8e912eeaead37fddce601a21efaede8ccd0c3aaea3c36f7507ab980a8048d8d4

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Size 662KB
Sample260826-dxd4jayte1
SHA256 8e912eeaead37fddce601a21efaede8ccd0c3aaea3c36f7507ab980a8048d8d4
MD5 ed915ec20ec2f3dc238fcfff184971ab
SHA1 a320c6ff96fc7708ee4d1c5ded9837f61b96916a
SHA512 4fa6ba5d81a73255974254fd051970dad235f4760f11a1f2b906bb7f2855e2479c9733aea052428c06ee3b6ca0aaec3d096db844fc8049efb8e2707d5efee950
SSDEEP 12288:PjGrFY7gQoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:arF8JosqjnhMgeiCl7G0nehbGZpbD
TLSH
T180E4137275D1C0B3C45118768695E6699C2BBE329B2448C3FB562AFD9FB07D0CB3A207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
248	elevation_service.exe
752	elevation_service.exe
3392	maintenanceservice.exe
524	OSE.EXE
3416	PerceptionSimulationService.exe
696	perfhost.exe
2072	ReFsDedupSvc.exe
5992	SensorDataService.exe
4516	ssh-agent.exe
3172	AgentService.exe
2964	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\978a482dd744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaw.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1ca583a0a35dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000851c9b3b0a35dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066c6487d0a35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052ebb43a0a35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000742f5c3b0a35dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000a53c53b0a35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008e4e17c0a35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
752	elevation_service.exe
752	elevation_service.exe
752	elevation_service.exe
752	elevation_service.exe
752	elevation_service.exe
752	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3460	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	3172	AgentService.exe
Token: SeBackupPrivilege	2072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2072	ReFsDedupSvc.exe
Token: 33	2964	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2964	SearchIndexer.exe
Token: SeDebugPrivilege	248	elevation_service.exe
Token: SeDebugPrivilege	752	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 4336	3460	2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe	90
PID 2964 wrote to memory of 4864	2964	SearchIndexer.exe	102
PID 2964 wrote to memory of 5240	2964	SearchIndexer.exe	103
PID 2964 wrote to memory of 1488	2964	SearchIndexer.exe	104
PID 2964 wrote to memory of 1388	2964	SearchIndexer.exe	105
PID 2964 wrote to memory of 2316	2964	SearchIndexer.exe	107
PID 2964 wrote to memory of 2228	2964	SearchIndexer.exe	108
PID 2964 wrote to memory of 4752	2964	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Users\Admin\AppData\Local\Temp\2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe -RUNASCMD
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3392

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:524

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3416

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:696

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5992

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1388
