Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 19:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe
- Size 173KB
- Sample260804-x2caaawvgv
- SHA256 c0fa150682fd1326b113f652be9a44dd009674c4a70d3fc3fb0bea49090c4c2b
- MD5 8d48fe47584c52878599dfea7727c87e
- SHA1 42a2a7f111555adae6a258fcd56dfa21666ee1b7
- SHA512 b48cf49aee4dfec6c77359c633f669bba8c3c1c863a3791093bf832e7ab9562f4091b79b68ebc4003a3115639f5de963a80e022a886525e6c18864385fce5534
- SSDEEP 3072:QCSjGoLpWM6VsBEjxNZdoWr1Pg9uCRFRzsxeuPo10JOSdBkK:mXqoE3zPmRFJs0ug1MOc5
- TLSH T1AE046B21B6ACF372D0E255B48E5CF2E16D3D7E310F2548CB72981B9D9E722C19A38356
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe - Executes dropped EXE 3 IoCs
pid Process 3332 Logo1_.exe 4196 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1972 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\RCX7AFB.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX6FB6.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX74EC.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\RCX78B0.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCX7D8A.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\RCX7DDD.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RCX6E25.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaws.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX6F05.tmp Logo1_.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe File created C:\Windows\Logo1_.exe 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4948 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe 3332 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5672 wrote to memory of 2872 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 90 PID 2872 wrote to memory of 4272 2872 net.exe 92 PID 5672 wrote to memory of 4948 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 93 PID 5672 wrote to memory of 3332 5672 2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe 95 PID 3332 wrote to memory of 3852 3332 Logo1_.exe 96 PID 3852 wrote to memory of 3004 3852 net.exe 98 PID 4948 wrote to memory of 4196 4948 cmd.exe 99 PID 3332 wrote to memory of 4252 3332 Logo1_.exe 102 PID 4252 wrote to memory of 4512 4252 net.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:4272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD0D.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4196
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3004
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4512
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1972
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX754B.tmp
- Size 156KB
- SHA256 07e6be2f3d0bfa5d4665cacfab1e9e21cd831665fdb70997464e958b05d5e45c
- MD5 1b4b44c08b5bed3fc7e54de3252687d4
- SHA1 4fe5936ab9fcc007557425e39730550859f4f641
- SHA512 ad23251515a29479aa791fcdf01ba9288b45cb8843a17374cba87ca5b6b3e880dda64083ca9c505036b85d951c5c8c71032233499fe56191ee1910143896f48b
- SSDEEP 1536:c7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx48SXzpn9t6kNL:1CSjGoLpWM6VsBEjx4Zdhx
- TLSH T1E6F3B36EB18FB3F6D3E159BC8D1CF295ED28FE20CE19285A75993B0EDA760C34508191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX781D.tmp
- Size 94KB
- SHA256 ac8f19f59c429094f4482d1eb0bd86e77bfc1efeb91f0fcd61982b84a10f4af4
