34de7ebdaa81c38e846fce1a14c25d418d736646c231a882fcc13f4411e801ea

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Size 7.7MB
Sample260730-wnanvsej21
SHA256 34de7ebdaa81c38e846fce1a14c25d418d736646c231a882fcc13f4411e801ea
MD5 25109252793461ba704d3f59c6f49fc1
SHA1 6525fa56e45194a18b14db0f3a2c540dfdfc1b17
SHA512 a6a26748a0453902d25fcdc841bf6d594ce2bb30d4c1b112de9a0ffa66ad4d650477fc80e806d633ce0b16a0d1c734d030bb81d413c62d32638b29e8c77733ab
SSDEEP 196608:VYnJNM0kRMIQ4B0N6EvjG0CUw53kxs2XRHlc4u2lcIW6YplTl0RQk:VYjWMIizvqkwBEsQlc4uSfW6ETl0d
TLSH
T114863302BEDB9431F5FA1FB088608BDA9B3ABE305835806F7F9D015A7C655C49A79343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5376	elevation_service.exe
2796	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2320	elevation_service.exe
4548	maintenanceservice.exe
4872	OSE.EXE
612	PerceptionSimulationService.exe
4828	perfhost.exe
5000	ReFsDedupSvc.exe
3564	SensorDataService.exe
4612	ssh-agent.exe
3404	AgentService.exe
2468	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2c91b827238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070a34ecd4d20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001c0291cd4d20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070dbfbcb4d20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb6480cb4d20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055c002cc4d20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006eab150a4e20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000812ececb4d20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
2320	elevation_service.exe
2320	elevation_service.exe
2320	elevation_service.exe
2320	elevation_service.exe
2320	elevation_service.exe
2320	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4428	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	5000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5000	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3404	AgentService.exe
Token: 33	2468	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2468	SearchIndexer.exe
Token: SeDebugPrivilege	5376	elevation_service.exe
Token: SeDebugPrivilege	2320	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 2796	4428	2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe	89
PID 2468 wrote to memory of 4636	2468	SearchIndexer.exe	101
PID 2468 wrote to memory of 460	2468	SearchIndexer.exe	102
PID 2468 wrote to memory of 4880	2468	SearchIndexer.exe	103
PID 2468 wrote to memory of 1040	2468	SearchIndexer.exe	104
PID 2468 wrote to memory of 5920	2468	SearchIndexer.exe	106
PID 2468 wrote to memory of 5472	2468	SearchIndexer.exe	107
PID 2468 wrote to memory of 4248	2468	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Temp\e594898\2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
  run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4548

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4872

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:612

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4828

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3564

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4636
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2792 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2788 2936 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2792 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2788 2936 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f02979f848187b1670c1daf948e79faa072673ef1f7533c6223bd10f3e04f16f
MD5 00ee0c5c5cb5573e7849ecc21044d6d8
SHA1 ba3e9cfbcd578986adcc10ee6d743fa457138fe3
SHA512 aef0bb40c3c367cf45585b82aff959dba78164e09ef2f4b2c5ae231f9dc64a64455ae6d759a7e4a4172ac24f503b0cf99d3d9d1a2fe52605939aa4d40a47b578
SSDEEP 49152:9b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnm95MdTAcQQfjP+:D3q6HjBb0xTQWj
TLSH
T13FD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ba8809addd3968615b48b884bc5dcd4c89d7dba5c2de30ae0144f1f3abb3ca45
MD5 07788829689015f107cde9d9be440f54
SHA1 83fe83c31db17ffd2d06838bf4ddce3b1e0dded1
SHA512 1cd8ff6338dc0290e24fe73af67564e5e1a824350eddc323e1a66dd1f9c615fd81d7edb9808a457936bb9fa8e435db7e92ae2eb2517e24fdc717f2323481fcdd
SSDEEP 24576:LXYfDtczA5N94AMdTEvcQFuOjOP95Xdt5c:OtcM95MdTAcQQfjP+
TLSH
T15965F12877D908F9ED678278CCA18511EA33BC514760E78B03E48A6A0F337D49E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 818e1aef47d5d576057af05a47e2c2204a043d841ffa9b897cc988ed8a76ae02
MD5 eb5e33e136e4ee54ff2a755114254ff6
SHA1 4cf71bf189c1ed358ef2a6d2439b35ceea51f6c0
SHA512 30274922acfe36e1748bd72e7cc17d56f56a168ce998c0d922771e1b575b2e314f5445f4c68fca5339ba4c21157bbbf693d117697babb0cbdd18271ee93c0d26
SSDEEP 24576:20Le5ji0hmxirMWN94AMdTEvcQFuOjOP95Xdt5c:2Pji0Acx95MdTAcQQfjP+