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 627d71dac2b93833868424f674425896a545e01e0d2b93e23d00e6deb33d176f
MD5 a883aebb6fc95cd03fe5af53e255c575
SHA1 ea4ca8791a3e44320c90bfe1bcb8e9e576a1d45d
SHA512 5c0269c62d5661dbb41c28b1525e36e18150a4f57e348e64fa4b9d123a5786ef26f55dddb60c29f73ce5dd5cae060b8dd541431ad4ae261d08e0b420e6c3fb50
SSDEEP 49152:Ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnNDmg27RnWGj:Q3q6sjBaD527BWG
TLSH
T129D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 f9d7255934ec48fee3e48495eae991b8b5b1a551491f89079a491bc5a9395977
MD5 0bcf30400315e3caefe1c23ebc889e6b
SHA1 da0384cd0e2bb63c492682a1a952cef303a38bd2
SHA512 78283c0f62baa32c5f1862968005428a82aad1292e219debaa20ec3d85927fdb8267aed35bc8f3d7c5f0e96fb447ec899e1b6e57332d2765028604a0e9352fa8
SSDEEP 24576:WXYfDtczACsqjnhMgeiCl7G0nehbGZpbD:VtcbDmg27RnWGj
TLSH
T133050129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 4e60730a327145fda7d23ffa2830000d8b25086edf5a40ce0b1ff4317cc48412
MD5 6098eb0f88cf2cc356212824fc30a691
SHA1 668290e12000c20267ca4380deb0c48732089c75
SHA512 edc5839255eafc0d5374c217e19606b5df1c3fa8e8da3da5bcc7890699a8daca6a09d3866362971fbfeaebc2fe6d82a8149e29aab64c0569fa64e92fb5ae9697
SSDEEP 24576:O0Le5ji0hmxxrMBsqjnhMgeiCl7G0nehbGZpbD:OPji0AjoDmg27RnWGj
TLSH
T1E2359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 157016fc3577fb704d4b71261b322d873b69cdda79937ff5e7879ad3b2ded65f
MD5 f0fa7eed2f5d63f0670024e652bd2522
SHA1 e5bf3766b77235d6225d7d11d029aacf794235de
SHA512 67e578704202e237012fdf42bca44ba969a27f56c83b30a4e578f2b14b9e2169c8c448051fa10875b622d851b4efa91769716ffccfef669f5eff64170cedbca5
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWn6q8wyu3sqjnhMgeiCl7G0nehbGZpbD:a/ezSC6vUzPveHjyEDmg27RnWGj
TLSH
T18A755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b77efa9fa96bcc7038139994e15d14f23e6fb686c64a83852370740b01d748cb
MD5 caf72e1996fb5b80b1b4a599fe27b7ea
SHA1 6548995a7ebaffcddada47ec450d6cf636953c6e
SHA512 ab87fcc62ca53852c2f8574e966233a9665b79118531c3a4440b1a4e0ecc7ed7989d0d4db6222dd12478f8b25e8497bf823d1502146892acc1fe1f7e34775141
SSDEEP 24576:qVbqPb88hv/l+YGsqjnhMgeiCl7G0nehbGZpbD:qVO88hXl+DDmg27RnWGj
TLSH
T133559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 80733f8d2b7206dc0ba02d1aa00c39c9fc01e82db23c1ec6f3ece003521fb122
MD5 1b8b99ef2373d938cf001ffadeb90abf
SHA1 cd2b9d47686dc6430e59c449e5dde853d6fd1939
SHA512 7907a36eeab6e87e6626c9d1b601ba1b3f3b526e2b71a304a1b879351f1297b5ef6feeac0586e9a665e2010c9df152709d24316cd8efe604a55e248e8ad6b4a0
SSDEEP 12288:tLlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tLlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12FC423BF864C50CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 01aad0259688dbc6dfbd478f900ff24cf12d3f13a748126c598d338ea8cecef9
MD5 9bb731fa876985d1ba521f7d89134cc8
SHA1 978bef73e1cbfc40d638b0769011f8c1215c1683
SHA512 9af6dc779474d83630f7858f8f426641d2f0dd493aeab6f7691224dc1dbe016475b439fa3a20b4b4dd3edf980bff8f3b58fbcd61ba4a9f8dcbcf428fe71765d3
SSDEEP 12288:/eBNUbTVO86UeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:/JIUesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C205CF7BEE28FCD2C27A8DB95791C600E76278314F2193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fb071a78f9134e37c284a05e7ba03b0121ce98ae51325a0d8db5e80385f34f60
