633eacd8c28
SSDEEP 12288:JbtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:JBm2kxUlYtEjedEeQ16ywqmpv
TLSH
T16BC423C2A827358DF7145A3460E6E6A2025A4DFF75D8D1DBDBCBB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 73578264f7a40289fcac668a868b1b569a824c71378fd1fd811f777fe7e17f5b
MD5 064e65ca5baeccb75d8ea15b439cbc62
SHA1 4ef337c7e8ca0ffae25a8c17031858c0279a968b
SHA512 58a4e3b58e4dc76355e69ef8d8fff97582874c996fca46983c28133803bd17d4dab4c22153b229e19298061952b1ef11bc1fb9227adb723c2150a13a49ad9236
SSDEEP 12288:wntAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:wtm2kxUlYtEjedEeQ16ywqmpv
TLSH
T10DC423C2A827358DF7159A3460E6E662025A4DFF75D8D1DBDBCBB20E80BC027D2DA085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5a49db368751713db5b5e30bb4a79842c8bbfd16f11619eb6df2f9bef618752f
MD5 c089eca0ff5424a603ca6f57302b2d45
SHA1 81e61999518d7b4239f1d9ab4ca14c140fb3b62e
SHA512 64eccd75a0c84a452999c5d731b75ad42b42201665fd31f53721ea42f70778ab463dc1657440702f1ef8a230bd741e53115c09f530fb84379e4790ebe52a9b8c
SSDEEP 12288:ryPz5L8wtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:GzyYm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1E0F4124773A130FCE136823888A25A12F37278761764CAEF57A4477A1E37291DE7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9f8c31144410fb5efcf08ac37a69174c7ad130350c17b240b5992cd04b7d9a57
MD5 0c87585de98b0246d0dd1d6bf4a5693a
SHA1 a6d908134e626c11a7ea81536354c930943f9574
SHA512 c2368cbe921908af054fdc1719d86b9f8ee67436c8aded8647b42716cbfe720ac5aebfe94d636dbec62f1495c89062dcd509f1421367300f436d6d6d5abbe043
SSDEEP 12288:UbtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:UBm2kxUlYtEjedEeQ16ywqmpv
TLSH
T165C423C2A827358DF7145A3460E6E6A2025A5DFF75D8D1CBDBCBB21E80BD017D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 56ccd37a43ea9ca90e4484fc191a4b896552279e4d45b3dd14817abc254f4409
MD5 abd711201e3e6215ae781465e7f1fb10
SHA1 9a7a6f687e493345c02c35f1c5faf830486fb1a6
SHA512 9514509eadd811054511e9e7b0f5097d9f44c02b8ea0d5120d4f94b6405398eb1e7ba52f7f562b458c8afbbb82821dfbc7a4e49ca7a198f9eb44664117db3541
SSDEEP 12288:NbtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:NBm2kxUlYtEjedEeQ16ywqmpv
TLSH
T11BC423C2A827358DF3145A3460E6D6A2025A5DFF75D8D1DBDBCBB21E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 32ca54ac27f99fca7c6e73d5b8af45d43dd3fb1ca2c62c061d333f5eda774dd7
MD5 a5813ed284fc563a6937adf6b0aa1df7
SHA1 6cfd031852b6aba60e4ecd72c94d91e9fc365038
SHA512 8dcc63d215809ede0bee25ad676031d6302f1f2d350b378af0aa5d2e4bc96d9f93692e875e02d64d4caa2fa8a21f2ca5048017181086ad491e99ec04512175ba
SSDEEP 12288:xyPz5L8wtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:gzyYm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1C8F4124773A130FCE136823888A25A12F37278761764CAEF57A4477A1E37291DE7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3baecc85bb424f48fab3ae46d734d9249e6046f7079b420ccb934a92d7d875ee
MD5 edf07f1942eaf5f60506c3d4ce965a8b
SHA1 bf530be10705191c1de56cc441944f650ddcc596
SHA512 3caa65bd9ea28427779fabc3c2dfc2f557ffd4884ab59c579d775fbc48a4f1693abe0db87d37e54e315ad8334a145560454a474b54047da62b1fd593cbe6e455
SSDEEP 24576:xT8aLl3z0zDCm2kxUlYtEjedEeQ16ywqmpv:xT7LljiuYtO2E8ywqev
TLSH
T124050295B35018F8EC67823EC8658912D2B27C6A17B0C65F03E4366B4F373A15D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 190cbb0fb9349cca74b2f94f591ca7545458e08fb1aae7e37a8e842bc61dd528
MD5 b82ba63fa5e4c6539a9abf0f34ea78d0
SHA1 73af5ab4f57f000ab030cd58167e096ff8cac255
SHA512 ebeceae1973fe09acdc0440fe3d5e9a1b6afb2ba074b161f80023fce1ad6e6fbf8f0e6f8eb5ae9b38fbc11e700b9c325fbbe55ba65c6420e024295a807d65745