TLSH
T1F2859E15F6788335D073C0B9C5D2A69EED7230825B308ACB4286D77C6E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9ae1695a96522939f6948b0d8d32e422f42bb43da4fed72c79ae01fa01a11fd5
MD5 e6f720a0ea6130fc1099cb7bd43aea61
SHA1 e2dcc49eb9852746bebed5e63d64234fff933927
SHA512 1c58a96e36fa27f38ff22ff0f0d74d9ae3eab87d71b056fe0d6bb08df44160f6b5363b4b7e83dfa4fa353958af4dce0c2d3d9d68046f114abbb70f7060971fb6
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWE6q8wyukN94AMdTEvcQFuOjOP95Xdt5c:v/ezSC6vUzPvxHjy195MdTAcQQfjP+
TLSH
T170755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3435d90178daa24bd9de273fb7c2f12093284252fef11509c7fffa8c90b3f1fa
MD5 39ca7ee51fd24f007750488b0fa62bd7
SHA1 9987894b2102737f260c84a28b4764dfc63869e6
SHA512 ef68d2594399d0b4ac1da79c99786800be78f217c9336c42556542db22a37bc9361ba55397aa0d58985acfd4639b8a163a630774208a3eeb052c22925ce5251a
SSDEEP 24576:fVbqPb88hv/l+69N94AMdTEvcQFuOjOP95Xdt5c:fVO88hXl+y95MdTAcQQfjP+
TLSH
T176559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 18367f95095500a079cf4493ae452457619437e106ce1003dba903c8da9a91f3
MD5 80f88d96de21c2b89c0a8a782b7a95a9
SHA1 55e53131db728da0dca10eb2fee98c857e1989e8
SHA512 dd379e84913e210504b124593a4dfb54a1f606b7430c1c7d7f16b95e4fd7df1db9202dfeeb4a2827c6ff0be0d526c55a9dbc2f41a29fd094deaa6d2a2d3aac2c
SSDEEP 12288:ERM1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:ERaN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1164523643F8D90BBF3EB197058F8C0786C0A9F518E41964F57935FAE89389C2D6E102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 818f78b73d60f09191c53dd661b4d56f275f6b962730c200d475ea87d47271cd
MD5 1ed0809efeaae6b1fb7967e058fa65a4
SHA1 5e8c0696789c655686142028a3670ac067e43b65
SHA512 e1d6c672ce4fb7ce2519572d35e754747d110cb57d8b389c46ccd6d79f35f7926dc4a2e645da4adb1968366f2f86ce1bd29b920fa68f81e230e7890c51463a69
SSDEEP 12288:2eBNUbTVO86U31qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:2JIUFN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T10E65CF3BAE28FCE2C27A4DB85A91C240E77278714F52A3CBD165830EDE235D15EB5C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 76ae4d1b4c5f2408097d05ce4307d0dbf593a7002326120ffd29265008606b65
MD5 5a3b44348f965f73be1d1e96cd7b5b41
SHA1 e817573b089f192c436ae19ed2ad8f483d645b46
SHA512 655aacebe399463d046b289456e301a2f5b3345be83cb6b27edeefd24966b479d38ab7aa105b8461b9f726059eb55b747bca1dd513964a0161206b35aad89e09
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THt:QQvGAdlCEL8c/yRNw5Cs0xTQWj
TLSH
T1CA266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ec210821a2105b275e098f8ff0b0ae65e6d7f86e7f96f07dedd25ea844ad1703
MD5 705f1ff1208bb479c86aac0a2fa01819
SHA1 138f29dcde3256a7f1d9fa05b2d8347f671cf174
SHA512 b72117189b6f9021252bb97d90e038ef118bdb0438c284926d6c1e900df020895dd7121a0ab89de6ed3a57e8ff3b9b927113f943beb345d31840239f18735538
SSDEEP 24576:qdewsAjDN94AMdTEvcQFuOjOP95Xdt5c:aljB95MdTAcQQfjP+
TLSH
T1A675E031FE74E036C2BB0DB21B75C716582D7A204F511AC3E3E88E9E59342D267B6A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d47577f419689def5584eb46f423ce3be5ef13c25e8e44d9cba561691df4a2bd
MD5 88f913a1d631ac5468d1cfcd3bed99fd
SHA1 032ba97f68a73955131b01a5ed6b1c375438d788
SHA512 14a7feab16e7dc9849c29b5fcb9edd0a029e355246a2e10fd3aa10e2e9a4a72921a72e3ee542342615e358689e8061110f21fc489fe858d6100f63a5bf659894
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHp0RQk:mUEtQevvqc2W1cpV2EI32p0d
TLSH
T157474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4674c6586e8ff2d9a0ad1afedc5ce72d365d36fbe05d1fea495179674a6aff75
MD5 91a2755a26e09ec4516530f4febf6c32
SHA1 f7fe4cd6ef482d4eb534474f17dc4f3586e24ba8
SHA512 235efff0d9fdfb2f29e61e27cd0350a5886c7b1d1b71561b89d47f2ad0fd1f17888b98ec7ce5ebb62be533e955c3c97bb02a4d4361c6b04d12b45fe2748ceeed
SSDEEP 49152:gCbRquA/m2yL5zTfFiV+XenmE3/zh95MdTAcQQfjP+:poquVjnmQ0xTQWj
TLSH
T1F2D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 344c6eba646c8bb90b2544deb056be42c120a25b067e1c460d52ae2032bfc972
MD5 795e891527944092cb5a3a2070f25b19
SHA1 b7165425b91353354d5cb6e951526a92a7ca5298
SHA512 79224accdef4a622933ad806ff51a03dd0d4ac8b2c4bc58ab4dd4b7d618d48d2825873d195f5d0f22fba261ffa52aaf9ae6ba634267ab38fa95211e249e18a61
SSDEEP 24576:JAhGLJIFoiwtA5l7S53AN94AMdTEvcQFuOjOP95Xdt5c:JAMyFoiq5g95MdTAcQQfjP+
TLSH
T1B6359D81EBF955D4F5B3AAB899B68171EA76BCA65E31C20F2150D11F0E33E809D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5c38c35a9500285ff6b55f29824573ba9e8c6bb75cdcb2af2c70063642efc6b7
MD5 15d8aa09820ba2ff0407ac83cd057daf
SHA1 76f4708fea4371a651167af38b979f3faaf17108
SHA512 d5f91a68d5aa4911e00f10f2a4caaef52ef62c724a7ccc58056784752f627957353491e668718179e69bbdcf770c807f18ae23be781b00cc6aa340c67beb31df