MD5 3e61c3541ac2c8b8038fd31fd0affdb4
SHA1 04acb299cace8b0235058ddb8ee90a98567c9ca7
SHA512 26bf870e004d0d09e7d1d3c4da8d344cd27d6fadf40356c342d430bfe33e640bfcfdab1f0ddf736a75f02ac88af9e0cb13e1bfe0b8971f87d2056011bb1a6cc4
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH5:PQvGAdlCEL8c/DRNw5C7D527BWG
TLSH
T1E4266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e6767f21707a8b6940ddb3e3c50d342349b247f1e3171de35fd0bb523e4d27d7
MD5 561483a22976f6d09e6f1055d0a34e8a
SHA1 4eb576359139fd1c6159feef6ea47c8a23916dd5
SHA512 09f7dd224e7771ec5acd65346b0d6ba67c6b7ff392513dcefb6f322f8b432441c8d3cf88abc886b6090a9655529cf3d506e2e7f05e945afbc6f6520b0fbb5536
SSDEEP 12288:UAwSfxL/2Dc3RDLLmt0LDQewsAjsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:p0ewsAjssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE15E031FA74E036C37B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e6e41a9a4e57949152742af34822f59ec98be44f30328fb450e57cd0d8c13d98
MD5 598283040777e89f6c37d179eb2babe7
SHA1 ec271b441449ebf906a9f2beffd6982d4f9b0469
SHA512 6f93920c78b651ffdcb1b0d9467adc198265074303e53a0fa04874f79bf50178a474cf8f60f4ecc6b0890d7832d5f6617aa624a67ed1856fe90d8aee332a6e0f
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHwVQBWG:NUEtQevvqc2W1cpV2tI323B
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 be43e201c056e9a09b49f7df4214dc0940c7ce3cbf85a8eb945d4ee93f75a2bc
MD5 669bca3572bcae99c726e71ff7263dca
SHA1 81700c891f9c32e706292f113ac413ff0fbd5523
SHA512 9166a525519aaf6a262a8d609b51760105c8f2299e469a95d11d6263c07ac5f1c159c8d78abe253c66f09709bdca4f4c84bb5a8a2104ebd9bbc5eba628c01d4a
SSDEEP 49152:/CbRquA/m2yL5zTfFiV+XenmE3/z4Dmg27RnWGj:YoquVjnmXD527BWG
TLSH
T185D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6f1fc3df6d5bb6dbc3089f536c86d94ff07659869737b1a3112b10d484b67da7
MD5 3bf82cbe4ed95099e937d6a6bcf35273
SHA1 c35db0309dd0d55649c7312920eda2336a61f019
SHA512 6472bd8ce936f3dc75100c5355648704536b4d3e711cbfa21dc22fc92f736cc31453ef5f76e739b95859980b04553b844d927dc0ad855ccd502f7c5a7c61abfe
SSDEEP 24576:1AhGL3IFoiwtA5l7S53zsqjnhMgeiCl7G0nehbGZpbD:1AMUFoiq5HDmg27RnWGj
TLSH
T1DA359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 fbc0e32d364decf19d213fbc45c1dcc1963721298707e122f9dac3e6b30eb4ee
MD5 6290226fabd92e8a254706796b629f47
SHA1 794e2681606a05a9f26a50e8498d9dae49d7e7c0
SHA512 7ac6c04cee591f72e483a109d3fc41f13a10754b370c6e6b52cf82da3a004ef947446b46b0745ff811a719da64885739860c5d3318c9bc4982db2c2a7f274624
SSDEEP 12288:Zmw5HEjsChNVBFgl0WDm+CXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:0wu4OW4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12705F15A72A80CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 3c528a6c1031e0189cb4793039b9dd41ec2096f4efaf79d23e0afb9480840890
MD5 0a83936d0dad304f3c7656ce522dfd8f
SHA1 0bf00226bf8f03fb60959d8bb0a69571554f48fc
SHA512 c28c04adb15f8f2a1f3193679f9a0c45a11f11eec563e4bcba6ba84f65b1e4d221268a9e3cac0708b3dc1ac07df0fa430ccf0c80d8a74c86e54fbdcf19ea60eb