- MD5 fad88ce0b15269fc91e0e2e596a3d134
- SHA1 a0d2a8a8e6dcfa51a649f07efdef99b2b140c72a
- SHA512 ca4bbab92f035f4405c4c3b489047a9c6b2036d1d450e6504a06776122fa3131f316a7bf358a7be982a0d3f1528d56eb1a14d4c2dead62c67caa3ae88d5db192
- SSDEEP 1536:h7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxn8SXzpn9t6PNb:ICSjGoLpWM6VsBEjxnZdWB
- TLSH T1CC93295AB18DB372D0E159BC8E0FF2E5BD397E201E1D189FB6992F0DDE76081190C295
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe.Exe
- Size 3.5MB
- SHA256 d85b3305a5611bf8dcbb89f70c6c7dbff27d2afcf624b66f28609d51ee713b01
- MD5 d725d64015951b1e6ab9309400fcb7d0
- SHA1 2197768e987d3f1d23793e42f2c7f1076cac5ac4
- SHA512 4a5d9dddea45634bcf8de84429c2a7b0c2f97e4adc73b0387521d2d4b5957976e65854d283fbea911ebb28d0529ccb33a90b10717b883f63502c9b7292c8bf72
- SSDEEP 49152:YS2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:PbN/ki+EcF0pDeN2y/
- TLSH T1ED063903A19922D8D099C174CF4AA632EF62BC8907F162EF365076D52E77AD03B3DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX7BEA.tmp
- Size 90KB
- SHA256 3cbcb2ca29259a7883d3bdd5d35eeb838fd77a94be13633418ea0b3cc60ad6fc
- MD5 fcfa766fc91fd0364b363b13a18cc04c
- SHA1 ba11fa8499cab8d60e718e19b7a8e6077f995c09
- SHA512 804198d1b527db3e268015606927e3e3bc8a5045e29624b4b4f635710ed007d90b9101adf62580ba86d076399a38186b5635dba4d04322e30ceb0215a2a13d39
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx88SXzpn9t6ENr:wCSjGoLpWM6VsBEjx8ZdhR
- TLSH T19E935B6AB28DB376D0E299B88E0DF2E5BD397E300F19185FB59E2F0DDA760C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX796F.tmp
- Size 1.9MB
- SHA256 55da6d1de4a47a3c79e5c5cf72b749e2323b1617652522c55916779396dca3f9
- MD5 f1c81a99aa637a3cb5e50c1d62be054c
- SHA1 4a97e30c4ba67a41ed7e554184afae1625d051fa
- SHA512 f09c4a5ddadc34da46917d3f13f8c5c859c71155a7c6a36f700c2f37b98973b520c7601f8fbccc3407f00c12174669d871dee5708bb13fb9c9c004a7e34a1bb8
- SSDEEP 24576:Oi5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAb:jZGu6qG13O7Q7gLYduZrSdHBAVfb
- TLSH T168956B03F69DA3A5D0D9C2B8CB2EB725DE617C554F20A6DF02807A652E77AD04B3D390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCX7E4C.tmp
- Size 99KB
- SHA256 9489354a843dd77a3efa5e548cc70569e4435e29a519807d5fc355d7ff5213da
- MD5 5992a87492475a206a6f310189868091
- SHA1 918a1f6d802ecd97a217aa4dd452e2eee21f4970
- SHA512 f9e9bc92a742240ab606e2d422adabcbdf21c3b87a859a9f620b6116210f2acf71f6d95131adeabc5dc43b695a421f2e3cc2f505a342a8b0bf348411d527f1ac
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxYq8SXzpn9t6eqkSZZZ38N7:4CSjGoLpWM6VsBEjxNZdJU8h
- TLSH T1A1A35C5AB69CB3B2D0F189B89D0DF3E5BD397E300E59185FB2AD3B1D9A77081190C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCX6A7A.tmp
- Size 91KB
- SHA256 b6adf7638e1fecb40a167633cecf3b59ce165a250a8c5811ad3eda6776e09b72
- MD5 d9f84b80c838a73062783daf1bf101b0
- SHA1 710ba31f388f0cb0af06753b7000dba70e71df2a
- SHA512 939e9633153e57c8d17aaa099a7023d8bc137cac9fa778d0617cdefd2f77027e74af1469669cfcb19941eef6b2e5fdf667f162a39040073dc3e40809d39200a9
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxP8SXzpn9t6wNT:YCSjGoLpWM6VsBEjxPZdN5
- TLSH T186935C6AB68DB372D0E159B88E0DF1E5BD397E301F19185FB5AE2F0DDA760C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX6C16.tmp