SSDEEP 24576:+3rd9CHKy7GZWm2kxUlYtEjedEeQ16ywqmpv:Ard9CHKyajuYtO2E8ywqev
TLSH
T1EC25CF90F3E410E8F1B7DA3588769512DA767C9A1B70DA8F03A4661A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 34c83ba3a98bdb8af5051575e51050267495293f726eb4aa2d6d42e1c16b29f1
MD5 faba7d5b49d5deb2179432281f550d16
SHA1 6d4474f16bae0debc6f85babb823af64c62315ad
SHA512 519a3ecd9c6050703e0fdb242810cf0621c693c6457969832bdfac1ca8475b83bd5f01f8e572036019277ae6f23ee0121e088b6494d4ecf7757710bf711c70a3
SSDEEP 12288:MetAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Mym2kxUlYtEjedEeQ16ywqmpv
TLSH
T16EC42382A8273589F3149A3450E6D662125A0DFF75D8D1DBDBCBB21E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 bfe0fcd3e6609054aade7e38590124bd9755a294127b1eb82041bc3e53c713b5
MD5 109f62af762cba8b5ecabdf2fab2a16f
SHA1 f3e070cc76f6ba24f1ea3e48ca5a2a6e66a5f900
SHA512 5a14612ac4fb766acbe3b31a568b432271b5de6b476471215bd8d9890d3b573413db7165bf238e3f5a4aff72120671a48e86f1d124c4e5c948da4017a46528d6
SSDEEP 12288:VQtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:V4m2kxUlYtEjedEeQ16ywqmpv
TLSH
T1AFC423C2A826359DF3159A3420F6DA63125A1DFF75D8C1DBDBCBB11E80BD027D2EA085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 ccdfd2dcaa78bd5a105761f20f88cad71ae9359414f711733d1782dd9a12b4e6
MD5 9b6129488e7c70499414eb35cb073326
SHA1 6c9f4a917656fedfa9b1a398940660635b4d6bf1
SHA512 af6ea564e60720bf4f4a7dc079f46554e1d4840fda7bcde256a70764f65658de46462e4b677919e98567c1f5f1258e12fc8fd0c264670d4c27954509b52e6b8e
SSDEEP 12288:M1tAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Mnm2kxUlYtEjedEeQ16ywqmpv
TLSH
T154C423C2A827358DF7149A3450E6D6A2025A1DFF75D8D1DBDBCBB20E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 9c237dad9a6785613f8e42802d48b23c290111c6c996f708c57a8f28bd94a32a
MD5 84521d6cdaf6fcb675baa1dbafcc548c
SHA1 51b8adebf3d617423baf5af800c02cd498192c89
SHA512 00cd1e518b063cac3b8144bc4fba3f8d3fd28d1639afa5f554feb2bc65e6c747bb66eae3de04a0e06199708765b99920e1bb2fd9aa03b8d136a09bc203df5bc3
SSDEEP 12288:ebtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:eBm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1C7C423C2A827358DF3145A3460E6E6A2025A5DFF75D8D1DBDBCBB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 6a9cce4404724c8a5a45094ea20ed847e44421de9bb79d15514b370ca1fa07b3
MD5 5a3dbc6308e4ab5beb05b269ce62c007
SHA1 d58f7b012167fe5b8a0435ada30a99204ea2ce07
SHA512 cc86461e01a6ec16aa002854f16096f30fc06840f965ad133358c8d304687c5e52b01061fddbc68c5a15f4fd0135310cb7b1b017dc737f80553ce376d98be0e9
SSDEEP 12288:eetAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:eym2kxUlYtEjedEeQ16ywqmpv
TLSH
T11AC423C2A8273589F7149A3460E6D6A3125A0DFF75D8D1DBDBCBB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 476744883866485f1f15826a44f081b0e1fed9963d640b53b45a3cfde312a1c1
MD5 2f85dfc9a4fd2c3350b0476b4aae5a1c
SHA1 c48b14ee6929cf1e5bbf01415f67eef5837bb7a5
SHA512 0d5e923c8f4ef322d63919a5899bbe036569ee112ee129bb5de3e574e92b323bc9619daa79f3986f84eb19aab6aff488aaa39cb985a153411fe9bf2e49cc617e
SSDEEP 12288:rjtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:r5m2kxUlYtEjedEeQ16ywqmpv
TLSH
T1B3C423C2A827358DF7149A3464E6DA63025A1DFF75D8D1DBDBCBB20E80BD027D2DA085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 b2378c69ca45ee726faf8536c58e42a96d809849bc546744c509afd43cb41441
MD5 a2d3d9f03691101d664da0c1a21f77e3
SHA1 aa892c25ccc310ea9ce63c161a1bbe75877dbc9e
SHA512 72404fc414fdf4a2e38e56f8e4f7c36a16149de7b117da4dead7c16b70d7c718039dd62cd74b11b8fa1746b513b79b866a10cd732953d3f967228b1dbd7dfcb2
SSDEEP 12288:3xtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:3zm2kxUlYtEjedEeQ16ywqmpv
TLSH
T13AC423C2A8273589F3149A3450E6D6A3125A1DFF75D8D1DBDBCBB21E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 4c73b676826d40d68420435ee82d97af4849ba65d7d8ba456e7a54573785578a
MD5 b0e4f4f3ad0549bf546ca2e8d20224b9
SHA1 454dd6baee686e207869d7fd372b65cae2e397f0
SHA512 5c0c82dd8a7bbdab338faae799063ebf1747ac8c82c5c6d9da09afcead93432ad3e022188ce3c9f0d030382342f4d69d501ef2efca2c0b3a99eaccb5c0b0b14b
SSDEEP 24576:mfwvzk9RX6wkyAI9m2kxUlYtEjedEeQ16ywqmpv:1MnYIIuYtO2E8ywqev
TLSH
T12C35C029EBDC04E5E177923C99B7460AF2B178691B71C2CF029A536D0E37ED49E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3b586bc514d8e41bb111a2e13abf8c88ba779cdbf255de199fd2f8e91a39a53d
MD5 0bc2dfcca01707fa86a06ef3025974c7
SHA1 efc91eb663c9df5567223db7fffd3d3b70a15f78
SHA512 b34f1ced71e285ef720a89b2e680a563e80a74b517b2c7b8a3763df8dc68626a6bdac2fe102f3fd6ee44ec5048c64597ea289b9db5a80962884cf7a104669d46
SSDEEP 49152:UYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xuYtO2E8ywqev:LySzPZuFJ8yHe
TLSH
T1AE067C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ac6bb13591b98107e7f51d51860840ec260fb3d6e025dd0a874da9f44c197c0f
MD5 fc8c7e119c0db5b2c498df216fc851a7
SHA1 b076b88a5d50968b1bbd043a098fccf854ef33b9
SHA512 8140371531e2b6b23dec131d029cfae2eb189b95f3e2699f2ee2a57ee44c99fadce5e371eb4fc3d5a410bd93d8706dfdbff56f0831f65d501f8c2e62722b6f30
SSDEEP 24576:T47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYcm2kxUlYtEjedEeQ16ywqmpv:T47JUQjqirIhCnDHUPfF/BuYtO2E8ywf
TLSH
T19B65AE1EA3EC01D5E1BA923885558A5AEA71742E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 d77f71c61f0b0c70e2b12b1c33d00a008e564084b9853e4e424da5f09c9f267e
MD5 06e6e7042b344e5486a285126f64c91e
SHA1 9d61fde5f42e07e4711e23ac61a6fbd8b914dd7c
SHA512 172f88e8a95b869d8eb8e997dfdc6a0108a5cc6b2f3247e52b0f64c24c9a8379022f230b6dd99d968504d7798ddfb79c37109d0fc71dd1ca213b662b3d0e0bc2
SSDEEP 12288:jpsfrtAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Exm2kxUlYtEjedEeQ16ywqmpv
TLSH
T18FE4014AD25812D8D16E6239C7969A41B3333C6693E0D3CB57C0F53E0F7A2919EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 bed9c414744fdd2a652d34ee5b166ac06489a47de7438115b37e5b45eb24da7e
MD5 fa4df6374a55e9b9bf90d2a790fe9b2d
SHA1 a8ef7a00be269ba193a703642afaa055e0a4455b
SHA512 827c62ef11ade17ea9dcc3ab75e3f25e1d8099409e9162cf12c8a597785a99ee627e835c437c7da9f44f9967c9916b8873afb61be1006286916185d39f0e1bb4
SSDEEP 12288:LEuikVU3ffTQE1JDjPNEJIU6mR4rOhuXwaRkvJ+WpO1SvTy6:nikUP0WPK6K4ymwaRkx+WpOW
TLSH
T1A2351741766BC75FC6A944325E32D1CCA7707D01EE05AF0373C88B3F9576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 599c9152d8c8ce5247ca0f153ca78b93d0c7244ca3651905d35212976a9e8867
MD5 a2e0a89df88d948d69cbca525e6b0a90
SHA1 a680f1588e6e2fcd31cf6d1cc860b4d685c603c8
SHA512 7cae74992134d96ec4b55bcc7ffbb79863b3a1654cce07fb564210206bde0d258b744e17fc619b37d041f8d9852d15edd11a47c73e278378d3206b3af8d13d94
SSDEEP 12288:Hs7fPakxcFIKLw+EfO1r5wUMorepFE9FsEZKDEyDuZa2Tn6V/1BY4i+gbTj+kv1W:UzcNLwm1T/CA5iT
TLSH
T1D265F9816037A38FD1FB607107265F8CB7A4EC16B7096F2673C8453AD86AB2560BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 750b233de33aae70d896b3303d62d8aad727f2d7ce5bb5839cf5b0af8d9b7280
MD5 f50694976892efcbc455331262efdbf4
SHA1 31e4875d2812755f9d9257294aab332ea726e32b
SHA512 c8cd25d2bcc3d6d2ae69cdd67c2809fc17745083abf52318acbf92fcfbb837904a9eda448c454e3a9e95a34dc2396d96c6f59cbd79313ea2a9e4f57450b62169
SSDEEP 12288:oM7ztAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:ppm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1F2D42383A66A3549F6755A3410FAD532121E7DFA3B88C0CBE686B35E807C0D3DEF9146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3b173d049390e39b8a69f8cf187507a9d8ea8f6d9eb8abd7308864b409633dd3
MD5 75a961ceca7719ac7a565d7dd7074d3e
SHA1 9bc6f9e30d12038fe127ea46ee4afb3ae0f5f44c
SHA512 a38694b1525c78fdd3cd57ef8e1dc4a9132d07986f5c7039583e64288425925b0ed9eb21f2227a2719f67bad5604efc9c2bdf4307e8be5213b71f1ca4f73973d
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYvm2kxUlYtEjedEeQ16ywqmpv:0gb4mBIBhGF/uYtO2E8ywqev
TLSH
T11F65AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 98c984ff84d47d6754b103685c716182d2a1bc98349f1c7272f1e68f117e1d67
MD5 72ef83f29bce1d1a8c7aa756c2241374
SHA1 33193df2b6c1625e31e9edcbbd572e31e09d09d5
SHA512 65f1c860e88233bd23030a7aa636306af02fed3976e6923a4b285b3a6bae21242f475cc960e2ae33e6c0cfaee97358840bd1e70fd9257e6fb922cf414235aba3
SSDEEP 24576:EG88u8FpJqH1vzria7/mMm2kxUlYtEjedEeQ16ywqmpv:37ZFPqVya7/auYtO2E8ywqev
TLSH
T18335016576E101F0E47BD13889828663F2B2B8251364EBDF07A88B551F336E54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 31a00d0671b08ea1d2833c7dfc9650747505092ef2a2663f4ed11a74d55e49ef
MD5 6c5d6e951021f774d9711d4c424eb701
SHA1 d2b80e1d65623e5bc8024c98611dddb22b2be674
SHA512 34eccfff2ed7763b3b5716300643167e174aa29334990707d0acecca9e0bf64a553046d19f8fee60e7a59a7b61aedd2a619cec49dd485e338c25df0fa06afae7
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTuYtO2E8ywqev:gG05lO43bguFJ8yHe
TLSH
T120D5C06A62EC11F9D1BBD17CD9C6860BEBB23825033456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 908c93739b4f0429ceb9cea187cb4aae63dc10917524142574eb940ca32da674
MD5 c7b5e8746d65e35691fc42f253de9470
SHA1 d491f5dc46e0c24928467b77b6061c2ad721451b
SHA512 8c1d4d2d6b6105f4f5d1ab9e44c2a2bddd9e1a2ae35594f5a3e759756a466c76cc36cd6f52d45a460d4c2f16bcf31e28cecc21f594a92e5a2f6211041bef5531
SSDEEP 24576:Ofa5POZ3dpyWVM50JicR2hG0lasx2+47eidnOm2kxUlYtEjedEeQ16ywqmpv:Wa5POZ3lJt2pasx2+m7uYtO2E8ywqev
TLSH
T11C65BF5EA6FC01D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1b394d7457a22338f5636a6f58199940f132e16f150933debc3a55b9ee859719
MD5 5f01326c3161ae8409a3bb6b249b03aa
SHA1 dc2f073e853cf6f4c113ae31f82fb61270bf8330
SHA512 8c4b0436b472e3a62ae7af46598995ccf28df7b46524fcd9408f10fcc8973e74c4397036950d0cbd83a767d42cfdb37bb70fe875fa1a21d1cd742d0ad3e9c217
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7Fk0m2kxUlYtEjedEeQ16ywqmpv:nNc/zEOVHF6uYtO2E8ywqev
TLSH
T182857B5622E901E4F1BBE1BE89779546FAB17869133486CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 751c691947fc94cde514e6e9fc368323aa3284d6db723eb7fe1ad1c3dd16c499
MD5 7c80710bac3703c1fe95aaf12bc06370
SHA1 3e070c540434048408f8c122cae2cc10db288ab3
SHA512 848f0eafb1e23127ce6c1342a9fb60085bd67b1c73ed5fa0a37c4735d837dd7e696f233ef295ac636634442010df7703d0777a1da6d81d9680775f0bb7652b97
SSDEEP 24576:PzkNvNnaFeYhJNtmZBm6m2kxUlYtEjedEeQ16ywqmpv:PzMwBtOmNuYtO2E8ywqev
TLSH
T1C355AF6EB6B806E4E1FEC6748D238512E6727461173293CB5390C13F0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 509d175cbfaeb812ff9c62fa8369d24fd94c9e8678c86411480244379529e189
MD5 b5e599d054deddbb0e8c1a316fe7946b
SHA1 5214738b7862beb8ae48980ea083392cadb9e13e
SHA512 c541997ba0a7171860d7c1658b17003b3cacc8011736bf485ffca836ce1c4c6e170f6bf4bce574bdfc28496213bdfed97aee04212355d233acf1fef14268c561
SSDEEP 12288:YHvUrBFrEjwaQotAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzD:YPUr+NQgm2kxUlYtEjedEeQ16ywqmpv
TLSH
T12505E15F62AD18E5F676E13C85828719E372B8621351D2CF02E1817E4E779E8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 d4bbc7d91bbb25a62a0b13ee4446c4c3b3c5e62a7de325cb057b729e629e6809
MD5 7e1f052c1076bea94fea1168f3f2878f
SHA1 b629ada9126dda4c80fc797ba5dbd200b4fa788a