SSDEEP 12288:qmw5HEjsChNVBFgl0WDm+Ca1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTC:jwuoOWfN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T15A65F14937D90CF9E9A786388597C136FBB2BC022A21D71F17A0C65F5F37261AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b9619a0a6738545f2261de6a0c6942ee80aa62f1667a1774082267ccdafa7909
MD5 340aee73bd70cc45f80863b31d2980f5
SHA1 1559db8f07d36af709c0f0d51405647b2a36d0da
SHA512 6b899a8bf98fb39b33f275100d21e1fb11cc351a4fa14f61bbe2f7283986e156d45a88c65c64c9b6de29b769a3497de05aa3f51860a911da27ace01e5f7c1564
SSDEEP 12288:qBZ1IyR1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:kZueN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1F15512593BDC60FAE1A75278C8E48215EB727D525B3243CF136146AE1F32AC29E75332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1cef3be675d7457d000071f73bbda30cff5d74a9e17063190dfbfdfad3bb5da7
MD5 3209bcd54171da567669b8020de6a36a
SHA1 f0522ff1132d618bd6411f6527c2b0e15f98289b
SHA512 24f54b296adf2f2a79e1c1d6c49ed6c9d6902666c33a7f01276588e5de16212862d69350c3fc7c226cfc125946abe347f7fcde26ea26638562bb45ce211ac7fc
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:wQRQyi36YOcPQLvw2gAf+PN3H0xTQWj
TLSH
T101667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c243359868f8b94b8c985796e946656e4769a7d97ce5bed256cc72934ec71aef
MD5 900ccd7f780db6faccdcdb8ec5e86924
SHA1 9b5a34ccdbafc96c13d05cc330f35a39f6245318
SHA512 d53ce60b07a53a0f445ba124f0f19d039609b9d6aca6d4e75638f2dec824943fdccbab0ded6e78bd91112ffd1f397ba965727ebacee6d1398a8b872cb886beb0
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:RQRQyi36YOcPQLvw2gAf+PN3H0xTQWj
TLSH
T171667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6aaeaf4eb0cea43943b19beb143420a4c7a41ad5b6e168914473e0accfaac418
MD5 3d9b339858a0f4d2f083833ee4a163c1
SHA1 97d063a13883401792775757fc72fe7866bcf1ce
SHA512 50fb0ac7b58d05a3d88f7a029cf2b6e46bd8ddb71dcfa8430f1650d5cdf16d723dde224f5f6f91d2868430eb59f57874497c0101f893e986d00818130533514b
SSDEEP 49152:D68Qg55nhheWu7PNU3/x95MdTAcQQfjP+:9thWRc/x0xTQWj
TLSH
T131B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9a97042e1d8bfa797234cfe4dcf3734747cb28e0d4b8a590d39b020ea6b2076c
MD5 f2fa693e765c37341a24afd9b5c52570
SHA1 674d2e8dfa2d4ac3739010b67fbbc5caa887b88b
SHA512 568d7a99ac0a94dd4e2f7b18c801fcf9eb1cac8458933a9124fd50520ecae2d0144eaae3a313b5a9991c39dc3ef6b466191a6705ac0c4545f341d806276895f0
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:fy5112gYy5azzVvL69nLKnhZa0xTQWj
TLSH
T16C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ed317b146ff70c0234c7c762a3edd20064ddf0f038c36a333e6c10376df314d6
MD5 ebefe277ed156708195cbf75995b343f
SHA1 69b80d707f16cba9b56f10e29eb1b5e071ede12e
SHA512 cf0367829078023e637fc400df3d3fb1b9bbfb8ad7efd89e21b17b4fdc93b4fbc6c5be405f3895c1fea4237f5fd018bf7b32e86508c52bd67b9649a9918db049
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl/95MdTAcQQfjP+:Uu6JmVxd2d/0xTQWj
TLSH
T180D59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0b005cef7319c2b1f5d33940909f2ef928a98c7d5b0de725e1e0047cd6b7b349
MD5 a42ddc1f9773832f8f374e20bdb7c0a9
SHA1 5d38a3f5925d60e66626f8ddc10ff0edf018be67
SHA512 b8a11ba081918e47dd1422a5d836d89ee35e0408235831d5614fa3afbca5389eeb09b18556d4d8f7307c72ff9dbbfe42f9373ef22c0681ce150f797c9b3efb91
SSDEEP 49152:Z1hpsNoJpF1A6UU44CwH7R4xD95MdTAcQQfjP+:ZmifPbRQ0xTQWj
TLSH
T1B6B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2c2fef3a1df69c76ea543dfe3c82f481fb8275ff0ec6d7290f0bdc58d33bcef4
MD5 8078c06db96a8acca1b1331ef27ab151
SHA1 b866818fbac0052febbf1bc5394f39a34ae94c40
SHA512 83d608fb28e98404b9d9155b7fcf2d1e9b80214c8afd0424837aa5be1c262cdf8ec2ece015b9d8184279575b9557e03f057a1bb5b683ef3d7147ff89a7ffd37b
SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHq295MdTAcQQfjP+:X5dKTi6120xTQWj
TLSH
T1E2C5BE13F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 885fa8e939e8935c6a4a6c0bcd35fd7aa5851eff1be3d87657b95093fc7f7abb
MD5 2e224cbfd12733f4878648de4bc20256
SHA1 ded47818325d3f0143c937f918ec2e60bb02d6d9
SHA512 28c3213a21ded88bd3d2fb15c149f157414e0d71b8d5847f4d2bc10dfeaee6ef4a04d6c8aec85456a1e080386c001beca65d845b71534624d9a24b2d5cb66187
SSDEEP 49152:vhtSn8EApI0figngiDn0AP5wP95MdTAcQQfjP+:+X2iyphU0xTQWj
TLSH
T1E195BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 db4da87b50c4d14b938347f2f6c1f61cf12217c0746437108a12ab3854eac58a
MD5 dbe9cdd05b2a7efe4d476bbf9d8927a7
SHA1 27fd4ccfc6f3c44a135def2fccb7d34898bd8461
SHA512 a82a7b477e8b73a79429c84a41680bd0cd689edaaab2a3f35990701fae12811beb8b6337ad3764d0471dd882e0f71de252b489a5146d79dab44f8f6b8e21142a
SSDEEP 12288:6k1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:6CN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D94523583FCE81BFF28755B088E48168AC0E5F47DF02528F67D74A6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0e69e895aec7207c35b42e072d9c1fbfd6e183b3600d35e53eef461de9244bb7
MD5 f17ac5742f0b0dd70b2d1952f6439601
SHA1 5557bb5cf6e6e7f7abc361887bf7bb8cde99dd1e
SHA512 9b95e23a82e42323781f8f8de2370015e3f9b4422d5a0bef89a6d5bc18f0fc66ec3bc44bffd8fdc13e68d7ae1f53ce72041fb9eb0ec54fd117f28edae323947b
SSDEEP 12288:F11qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:FXN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1DF4523643F8E81BFF28755B088E48168AC0E5F47DF02528F67D74E6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 576022ab308add6d7692cd3aa3b39111579be1d2a716054b3b1900526fce3613
MD5 46b242e25ac72f7b05400d10a174a77d
SHA1 a5cafd9047a658b559351194b2a6e42f7687de55
SHA512 213005a64073393c60cfa9c3fba090140077e2da2339465ed07cb0b40ea42c740a8faab866d4f459c7e64bd3ab0beea1b7dea65528943f05018e463f5fff75a4
SSDEEP 12288:nv1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:nNN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1E74523543F8F81BFF18659B088E481A8AC0E5F47DF02528F67D74A6E8E359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 bae36cfb52134157a71657d385ec35d35bb15df577abac891b470cd4aea3fe5d
MD5 9da4078f55bccb8d6b58d107ff1d831d
SHA1 5490e19ee86c52b34fb31feab8e8b5f77fec58ce
SHA512 2ba654f0e23cd9a6881dadc68574ca057efa6445a17309a40c08d1a2242cc8f2ac5f65f7fdfe74d4798e6513d9abc4a3b737deb3ddbaf450b357b2d6dcde3deb
SSDEEP 12288:2VG1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:bN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B44523543F8E41EAF5A796B0C8F48164ED6ABF929F12938F57420A6E0E317C1D9F0069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 22320996e74779ac504af1df88c88f30bf3a40b78fd696833a6e6e7dd4f5b6b5
MD5 05d31d3fcc7c5cc91542a7399763c0ac
SHA1 df64dc1947cc338ab902dbdf7eb3cecac27516cb
SHA512 c8905b34bca2064db9de04b8f950a5f8fa0d5bfe61a9c8bf21a2439d81340c2c36e42e2d2e3f4861b290e7275b7d41993459c81ea6b44a65db867f2618f6fcf7
SSDEEP 12288:OO1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:O4N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1CF4523543F8E81BFF18759B088E481B8AC0E5F47DF02528F67D74A6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d0cdda4c118878b6bb35a066304daad6d22b97f5ae2945d902e5c8d4cb96dcfc
MD5 7976d71925cf40ca54f0b7f2bd903471
SHA1 1947af503fd366fdff00d163af8f5088da925119
SHA512 83d2b4f115e91b46af7e5c3d146e95e481f3e732776e8d9fdea83695a46c2c020904b215fa98c76a541a7035edf40102a5c357c3d50b578ba03baf4bf18fa61b
SSDEEP 12288:X51qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:XrN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A44523583FCE81BFF28755B088E48168AC0E5F57DF02528F67D74A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2ea32357542e7eb67f533a253fdbc7d06c2dd086d3b7b35eae44b62c4003c27b
MD5 b3a7044c8c7e4b7a1b77a2333fc69189
SHA1 dd33db1048777fad699bbe8fc469407434ee5520
SHA512 5f95fd81aa3332f239de81603f17bace68fb9839471265e98cfcf1b0485887a1bef30bfd3b13d63b7113ecf2db9d830635e891cbd624d3e0998c1a8e4de37c33
SSDEEP 12288:pd1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:pvN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1924523583F8E81BFF28755B088E48178AC0E5F47DF02928F67974A6E8A359C2D5E107D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 af84cd6d6050ff22f044c5023c6bf8789d6efb71b66cd6a19cc7bb4d8e56876f
MD5 bc1c9dcde7c7462d4d7bbbabbfc38490
SHA1 1a424413339650708f9cd0707e03c2d06b74efb0
SHA512 fdfcf97545ac9a4a0d9aae9e0fec3cb3cfad3461db2c3fa06521451082084880e4a047ac9e3837d6be235457d09388ac8e8b90dfe216d24a5a1c849242d93c2f
SSDEEP 24576:nZMSzFVSO3N94AMdTEvcQFuOjOP95Xdt5c:nZMSzfJ95MdTAcQQfjP+
TLSH
T1EC650294739418F8ECA7813ACC658915D6B27C5A0B60C60F03E4366B5F333E15D7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e26d57290a9e6844d4e916970283c0093d36bc380c0e3a55bfde1ee026fc3cf7
MD5 1433fc2507a32bd4733838c18714a3ad
SHA1 8d8ec55dbb897575fc3c713e0edd2d72cdf31ec8
SHA512 9220fd0d531ab392ea6b7241161013ebabb051af77d4dc4d08baf7ad056a445ca8cd780da4704df79a70a453991cc4fe09b085c687aaed7428ffde0c72a546c8
SSDEEP 12288:eA1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:eON94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1DC4523583F8E81BFF28715B088E48168AC0E5F47DF02528F67D74A6E8E359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 630ea19f7a30ee567b6d848e28867a172fe73436c685f15280e5738f7b7477e7
MD5 be362535ec220617d90d879a50ee0caf
SHA1 7e2a98904666a57190e4bbe53cada182654bd9a9
SHA512 af0d746dfcc14e32c1067a6f889559f3c9ab654efd1251641b455f0feb5ad13a977a223c2fd6032a0ff6f6d70fe17fb2d62d69e2b15032b1a42cb6b7b077c509
SSDEEP 12288:I81qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:IKN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A34523583F8E81BFF29755B088E48168AC0E5F47DF02528F67974A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a35ded60754adb7f0629da2cc4a577b9e26a950c8745a97f381a92dc93b33a2c