SSDEEP 12288:peZ1IycXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MZu5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T100E412AA239820FAE163417CC5E5D609EB337C62673043CF166256AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5da489a9181785f9d519662de4e9984bc3e42f1198081bcef7c0143d1c697420
MD5 1aed0db403bcaca7a7bdd420c3953c2a
SHA1 480e3e17e9258d87b001e8ddc6cf7db3111b2e26
SHA512 faac7a01081c2f89b7c509ddb3aff53b7da555ba31e95e5552f53ad1680ede8267385d86be18034c4cd17cad3de6eba3e686cb7fac5f17576f378ddfec5fefed
SSDEEP 98304:hQRQyi36YOcPbLvw2gAf+PN3uD527BWG:4QyiKa/X+PN+VQBWG
TLSH
T13B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b32fb5e00fac93c5462f6b5d3a6117eec1787af9a78947bd953d998a0405f7c6
MD5 978fee1dd94d379db18b7dc61f5ba8f8
SHA1 2105f5a9de80bdbb24ae1d4ee4f532dbc792a91a
SHA512 54d046b26342a499f56be548dc164d7dface43eecf15d0f27f0f367247538f23dd48f048658dad93b434389d44e150df0854fba18873a14a0e1f6a8c5508f053
SSDEEP 98304:xQRQyi36YOcPbLvw2gAf+PN3uD527BWG:oQyiKa/X+PN+VQBWG
TLSH
T154667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 10b07316952f5e93757396961c4247aa9f2a62043381c6eebaed8c465a401427
MD5 7b6947fdb5ccd0514f9ceb0c1bf3405e
SHA1 61dd182ba0a12a3a821074142576618cda5def8b
SHA512 113e71b10813ca2b772a3a5b1938435b22790b551a400c9948fbbe76945ebe4e2f4d7ce93d20aa9846d924ea7e0a914fea2fb4588e1470b4b2fead66d28521bc
SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0JsqjnhMgeiCl7Ge:z68Qg55nhceWu7PNU3/oDmg27RnWGj
TLSH
T11EB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 81fb2e606622d61dc914279fd72f395f283627c6340e8646de4511ff1f0e78a8
MD5 35b3607ca8d816f50c083778b67aeb50
SHA1 6b966c08e57116f27b3bcfa744071c477be3f6a0
SHA512 44509d7b7c91c9742ec17c2faf3e536c249147d57476a568f4ab7b1c2d84f55050334efdf267fb097f992747cdc1c1a0c54d0980509cb2ed0546e0d38a03dd8f
SSDEEP 98304:/y5112gYy5azzVvt69nLKnhZZD527BWG:yLIHEWhPVQBWG
TLSH
T127167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 54fc53200da405051ddbd1ad43f215ad6828fb8c904dfcb37fb8b67db7a31667
MD5 30af86d30e0c348b7252892a6181adcf
SHA1 7b6b42d47707dd4ad1f7387f21f0ce7b11b81694
SHA512 53975a071a9a11811f31c80c5fe9ffe038f481a593d5937812b4829c41fe1d6f5f66ca0f6aa68b476265d2c32a6abdfc44339383e0f567b054336e6ee6b21fba
SSDEEP 49152:IB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glWDmg27RnWGj:Cu6Jmdxd2dWD527BWG
TLSH
T13DD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fa449e98af31d7646bc45082433c5e291cf9c3f06e021f63239f688332bd7333
MD5 cfcc769bb39607f707c3539d53726624
SHA1 14a81726cee326c686563f5371719bc01be9fe5c
SHA512 e45c28cade1eb2e5b449765bc9085ad25a670499266a168f467f15b21504d124fcedb9d322875a0b76c3dce68c26311f030e3cdaa545b20c2dc5babf0c050809
SSDEEP 49152:G1hpsNoJpF1A63U44CwH7R4xSDmg27RnWGj:GmifPWRXD527BWG
TLSH
T1BEB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9e3fad68c4ffab116bab160df88b7765bf67fe284981d4607ac033ee565dfb0f
MD5 eb9024b042f532655cf1455aead85cf1
SHA1 ea4ef7f62e72a063e71913a0a6be8d214b536003
SHA512 6b9dc271700ecf80c5c2e3b73687fa876da30360e173f2a1d8a2aef3191c74ff703a436cbdecefa866f60f2655525d169415bcb04b0de110baab6cf68a72c7d5
SSDEEP 49152:BSuZQIY0Be2KcRVtOnks6NMHq9Dmg27RnWGj:P5dKii619D527BWG
TLSH
T14AC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1b0faf76676d7e39deb07203b221b2f6d16bfb920ae14df096fe4304c156820a