- Size 91KB
- SHA256 231294a16640c74c90781704d683a1d054c5f2332540e24a171bcfdd0e93fdb8
- MD5 1f0ea8faaaa3b70a21b24c428283fdad
- SHA1 4b0686b09fb2a2b233bf53519f2ea34ff0d6e386
- SHA512 31feea71fe241733ed6585d67d12a925582737b8593557baf184d091cbc6d40a26f5156f20fe98d1a4b6277062768d3ed58f1e27f7b6136035195b0e1ac5499c
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxH8SXzpn9t6ZND:YCSjGoLpWM6VsBEjxHZd8p
- TLSH T1D5935C6AB29CB376D0E159B88E0DF2E5BD297E300F19185BB1AE3F1DDA771C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCX6FA6.tmp
- Size 91KB
- SHA256 10b4bfea3b90bb34c7cdae246e007387809f2d7c0e26635cc56fad0e4c89aacb
- MD5 15ce65245c6d7b6cda5c243a6f3ad487
- SHA1 378c42c55810cc067a038fa536917cf8a348e29a
- SHA512 a265c144a1726b3e958a9027d9419c870f5ca0e6517ffea48c3642a739dd7433274bb2bac587a2882eb0b5af0f918a3288249e97e2a41dda924bbfb2fecf3459
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxH8SXzpn9t6qND:QCSjGoLpWM6VsBEjxHZdbp
- TLSH T145935C59B29CB376D0F259B88E0DF2E5BD297E300F19185BB5DE2F1DDA7A0C11A0C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX8320.tmp
- Size 92KB
- SHA256 75b089f7674d2672b4afbc301f1b87089240039e56baf9309f1291b37392a717
- MD5 6693865e35f1160a40f435926652507c
- SHA1 b6dfa11ab6da6f157a8b77669a01b526f269de6d
- SHA512 c183e92391532399ef0f9fe6d6b85f40c7a302b3a4bc60d45356c2bdf836f99777c91dbeb2ea8a65a207675cdd63d6a83351e50b0756d4b464fa75abef378236
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx/8SXzpn9t6CJNb:ACSjGoLpWM6VsBEjx/ZdDJB
- TLSH T153934B2AF29DB376D0E199B88E0DF1E5BD387E304E1A185FB69E2F0D9A770C1590C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aDD0D.bat
- Size 842B
- SHA256 571da7354ba79d141a8751adb6d6ab85f076a0a8f01c212c6528b3f45c092072
- MD5 818b952a15b04e27fde6c330db1c80c7
- SHA1 884397d1490570be621fcb58f4709dd71487bb66
- SHA512 7892ebc49a6dd8a28205206fa1e951baa84ad0f79e144991feda5d3382826038909d2ff24f1e740cc3f9dec7180b3d37d97b029567b8b1ea1bfeab7b73832e59
- TLSH T1E201C2423A5E45351A45454B47F2E44FC1617EE16B8137E0B2328A1D05E2A17A9DA5F2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-08-04_8d48fe47584c52878599dfea7727c87e_amadey_elex_manuscrypt_rhadamanthys_stop.exe.exe
- Size 80KB
- SHA256 06222f5319945568d31610d9397bad55125d7dce62f6cfcd3f0e4737324379e6
- MD5 51f9aa41b0bb9022c11c26559562443d
- SHA1 876e47c5bd34dd12805f8dc7548a08366cffa107
- SHA512 b49121fa0afe3a8b800ab6b26d80af2c2aa65e2c782a7bdd230aa22f9943d7fce1714eaa84d6471409881440f2a8adc6b300295fc50a4df37496368ddb22c621
- SSDEEP 1536:UlZ1PNq9uCUOFVSiHdq+sxne2FPo1065sPMgurHdCOSdBXke1:Ur1Pg9uCRFRzsxeuPo10JOSdBkK
- TLSH T193835B2179A0C132D8E355B449ECE2621A3E7A724B758CC3379413EE9EB03D19BB5367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 c9e3ead6888feb91cafb25e358e15c98d8fce835e2b0f7886ca8c2150977273f
- MD5 57c02170928cca7ba6f9cb31618e8c57
- SHA1 795781a602e8d9c74027c493ed053edff54160e9
- SHA512 0b01da2cb6fe971714b157337d96ee1697b61e23b577ad463de6ab49171a6645e474b18d2e9b438b433b67fcf12399f01db7ff30fbc44b7cb7aca906e4e90180
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxN8SXzpn9t6RN/:QCSjGoLpWM6VsBEjxNZdod
- TLSH T101935B6AB29CB376D0E199B88E0DF2E5BD387E300E19185FB69E1F0DDA774C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH