c0fa150682fd1326b113f652be9a44dd009674c4a70d3fc3fb0bea49090c4c2b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
Size 173KB
Sample260804-x2caaawvgv
SHA256 c0fa150682fd1326b113f652be9a44dd009674c4a70d3fc3fb0bea49090c4c2b
MD5 8d48fe47584c52878599dfea7727c87e
SHA1 42a2a7f111555adae6a258fcd56dfa21666ee1b7
SHA512 b48cf49aee4dfec6c77359c633f669bba8c3c1c863a3791093bf832e7ab9562f4091b79b68ebc4003a3115639f5de963a80e022a886525e6c18864385fce5534
SSDEEP 3072:QCSjGoLpWM6VsBEjxNZdoWr1Pg9uCRFRzsxeuPo10JOSdBkK:mXqoE3zPmRFJs0ug1MOc5
TLSH
T1AE046B21B6ACF372D0E255B48E5CF2E16D3D7E310F2548CB72981B9D9E722C19A38356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 3 IoCs

pid	Process
2460	Logo1_.exe
4320	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4364	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXEB6B.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe	Logo1_.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXD874.tmp	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe.Exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files\7-Zip\7z.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCXEB17.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
File created	C:\Windows\Logo1_.exe	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3308	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe
2460	Logo1_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 3992	4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe	87
PID 3992 wrote to memory of 4080	3992	net.exe	89
PID 4408 wrote to memory of 3308	4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe	90
PID 4408 wrote to memory of 2460	4408	2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe	91
PID 2460 wrote to memory of 4836	2460	Logo1_.exe	93
PID 3308 wrote to memory of 4320	3308	cmd.exe	95
PID 4836 wrote to memory of 624	4836	net.exe	96
PID 2460 wrote to memory of 2356	2460	Logo1_.exe	99
PID 2356 wrote to memory of 3512	2356	net.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a488D.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Users\Admin\AppData\Local\Temp\2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4320
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:624
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3512

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXE3BA.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXE3BA.tmp
Size 156KB
SHA256 07e6be2f3d0bfa5d4665cacfab1e9e21cd831665fdb70997464e958b05d5e45c
MD5 1b4b44c08b5bed3fc7e54de3252687d4
SHA1 4fe5936ab9fcc007557425e39730550859f4f641
SHA512 ad23251515a29479aa791fcdf01ba9288b45cb8843a17374cba87ca5b6b3e880dda64083ca9c505036b85d951c5c8c71032233499fe56191ee1910143896f48b
SSDEEP 1536:c7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx48SXzpn9t6kNL:1CSjGoLpWM6VsBEjx4Zdhx
TLSH
T1E6F3B36EB18FB3F6D3E159BC8D1CF295ED28FE20CE19285A75993B0EDA760C34508191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE64C.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXE64C.tmp
Size 94KB
SHA256 ac8f19f59c429094f4482d1eb0bd86e77bfc1efeb91f0fcd61982b84a10f4af4
MD5 fad88ce0b15269fc91e0e2e596a3d134
SHA1 a0d2a8a8e6dcfa51a649f07efdef99b2b140c72a
SHA512 ca4bbab92f035f4405c4c3b489047a9c6b2036d1d450e6504a06776122fa3131f316a7bf358a7be982a0d3f1528d56eb1a14d4c2dead62c67caa3ae88d5db192
SSDEEP 1536:h7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxn8SXzpn9t6PNb:ICSjGoLpWM6VsBEjxnZdWB
TLSH
T1CC93295AB18DB372D0E159BC8E0FF2E5BD397E201E1D189FB6992F0DDE76081190C295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE76C.tmp