SHA512 16041c018a79632f18f96793bfcaf788bdc1b8e1946a75cace8a3be1378e1a7c08b6ef74b435b985f1193bb818c41ce1e59eb12eca4913d00dedf673e872b2c8
SSDEEP 24576:VD3FHshBIYQgAFm2kxUlYtEjedEeQ16ywqmpv:VDVHeBIAAwuYtO2E8ywqev
TLSH
T1A225E17EE65C04E4E57AD1BCD6A38A06E37138AD032156CB02D4C1BA5F6BEE46D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/964-119-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/964-113-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/964-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/964-121-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1884-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1884-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1884-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1884-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2068-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2068-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2068-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2068-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2068-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2756-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/2756-1-0x00000000022A0000-0x0000000002307000-memory.dmp

Download

memory/2756-8-0x00000000022A0000-0x0000000002307000-memory.dmp

Download

memory/2756-77-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/2992-138-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2992-127-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2992-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2992-133-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2992-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3152-67-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3152-73-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3152-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3152-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3392-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3392-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3392-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3392-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3392-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4216-55-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4216-61-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4216-293-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4216-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4428-13-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4428-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4428-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4428-22-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/5408-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5408-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5408-79-0x00000000005C0000-0x0000000000627000-memory.dmp

Download

memory/5408-84-0x00000000005C0000-0x0000000000627000-memory.dmp

Download

memory/5572-122-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5572-107-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5572-312-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5572-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5968-90-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5968-96-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5968-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5968-326-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5968-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5968-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download