MD5 66e401ba3abfd16fe44597252c9e1686
SHA1 7e16637ff13ef7d75b5921b8b6de06dbcc7098dd
SHA512 034f0a0ad86a999e23ad4f7e4b434c2addb997efb69fa1269ff2ef5d7f7e5d778390fb15ed950e59363b3b9e225de48ae66d1ff5b2c2a16548f92900b3a020f1
SSDEEP 49152:PhtSn8EApI0fig3giDn0AP5wGDmg27RnWGj:eX2imphzD527BWG
TLSH
T1B095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 41c6301fc9632cd0bdca9cb17c150e8af55eb3fb6da264632003b218bf0c1ab3
MD5 33ba239b1d715b044a04dbd459f64e78
SHA1 307e58bc08fbd71ff61e46761cf4b9d479076a86
SHA512 1fd0190e688035c9bcc8a95869b440e092b69d427d0624c9851c574c176b806cb62093984f6b9dd68e6215036439c1e6ce1a4a6db755d16b6cb1162ba74fa780
SSDEEP 12288:wdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B3C423BF965C41CAE52248B5C3E5F10EAC073E5BE92004937A577CBAFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 19a686a2f1a1e69d4f30e861ad44c8509864d2a922da9066451af8f1f8184f99
MD5 b54af0f5c551b21d729cfb2c8b29d512
SHA1 f39aceb2745836fdc7d7ed527bfe1a6c989d5101
SHA512 626aeae48479375a39f6d3ce3ddc602c54451cfa6b2eb2d33740558133cd082528dcf0823e21e18ee156e16345de300e2f1c901c963c38d31556b2994ab6a8ce
SSDEEP 12288:3AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3AsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E9C423BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b2901ad1d3560da31e7620be1612ff1944fc3b2e461904fc15918c840b0b3b60
MD5 cbd989482067fac5647f59fb127030d8
SHA1 5294bcb0dcce808dc9c19159277bb1e4dba4af59
SHA512 3493773c3e3de7007f9637fb58b473a8c332426e47df555d30c85a98add43afb911adefbbac56edcb3311ae7df58b2f9a1d1b600ead710d65713c1109f4f138f
SSDEEP 12288:rWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ADC423BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 6d2949881590db58963d5164c2a127d85dbe413cb4025661199fd155dde3356a
MD5 b52206318061a6d1ff11f1debc12ef17
SHA1 a05e6210099033fe8b9644e7e4e7684cd8ded5e8
SHA512 b70b748e4384e58fbcb947e5dd69deb29a7f8fd20789c6001b7e88784b840c9e6150d8f5de04374e6f0a68459ca942ac3abd696d77ede3dfdbea9dffb0dc709a
SSDEEP 12288:5VTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14BD4236F575C01CAD83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 87bcf996118e26b57c83a419942e3aa4675bed23f8a3870b56a4613d756c9bdb
MD5 98feae954a34630891a068a3d9dae57e
SHA1 b546a3598b57b6ed98da57f5ec26550fb7c0672c
SHA512 946414c3d4505ed8353f4273fd04b0dd81ce5f2685a7e78d4a2391826a00386b2d1a91ee8954734563daf0aefa56a0c94bd00d08c01db7b1bacdb0bafe75916a
SSDEEP 12288:d7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:d7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F2C423BE965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 df55c5aaed84f386ddc1cfea4cd883fba7f9a04b8e095abd625d10f376258bc0
MD5 230e26e88f5cef6fe4f4daef27e4e6dc
SHA1 1df13f3ed9f9d16379f02535780c9073d4ad4ef1
SHA512 a961c7cd1e137631a0583973429668ea3ed22356297188bdf92f0a8ceadc5e4021dcba8b059d1a1d2181eb686a0d34bceac9ad7eec876db55f047adf00d6eb7e
SSDEEP 12288:PEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17CC423BE965C41CBE62644B5C3E5F10DAC073E5BE92004937A577CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f065f45380a908b22ae743f3cbae27993e11395439fb93f86369f17d39b4f20b
MD5 aec33a5e1c0a28cda1d0aa93ad61d902