Path C:\Program Files (x86)\Google\Update\RCXE76C.tmp
Size 90KB
SHA256 3cbcb2ca29259a7883d3bdd5d35eeb838fd77a94be13633418ea0b3cc60ad6fc
MD5 fcfa766fc91fd0364b363b13a18cc04c
SHA1 ba11fa8499cab8d60e718e19b7a8e6077f995c09
SHA512 804198d1b527db3e268015606927e3e3bc8a5045e29624b4b4f635710ed007d90b9101adf62580ba86d076399a38186b5635dba4d04322e30ceb0215a2a13d39
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx88SXzpn9t6ENr:wCSjGoLpWM6VsBEjx8ZdhR
TLSH
T19E935B6AB28DB376D0E299B88E0DF2E5BD397E300F19185FB59E2F0DDA760C1190C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe.Exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe
Size 3.3MB
SHA256 6b4abf3c0521e76557b28d7250b20fb897ab258d89ee712bc7a0796a615afbf1
MD5 ef06c8e91ec71167928d5d78d1b0255d
SHA1 35eb11eb1ef5ceaf68c629f61b8a41fe4b9378bb
SHA512 573c2a5fad8fabc7554dfb5ccf67dc14f71ddcb81207e11e43dd6f79c74d26e0141cb54dec9b1f75d3a2b36806dc798105f2b5f39d71f1dddb48023824a14edc
SSDEEP 49152:SglZ4ThD+gGTZbqZK95S4pTiX2EUqMzADxulO7Udq+KqOuBk7bVnU7wF62JtY0:Ws6Gwxul1EE4wsH
TLSH
T19DF53803E29D22D5D099C074CE4EA222EF627C8D47F562EF3290B6D52A77AD47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE82C.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE82C.tmp
Size 118KB
SHA256 517ede9eca34f0770e883234cfd669873d1c68011fc82001369eae1bed136619
MD5 065e22fada3c5bd44399f4b6a7841cf0
SHA1 b28fc7c9d31efd2ae624b6a1eca33fca8b3b85d9
SHA512 4a10b3f40a04235ebe7e0640fa548c8342f1ece7bf0cdc2f2b0c16a366acb4d38909de7cfc6447e3d7ed6602ec4bf707fda20614fdff69145caf96dbc010fb5f
SSDEEP 1536:s7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx88SXzpn9t6x4GZjzQwK5WW7VCnH:lCSjGoLpWM6VsBEjx8ZdQe5BV0/v
TLSH
T1CAC3AE6AB68CB376D0E299B84E0DF2E57D697E300E19085FB59E2F0DCA7B5C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe.Exe

Path C:\Program Files\7-Zip\7z.exe.Exe
Size 642KB
SHA256 fff4ef31023aacd037c325836e66bcf4da0506c27378e9f957a5b91a0d3f5022
MD5 3372a4b3e144eca5442dc7035391390b
SHA1 0a3531055bb03c2b05e051bc94e4900919516d44
SHA512 0b90a5ca87871b60e16bda56c3950a7d5bfa002098cce48fa1fb234bd210ac71954aba312f4e9864079318a125f4d370ebb2cdb705f95a7d55e9375f0de992cd
SSDEEP 6144:mXqoE3qXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ8F:eXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T18EE4F715F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe.Exe

Path C:\Program Files\7-Zip\7zG.exe.Exe
Size 783KB
SHA256 469696ee2230a4e5c312b2db2156b75a22fcd27c279ecd02d9674d71b7d2c3d8
MD5 294c894e0f78dcfa0c115faca2f50600
SHA1 a204ae8766b44b18eaaddb39a2893de89143a4b9
SHA512 f8ab81e977ae4c1d1e70fc930dfb5e395a97a3563a63e5b1bbc6f7a8c05d0a50c800df7d1f8e431f246e8de087b0880cb4727629a8e684c8cc1476a850b26d91
SSDEEP 12288:CVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:CVbqPb88hv/l+7
TLSH
T16405F765F56CB331D0F2C0B9C5DEB69AEE323C414B318ACB1246972C2E676D68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD7D6.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXD7D6.tmp
Size 91KB
SHA256 231294a16640c74c90781704d683a1d054c5f2332540e24a171bcfdd0e93fdb8
MD5 1f0ea8faaaa3b70a21b24c428283fdad
SHA1 4b0686b09fb2a2b233bf53519f2ea34ff0d6e386
SHA512 31feea71fe241733ed6585d67d12a925582737b8593557baf184d091cbc6d40a26f5156f20fe98d1a4b6277062768d3ed58f1e27f7b6136035195b0e1ac5499c
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxH8SXzpn9t6ZND:YCSjGoLpWM6VsBEjxHZd8p
TLSH
T1D5935C6AB29CB376D0E159B88E0DF2E5BD297E300F19185BB1AE3F1DDA771C1190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDAB4.tmp