MD5 f5778d261e96272bc66a6b5a1ad8ea38
SHA1 889ef7eb3255f423b7942f69265ad674571290be
SHA512 e389af677da4b9a37f7566c78c6331343c15a5fba426343444691bde125493e4f6e8f8c94520cb998ba8bdc4b3774639490d5fe09e69f0ccf79e94848faeab0d
SSDEEP 12288:nyPz5L8R1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:KzyzN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D2550217379A20FDE1679234C8A14615FB76BD324B208A9F13A0077A1F376D19EBA770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 eedbbd6ca4be8e81784b96d35a7bf05fa3a7928779a0757de141997c173367d9
MD5 dd614650dce719afcddf675274e469ae
SHA1 1e218aea5480abe9139a2decc8658c82a1f0e256
SHA512 e8ac45e0172f623fee25dd0a1c7fc3e4d8b4170a6b9789578d714841706364bd8b0c6683f2b9579667baac79365232c31304223fbab1e880d8e9650e8b8a3036
SSDEEP 12288:pA1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:pON94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A54523583F8E81BFF28715B088E48178AC0E5F47DF02528F67D74A6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d156f0a9e2f8d7152908743f6b6b53572477b521cc10fc94065e9287a942a319
MD5 87ffe153d6585e487c7519b8434cca14
SHA1 9f774b1590816fd43c54be3a69d4c0cd4f79429a
SHA512 62653f88e44de95aab2cb5aaf56172640a75228ac6bbcac81544c197a1dd6c23763513148016ff105f9faafae734f6320a1db3810930f31f86fa246e6b5168dd
SSDEEP 12288:fA1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:fON94AMdTEvcQFuOjOP95Xdt5c
TLSH
T15F4523583F8E81BFF29615B088E48178AC0E5F47DF02528F67D74A6E8E359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 bc02a22e57c9b083e9d4b748b0a9d0ee074bf472af99d10e170cd2c191f323e5
MD5 af4986c1df7276d42e5b38986c6c9a87
SHA1 7c559cf39b31f8d207726a37e7798bc78b7daa9c
SHA512 203a5055d8698ae83e5fb0a571325ae5f32f0bd42fc6b87dbfdf89559b59d317dda9e4f647263e7ea1bc64a377a4bcecaecf885efc779e78391c7aa6f6953796
SSDEEP 12288:ZyPz5L8R1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:YzyzN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T17F550217379A20FDE1679234C8A14615FB76BD324B208A9F13A0077A1F376D19EBA770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 04110376ef47868963b9157538c8e58537a5068042edd428229d2e76ee89a580
MD5 cef398d6a8755cc8511aec1ace14dc87
SHA1 30098a82254b5e317aceb239b4f87a08b1e606f7
SHA512 deadfa55d8f7e20f919d71ed7f2444cf83301858a35ce35bef2c356a32e552b5e00c48171161405b03e60877ebc0f42f788776dc28a06a9c849173124ca37d8d
SSDEEP 24576:3THaLl3z0zDdN94AMdTEvcQFuOjOP95Xdt5c:3T6Lljc95MdTAcQQfjP+
TLSH
T1E16502A4739418F8ECA7813ECC658516D6B27C5A0B60C60F03E4366B5F333A15D7DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 d95c828628631134031c0db751cb6b3d375c386ad9f56d74d20a22875543a43d
MD5 416480ec5af6d08ae79fa4e28297ed86
SHA1 2ae5af293c592ff6fceb6262972de93d0b618578
SHA512 4070f6740e25ebd0e18fbf8f098277ce9e07bffc5281b6b91cc4e06bca1f9808eff5c8086d0fc250887755c4658c9fd3eed90e0b811807dac7e7c25b29e834c7
SSDEEP 24576:+37d9CHKy7GZhN94AMdTEvcQFuOjOP95Xdt5c:A7d9CHKyaJ95MdTAcQQfjP+
TLSH
T17275CF90F7E810E8F0B79A35CD768511DA767C5A1B21DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ebdafa8f55634b7010f7ccfde6bd9ddee82f1fdd1cc0987ff635d2a1a12737d4
MD5 b98e9ca73f364fe7432ab15e8e4fc3d0
SHA1 4b76dcb13459b6b820b5a33a06dc49f32c5e94f9
SHA512 08b1099cc0ce0d19fed49829a14948d3fe9ef9a1c148573344f7feaba945827c1d30de46a5e56fae284694f5cede55e8b84f305824ec14079c81bbd99e0833da
SSDEEP 12288:7P1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:7tN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1BD4523543F8E81BFF28655B088E481B8AC0E5F47DF02528F67D74A6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c24d136a95efeccf4b1cd4422a4b0a9738ea258f37f2704cd0bc9b8af2129e10
MD5 62a5c9ab62ee09b5aca030d4f29c2ca6
SHA1 6b1605b0816f5fbe9065de079bc7dbf650e50f20
SHA512 fc9865d47c36734c20ec8190597166a52ac38f73ebdfb2dfbf7bc549e7c595b1bbf7280ea188f6fd5ae49a9f176f1f79c2b7667b5ebbdd191003c2fb803110e4
SSDEEP 12288:Ox1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:OTN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1C84523683F8E81BFF19B55B088F48164AC0E5F47DF02528F67D74A6E4A399C2C6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 24cd34d4bd3af321551a381e46de8f7ee169094100532da03089d0fa3aed4b69
MD5 97d513ed4efc59340eb1abd23b133f9e
SHA1 11b29cb462c07550ea64621a7e64a8d3188478fb
SHA512 82c493d613b6c79bc1d99a9724a88aeacecec42eac603f6c36339d42f6b5190282aeed4553a4a38ba308b9a6dc8a8fb97deaed100678167e661ddac191a3636b
SSDEEP 12288:+i1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:+cN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1394523543F8E81BFF18655B088E48178AC0E5F47DF02528F67D74A6E8E399C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b104f829133de00c6ce0200ce02e8aaf842e8b8e0f15c771e4af6de452073627
MD5 5b5170d474e363cd3eeb9cdbd331c8f3
SHA1 c71c98cbef09131d936eceea73503c0e027fd82b
SHA512 398a0bf3608ccab489735ce1a66e7757a143ca5805d25fe2caab28ebd7a4e1133fa727a2fae1674ad51e5d518e3082d7c43b9ea5e6ea9c5bcb5a9b60758486bc
SSDEEP 12288:qA1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:qON94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1DC4523583F8E81BFF28615B088E48168AC0E5F57DF02528F67D74A6E8E359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 c2f7eabda29548de0ef3b635a9219df5df68a21a7ee347c416fbd9a9001b625f
MD5 40cc5e7695e0fc9ca5a0d77ae833564d
SHA1 bfbd565c70a1fe5a276e2689d37c8341e58e71f3
SHA512 278c233bb4ef2bea9a9588f798fbe2964a46fbd011602c280a962c15ca2a00db850817f1ebd4a83822e16bd6f766aa2d8583099534565be66ee984bdae387b41
SSDEEP 12288:LP1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:LtN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1874523543F8E81BFF18659B088E481B8AC0E5F47DF02528F67D74A6E8E359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 520b4ddc55246e3ef8d4c1357247ca7f4217234f3c2db551204863a3fcee16d8
MD5 e32864c2a6d8a44a3abff7be20ceca4d
SHA1 4910ca6ed51e35c040eee872d5c4fc63ea34430b
SHA512 cb4637d8198497e4c6b0fb89bda5219800ba4edcabc8bc0bcc1d21eaa279b29b9ce1b0ae6728d60ae22600a5054593166f19206b511f0f212373001283ccfb96
SSDEEP 12288:5o1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:5mN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1EA4523683F8E81BFF28755B088E48174AC0E5F47DF02528F67974A6E8E359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 da5f33215ac34ac6eddef1e9840aee69f6b7ca591e6d38354a121c9391d31fc0
MD5 a07f2e8810d7a7e67e8ff5f002bd89f9
SHA1 40510ee714fb38c7e827371705d6f18d4c060cb4
SHA512 b4d0a553eaf1dff583553a2d891efeaeac53e46074a525d78533de2ae0e8cc425f7538ae441d2a007d712f77c51f959e2a090c0e3f7b10291b6e0a99b73e7acf
SSDEEP 12288:bO1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:b4N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T14B4523543F8E81BFF18655B088E481B8AC0E5F47DF02528F67D74A6E8E399C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 f772ed841fae2a592a5060666cb0ea18c1bc36874cddb3179110909fbbe74838
MD5 8a799dbb5e5a5435d1259b80ecd3f552
SHA1 5ef2a9e1cc48793e7969d69c9ec94d9ef20ed38b
SHA512 89c56101d505511d05ab3b2bd92ff9a3d270078c6fe23d207f057c17f163689d8161cc27ec2a4ea41355004b022110730846f07c0d2bc26b52b9571305cbfef0
SSDEEP 12288:2n1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:21N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T17C4523683F8E81BFF28755B088E48174AC0E5F47DF02528F67974E6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 9d3fe3fcdaae4fb360dc419e82aec5dfba9a90636da8306092b07699728b05b7
MD5 f951c34a0b0c65201d443960d7d7a7f4
SHA1 60570a922c576fc21ca2a534569e6a46d4614464
SHA512 fce09ff525c8d36bbdcc9a7bc47a9349e84f5fb400da3617b7db58e42bc8a884a962998cd2ce89c1fdaac1f26682f5763133f0eff14188ca305ef3d80d0755b2
SSDEEP 24576:Ifwvok9RX6wkyAI6N94AMdTEvcQFuOjOP95Xdt5c:wMnYI695MdTAcQQfjP+
TLSH
T19585CF29EBDC44E5E1B7923C89B7460AF6B178591B31C2CF129A53AD0E37ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bfb4c2d049d48b47e03a10ea4c7774b6119c175c05078c2baa434ed1cbdfe4ea
MD5 7c78d9dacb0e6b301d3800aaac538701
SHA1 58e8462145c47a347ad859df9bb60663371edc58
SHA512 b4899522a9614473e20c2dcb330802ba9d6c6161673e3533617b75b670bf5c3118f5b5875006ab8cb5901c2732fed1ef183e2aad1e964617fca9a2586539895a
SSDEEP 49152:ZYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0v95MdTAcQQfjG:BySzPn0xTQWj
TLSH
T14F067C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1c0415d45f15c0398d8b463cb978186fb270e9e5e4e7a55d9d754d4d108d6bc0
MD5 c6fcee7123d7b58fbde49bcf45ce7fc9
SHA1 57ce4d602fa2c94190029d7f8ee1c88387a66c28
SHA512 1f0686c824069c8bf6cbbb8fd34cbbc30eeafb6370a22ef12976fa47c4c0bf6ae62cd56313b8f31100cb12148b8068573bd7f9d2db4e8e0ea9f177191936abcb
SSDEEP 24576:D47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYnN94AMdTEvcQFuOjOP95Xdt5c:D47JUQj1irIhCnDHUPfF//95MdTAcQQq
TLSH
T18D65AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 33046b0af967fc2a849527d95903fe6e185bfe5ace4b160609109d0c4b2cde11
MD5 3c5541a5611ea43d61d8d2547c75a736
SHA1 98697ad92d7a7f036cccc79232ccb3963d55db76
SHA512 dc3ccd62fbb683c901d97b697598c43988fb4dabcf25d332d12942372448cacc3d2db2072c62f208f4c22d529ee4c4c7dc72e700b8ddb85f61783e310866cdd5
SSDEEP 12288:kNsfQ1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:1eN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A955F119E68802E9D0AE6271CB958640F7277D258BE1D3CB53D1F93E0F366C09DE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 ad0195f9de8b9382c46dd17e74f83a0cc21a1b76430e10d9e7cb1c64046b5bfe
MD5 18e8f024fc01eb2bcb5e15deb25f4b6e
SHA1 a1387c4019efed68be611a5c4b51cc804975f873
SHA512 f9c2826676c876adac177e439e3c0da54616ba0ca9972ff6a46f375609369f928905cee39108441fe1bb62a6cc4097f9ffe811c5c12de84e97e757d22f69935e
SSDEEP 12288:xajlS/y57UjltfcojjUfvzOkX+vPhqaRMswfFYTa:8M/CGltfcoSZX+XhqaRMsAiT
TLSH
T1DA452751766AD75FC6A940325E33D1CCAB707D01EE456B0373C88B3FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e1829d1697f4d3769f38a665565eea2e8f455017b6c2fc4f49f946523156b7d6
MD5 e034ba14d611c49936e931d79745d677
SHA1 b2e51bb5adf2264fab1c57fe5041dd80f2049806
SHA512 26db689a2109d72d8b5b539da9f14ffa4e49b0fe421be814e01119bc46199872b9f0ceab1ef6b28de9141eaa1c9e56a80f059c8a72038d19a39e468e535f9970
SSDEEP 12288:re58ALyjX3olCcvvJv6GnLdEbk9HKXZOrgcTk2qHIezS0pblzfOV637lU:1jX3olCct4OKlU
TLSH
T15065E8816137E39FD1FB5032072AAB4CAB64EC06B7056F26B3C8453AD866715B4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\e594898\2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Size 7.7MB
SHA256 34de7ebdaa81c38e846fce1a14c25d418d736646c231a882fcc13f4411e801ea
MD5 25109252793461ba704d3f59c6f49fc1
SHA1 6525fa56e45194a18b14db0f3a2c540dfdfc1b17
SHA512 a6a26748a0453902d25fcdc841bf6d594ce2bb30d4c1b112de9a0ffa66ad4d650477fc80e806d633ce0b16a0d1c734d030bb81d413c62d32638b29e8c77733ab
SSDEEP 196608:VYnJNM0kRMIQ4B0N6EvjG0CUw53kxs2XRHlc4u2lcIW6YplTl0RQk:VYjWMIizvqkwBEsQlc4uSfW6ETl0d
TLSH
T114863302BEDB9431F5FA1FB088608BDA9B3ABE305835806F7F9D015A7C655C49A79343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 de9115243accf3b09493254aab18c9441d2ef443149aa919a247ac36f708f5b2
MD5 9c46076f23ef6545895b8396e9c1cf33
SHA1 7c1f80ba6e280af52374cf50bf73a800c4d89de0
SHA512 d65ded4f11852f70fdabc427885ae502fcc666da691d16680b572cdb2bfbf0168d232ce79c9d7cefc5bbd83a5adba236669163476aaa152bf9e436cd53149e95
SSDEEP 12288:m0741qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:f2N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T13D4523253F8D956BF5BA56B048E8C1346C0EBF658F0191CFA7424BAE99349C1DEF102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e4e186fa61e19d21becc306e3454e809a4b16e26f010bcff8f0e2ec3dfea439d
MD5 78d35954c17a664b640cb69ae30f09cb
SHA1 53b5bd11abaec7cfa9b6b6ee7133c559478b6051
SHA512 324a1bdc1d5fdfcf4bea09c30c952ddaea9aedbae63b728258f671190588f9d53847ac4f654d446f47bc2b2042d38b4b15cd3775963a9d4e65810475cf4640b3
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYkN94AMdTEvcQFuOjOP95Xdt5c:ogb4mBIBhGFN95MdTAcQQfjP+
TLSH
T138659E1E22EC02F5E0FAD2B89DAA4417D6B278160731D2DF1251427D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 efcf2969de57729eee55fb8920e9c54f0999c30a64c33f52a4403a281047d922
MD5 fdd1695855373bf6282afa6b3535c9c5
SHA1 582f7ca8af2b2d9253c7aed7e4cf65fb5d3f1fb3
SHA512 285c5dc1f00f2a7f5c10c92508e0cfd0946df1054910cdd962507f92a3a5776ce811c0d69114681b7d230592324d43965aeb96ac48f2672baa3ba903463c08b9
SSDEEP 24576:QG88u8FpJqH1bzria7/m3N94AMdTEvcQFuOjOP95Xdt5c:D7ZFPqVea7/E95MdTAcQQfjP+
TLSH
T15685016577E501F1E47BD13889864663FAB2B8210360EBDF07A88B551F23BD14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a0ce729d6bb409c2cc2ae36184d368459782ddc4e8773e656b9723921a85cf4a
MD5 f5e6883681f27368a8c4b4535e273f0d
SHA1 6e83dfc1cdb52f391e8c87562094a0feb5b4047d
SHA512 bd0eafd6870798f0683eee5f03762800f2eb745ec6701fc849cbf1654efd5165407cb8408249d556c099f5134095efc55a841712a0551ac9ebb6229faa021676
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj595MdTAcQQfjP+:uG05lO43bC0xTQWj
TLSH
T120D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d77584f9091da05600048f45b161e43e928f571bfa2bb282896dbc01dc4dae01
MD5 a7f6449c1ef5126b7746186fe464fb63
SHA1 fc2f5023d0d16967c4c93b3f3812b2ae12a302ed
SHA512 bddd904a7d84cd78e91094fa8d543e7398b2a4fffd94d1113f45a92c2234a14e0c174e60a450fb9f2693a9d6af32773210589c5aee818eb1f61c765457470afb
SSDEEP 24576:Nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnZN94AMdTEvcQFuOjOP95Xdt5c:9a5POZ3+Jt2pasx2+mx95MdTAcQQfjP+
TLSH
T12365AF5DA6EC01D5D5B9D17DC583861AF5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8f30f1b428c20055ebbb8cfb6e4f7aa8db413c2280d1869cd4a73d2de242ac6b
MD5 75613d84a8f099d0575b217a7d5cfa93
SHA1 1039a809d5e2622d3338c310939ab6e2832b13f5
SHA512 b32d03d9ab77d109d70f8c94da6ba94c6892636e663463fae277ca62f88807f35b3f8f51fed13a135a2653c4994ede215eebbc14b97fbeba593d2ef5ce30ae89
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7Fk/N94AMdTEvcQFuOjOP95Xdt5c:gNc/zEOVHFk95MdTAcQQfjP+
TLSH
T113857B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 81e965037dec6ce1593f7522795c10426588796d46ee2374e34bb066bf1ca2e2
MD5 42a71af135548611f9dfd31c36c94738
SHA1 9b659c2fa5c62019c4ac605fea72b1b5611eff14
SHA512 f398f88a8f36be1fe3bedc14b22b4a2008cb87489e6d1f4f9f05fdc41e5264489b6c0f19bd8344dfe2f0895f50d90744eda321786bcb929cbb2a034184b0c290