SHA1 ccc1b0abb3cdfab6e3f8cca4c3566a12c1467737
SHA512 8266e808100595822a8cbeebb9d0390a4f206f9abc7414542ea4b650ab41f0f054bfe465309d6192e79e58cc1e2118c04b2d36e8420f1e5da70a195aec097eac
SSDEEP 12288:FIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FAC423BE965C41CBE62644B5C3E5F11DAC073E6BE92004837A57BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 98faba3848a91f0d41f7ee7c4e220ce8a99714350b6862b843b706c1450f80ab
MD5 de310a9bbc32079be992bccde8092ba5
SHA1 cecad22461d022ab330d549b8b3fd3231e4e3ca8
SHA512 64d7e247fbb18f7d5e4d0ce125906d1ab53e37b79ed1aa30d181c3224fd20471fa043b5abd1df5524cd4198bf526de2801d75609bc988aa5c4045544122331c7
SSDEEP 24576:TZMRzFVSOgsqjnhMgeiCl7G0nehbGZpbD:TZMRzfQDmg27RnWGj
TLSH
T1040501A9B39018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a16eb0233b6e022fbd8d906f6c575ca1849fe3486819eb8b175e8a9bf873a7bd
MD5 a8aa28abfd720bfb6f29a97bcc6413cd
SHA1 8da10426c29939f6394dd0e4a00124f00233220b
SHA512 7bac59d495a4e896fdd2f78300b459654b5871ba0628bd82a16e11fef967db8106c530d47f08334d39da4acbde414e0032d0d8c3bb7678ea687b2e6368917144
SSDEEP 12288:/pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/psqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C2C423BF965C41CAE62608B5C3E5F15DAC073E5BE92004837A5B7CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 92241e9fda671925c619a1c2b3ac0c6cb32f5288e79ddb21d9cd1874df241999
MD5 8cf47b4125c0e1781e330b516f6ecb75
SHA1 0d23e301d00cb7dcc8332304fe4f41629f79cef6
SHA512 9349b13ac3a78b1d83baee1cdfc0b2cdf197f4713118c679c0fd63e064860c6ce521aca2e77c4ae61a5c68d7081d209ff023cdb40f31b030638b7e6fafe1a7d5
SSDEEP 12288:YVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T198C423BF965C41CAE62604B5C3E5F11DAC073E5BE92004837A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a9b267d19866a6a81cc9f22825c64467ef149258d5d90bb4da428f121ce2cf5e
MD5 25960a180bd63f3bd9883699b3b861ec
SHA1 fa8ab25ce5fc139d10b6ca4b152b38a3a134d0b0
SHA512 edc99764284491e2642c8a2019ec706cc3c9b09e1455cf27222e2d8499fafe0b7c95cc8b5d7b0645bfcb745fec032590aed1cbb071c60d7d26d06bb1a2922352
SSDEEP 12288:zyPz5L8cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+zycsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E6F4125B73A530F9D1368178C5A29A06F7337C3647204A9F17A506BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9886d51a24e9a1894a4dcf36a5f85f8fdec74fb3a4e9b516d709a837a0ed2008
MD5 a72169d916825e24223174ccaee457e4
SHA1 54f7ca421b1c2cb7d6be0aab4baab3e8430ab171
SHA512 4076ec49ddf2d27b8596af3fcf2cd61109ee7f75e3f8d0a8d9834505f25dfc8b3391fba7cc45a81924cd6c2d2056089b9376da7511c3df1589f55aab4266ad71
SSDEEP 12288:EpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F1C423BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 00d3879e6f15d3e631c224a10e41b98a70b47e5417207e41276c25fa56715bfa
MD5 d8e0c9faf00a8b7ad7072a40e30cfd68
SHA1 3702d9f500c5f3df5a3f2bb40e399e51f18ca595
SHA512 f27217ef7663a941a7aa0615de38e0f7e1d1b7874887610398556daa9e8bf08b9036d1450bb2518785ecd215e4f656e577f08689495ad0635f08d90f4a40824d
SSDEEP 12288:ppXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ppsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C2C423BF965C41CAE62608B5C3E5F15DAC073E5BE92004837A5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c963bb26101074d02e43787b931623a5a76c5cd90a7cfd47512914e44ae60263
MD5 61f65811dada39c52721e59ed1098609
SHA1 d9eb7f05a15e441f3b46bed08e00bfa927cb4cfe
SHA512 dd95399d46a32d8d9aabfa04a62fd50b90e372a7e7b5b3f0452ae308d7977ca5afc60f01f67b6d4c4f5d7cf38d1b2cb4e204d18c41a2446287059162c5bac253
SSDEEP 12288:uyPz5L8cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zzycsqjnhMgeiCl7G0nehbGZpbD
TLSH
T113F4125B73A530F9D1368178C5A29A06F7337C3647204A9F17A506BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8b4faa2152d0c567a4064b89f24fde2e46aa555dac8dd149a5dc8c924d932ce6
MD5 e2ee79e328b7869e66addd30862f5837
SHA1 33469d0e3035abd591cc9857c5346e069c241d88
SHA512 ac2a1d796a921a48706414a6e44624eda2bddd3c27a28519a6718de4b230627eb6e45115a836012d31ae3f27599b0ea36edc5e93da68e0c62320b737ae98823f
SSDEEP 24576:oTDaLl3z0zDmsqjnhMgeiCl7G0nehbGZpbD:oTuLljLDmg27RnWGj
TLSH
T1790501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 b5510dc3514f973a5f7d1ff646a3ea40c85a1664782b32d0a42831e92ab627ff
MD5 3c7e2d214572c15a5d2cf29ae2a753ae
SHA1 18be230f921a74463e92bdd01b5356ff61e0103a
SHA512 1e5a8e20570abea2f679b3a31b54578a76b0a4190325f249cb34ceb76cc137e255af66d0c734cd2434d0693abb1e513dbaa15fe655a0cedb9d2a6d64edac5b41
SSDEEP 24576:m3vd9CHKy7GZ6sqjnhMgeiCl7G0nehbGZpbD:Ivd9CHKyaQDmg27RnWGj
TLSH
T15B25CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 b385bd9795b80000603b2a2ad9ed9bd70e0d5df997878e35738ecdb96d5931f5
MD5 97367f6145f97ea6f16c3167a33ca57d
SHA1 efff477e194c5c998d24b27d1a9cb3562e5a1e65
SHA512 42be5ebe4152cbe0228e514eefd9eeefca6caf35d03a391603105dd20a6a9d9a3d42fe158e10a97de7a5abc42166357f47b0f6e3f80e58aaaa6d85b656b1a6d0
SSDEEP 12288:52Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:52sqjnhMgeiCl7G0nehbGZpbD
TLSH
T150C423BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A977CBEFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 f3f29902622b6e0bc41ef52770defaa15602af38cdc0d6d9fc2e7b4c29408465
MD5 a3d54a29b07b5c3ebaf4bfe049085fe8
SHA1 8e51c1a506eddd208b18bde4e8bd7fed234ceaa9
SHA512 e87491ec6ea5f13646fa06ca70b57114c0ddf6d20aa4ec57950a1811ea5b631739f976d92bc7414d6cfd7db21cc18052f59c643cd43bbfea437a150d1602f2a9
SSDEEP 12288:L8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T146C423BE965C41CBE52644F5C3E9E10DAC073E5BE92004937BA77CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 3d6bd2481d598796599c7fe4db7fb0d2b10627631dc7c3b22b633e78b7dbfa8e
MD5 05ce6add28c66e6cbcce7d2d648798c2
SHA1 4b9e6d92a7d748b4131a5dffce623b89d24c1c32
SHA512 11bbd7577432c35ba966a25da2b73164f6847420ca2cc4cb9b37a6150e0f21fd37112c57801ae63ede2c0225709426a9e590bcce002b4d89a2b49da110c7cffd
SSDEEP 12288:x/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:x/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E9C423BF965C41CAE52648B5C3E5F11DAC073E5BE92004837A977CBEFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 39e039280dcabfded3dfc66ef278eb52a855a40409984315f0a46c4dd24892de
MD5 529813889cc995455542735e2cbb14cd
SHA1 279ee331352a82166f603b0603258c9ea5a8416e
SHA512 a230a1ff7be509114ce9389f9efc96d6a59371fac0c1a2443af1d2e79a100acdd2f2a385866d016146e67fb8199b9bc0dd52bac074386009c3b75ee7c63688c4