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXDAB4.tmp
Size 91KB
SHA256 392a9c92bf181b428bd96225e09602bbc688816904584b427041553b64f50f59
MD5 629014b2847802c3c59b58cba895ac2f
SHA1 04ad17d6480b02e030a606fd52d39cc346beeab5
SHA512 24263b31dff2f4f84dd244e3353098b9d288eb88fc4bdd2b247c665e77b4e9a20b91a25e5cc28b03c8c52b6be52b71cde6f43f4d6ce32ec421add171ffe7a3ae
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxH8SXzpn9t6qND:QCSjGoLpWM6VsBEjxHZd7p
TLSH
T1A4935C59B29CB376D0E259B8CE0DF2E5BD297E700E1918AF71AE3F1DDA761C1190C281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDB38.tmp

Path C:\Program Files\Mozilla Firefox\uninstall\RCXDB38.tmp
Size 99KB
SHA256 9489354a843dd77a3efa5e548cc70569e4435e29a519807d5fc355d7ff5213da
MD5 5992a87492475a206a6f310189868091
SHA1 918a1f6d802ecd97a217aa4dd452e2eee21f4970
SHA512 f9e9bc92a742240ab606e2d422adabcbdf21c3b87a859a9f620b6116210f2acf71f6d95131adeabc5dc43b695a421f2e3cc2f505a342a8b0bf348411d527f1ac
SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxYq8SXzpn9t6eqkSZZZ38N7:4CSjGoLpWM6VsBEjxNZdJU8h
TLSH
T1A1A35C5AB69CB3B2D0F189B89D0DF3E5BD397E300E59185FB2AD3B1D9A77081190C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXF0A4.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXF0A4.tmp
Size 92KB
SHA256 75b089f7674d2672b4afbc301f1b87089240039e56baf9309f1291b37392a717
MD5 6693865e35f1160a40f435926652507c
SHA1 b6dfa11ab6da6f157a8b77669a01b526f269de6d
SHA512 c183e92391532399ef0f9fe6d6b85f40c7a302b3a4bc60d45356c2bdf836f99777c91dbeb2ea8a65a207675cdd63d6a83351e50b0756d4b464fa75abef378236
SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx/8SXzpn9t6CJNb:ACSjGoLpWM6VsBEjx/ZdDJB
TLSH
T153934B2AF29DB376D0E199B88E0DF1E5BD387E304E1A185FB69E2F0D9A770C1590C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a488D.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a488D.bat
Size 842B
SHA256 07a0d107efa7f9cf9a4fe21b9143b14df23e07c62a714023eb3b5bf356542225
MD5 cb99997af8789b00c9657ae8e64d19b1
SHA1 1df0ee9f0ee5ef46a8d7c5bdd1e6d5b75f3f3591
SHA512 f059559b211b202050eb885e525d7d21be2f27519ed480ca850433aa09d5bb87e8d647b4f27c5c063f8ecb4c5a0293f002d0bd6663d2821eeb95746641dcd233
TLSH
T11D01C2423A5E45351A45454B87F2E44FC1617EF16A8137E0B2328A1D01E2A17A9DA5F2
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe.exe
Size 80KB
SHA256 06222f5319945568d31610d9397bad55125d7dce62f6cfcd3f0e4737324379e6
MD5 51f9aa41b0bb9022c11c26559562443d
SHA1 876e47c5bd34dd12805f8dc7548a08366cffa107
SHA512 b49121fa0afe3a8b800ab6b26d80af2c2aa65e2c782a7bdd230aa22f9943d7fce1714eaa84d6471409881440f2a8adc6b300295fc50a4df37496368ddb22c621
SSDEEP 1536:UlZ1PNq9uCUOFVSiHdq+sxne2FPo1065sPMgurHdCOSdBXke1:Ur1Pg9uCRFRzsxeuPo10JOSdBkK
TLSH
T193835B2179A0C132D8E355B449ECE2621A3E7A724B758CC3379413EE9EB03D19BB5367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 c9e3ead6888feb91cafb25e358e15c98d8fce835e2b0f7886ca8c2150977273f
MD5 57c02170928cca7ba6f9cb31618e8c57
SHA1 795781a602e8d9c74027c493ed053edff54160e9
SHA512 0b01da2cb6fe971714b157337d96ee1697b61e23b577ad463de6ab49171a6645e474b18d2e9b438b433b67fcf12399f01db7ff30fbc44b7cb7aca906e4e90180
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxN8SXzpn9t6RN/:QCSjGoLpWM6VsBEjxNZdod
TLSH
T101935B6AB29CB376D0E199B88E0DF2E5BD387E300E19185FB69E1F0DDA774C1590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2460-731-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2460-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2460-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2460-1260-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4364-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4364-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4408-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4408-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download