SSDEEP 24576:Y8kNvNnaFeYhJNtmZBm1N94AMdTEvcQFuOjOP95Xdt5c:Y8MwBtOmz95MdTAcQQfjP+
TLSH
T1A455AF6E7AA846E4E1FEC6B4CD238512EA727861073293CB5390C13F4E279D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 cdeb860264a304a76f1cde60817958388725e5e352904fc442d2106880bc7159
MD5 a916eb5395efe338a83e8f7fba2d3ec0
SHA1 d6ba77cbb867b7f12992fcebafe8001c8ba2b031
SHA512 5a044a538f4f37fad370b58a491e8d50188a15d7b2028883326d968cde22ef762e3e35dbb929133566a2d51898860c30b3e355ece9ef7ee820163b5f0e4cb983
SSDEEP 24576:aPUr+NQbN94AMdTEvcQFuOjOP95Xdt5c:aJQJ95MdTAcQQfjP+
TLSH
T1D565E12E36DD18E5F676A17C89858219F772B8620712D2CF02E1817E4F37ED4BD39A24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e353600f5a2bdc736cd146cbf5f5975223f88466357b8811ef7f937ccefc2ee5
MD5 6d6d57b0a12df81a5d30d9626a0b4dc6
SHA1 1542c6c80740df31df54168c8f8290af3df7cee1
SHA512 2419271579584c18f478c202dd7f2acaaa7348447c3e777a5939002a70aefa3e082bafa5121f51f10c7f0b9cd29478a7385a3a8ac538bb1f87c0cba01b6ee221
SSDEEP 24576:AD3FHshBIYQgAiN94AMdTEvcQFuOjOP95Xdt5c:ADVHeBIAAS95MdTAcQQfjP+
TLSH
T1E875E17DEB9C00E4E57BD1BCCA638506E77138A9072256CB02D481BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/612-81-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/612-75-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/612-310-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/612-82-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2320-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2320-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2320-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2320-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2320-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2468-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2468-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2468-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2468-373-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2796-313-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/2796-33-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/2796-31-0x0000000002650000-0x00000000026B7000-memory.dmp

Download

memory/2796-26-0x0000000002650000-0x00000000026B7000-memory.dmp

Download

memory/3404-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3404-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3404-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3404-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3404-128-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3564-371-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3564-109-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3564-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3564-368-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3564-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4428-0-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/4428-1-0x00000000027B0000-0x0000000002817000-memory.dmp

Download

memory/4428-8-0x00000000027B0000-0x0000000002817000-memory.dmp

Download

memory/4428-323-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/4428-73-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/4548-60-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4548-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4548-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4548-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4548-47-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4612-122-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4612-372-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4612-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4612-116-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4828-86-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4828-315-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4872-69-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4872-295-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4872-62-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4872-63-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5000-385-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5000-386-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5000-97-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5000-370-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5000-91-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5000-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5376-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5376-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5376-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5376-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5376-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download