SSDEEP 12288:dpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E4C423BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 4bd75db3df5f21c5736d7590d73a27fa30f903da5ff7b38878e930560cd8c607
MD5 834168d1a11d608624c9d99388396cc1
SHA1 008954e0fc462cde2c224f7595dfe0eaff477807
SHA512 2a4b127c0c2d2c0dc07dc64d63e6882d11836db89add59cf9b48513c1c1839cccb409b6666c7bc969821d646ba68ee49f5c5f756658bf573df22e34cc0e2738c
SSDEEP 12288:W2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:W2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B7C423BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 6a0a5bacbbe22dfd17a153bd9d46539985ae8017f96458ff01b11225f3494bd6
MD5 dcd947db530919c82b50d1c4721e91b6
SHA1 cc5037cc041829760f7d2489f40967a787855123
SHA512 8c80a7b1d0aa909e14cd8478a1c358c60aafd6c1e5fabb36935d548a907c33d51a765f6d3f92b790c0c1ff09d9d15299761a0517f606fd0b5d154e326834cd1b
SSDEEP 12288:YRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11CC423BE965C41CAE62648F5C3E5F11DAC073E6BE92004837A577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 dd41901653d61d82b88143efd46e87c10ba78c1ec5ec553378b74038f45e74e5
MD5 112d69afc67c376ba36111a7051e65c3
SHA1 f4abe6b6a79414bcf1385b5c5c37f71a8331e9f8
SHA512 ff169da1b89908a867ef306b6467b6847fa1876433ed4d802e8351a1ef16bb0bc056c0f641556530e153a5a710fb0ada6675fde5af5145e440e84e72c12c517b
SSDEEP 12288:67Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:67sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E6C423BF965C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 e54872e2f2f56cb747c977b720fb5cedc601af1b33c7de71b93dc8e5f36a242f
MD5 e28b01bc75a2cc5090f458bccc676b39
SHA1 c74cb1dfd91c212731f772f641f4849b27673916
SHA512 c6fb45f23b52cf56ce5a01112875399ea53aa8bf899f8a6e54d33e5f137a200151c70d8f8d2fdc4890c99986ccbee76f87551cb60475da0774a877a6c602b280
SSDEEP 12288:BOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T170C423BE965C41CAE62648F5C3E5F11DAC073E5BE9200483BA577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 52a3b3a79e7614a272623247e4cb1ac7d2f566258449a599d99828c0778872b4
MD5 dd627a85e68d62778b038c7eb385a4f5
SHA1 693e1414028e59b4a6318938b4d9e680441060b2
SHA512 94b287db916b2dc431b4c902b31c46c063b4fcfbca2bad4e6f806d10e042fe8f588668d472ffaee3634037110e887862df0aa924b817be1490423ff32f1565fb
SSDEEP 24576:FfwvUk9RX6wkyAIFsqjnhMgeiCl7G0nehbGZpbD:3MnYI5Dmg27RnWGj
TLSH
T10D35D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 aba3d8cd4a01680c11b74ea3071c3ce552712d90dd19bb80d1b16ccf9a84dbd0
MD5 7351437dd55eb6f0fe5419b9cd3e9268
SHA1 72c47bc0ac10a2ccefcab9c4296faad023677984
SHA512 e841a4c26741dbf42324b67f6486f94e5240b3a20a07fe996dcfac9aaa44bd879c346f86226da52ca1bf3ed77870fb891d1727eacca1ab910a85101757780510
SSDEEP 49152:oYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mDmg27RnWGj:/ySzPOD527BWG
TLSH
T1F5066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ccefa2b3a97bc1f4966421ae47962cd68f05d029b300d50dafb84db7502a303f
MD5 4b349520b6b36d945da0be2e603223ec
SHA1 d27817d673b897612f5973b4172ec1b308377e4c
SHA512 d5b3fa1a017b9c56780749e33dbbaddb3eafe7f864f5381573255b805645ffd164c74a62ea4b5c52304e98ca60a76b44c9ad8a3f0b9e7c4485516496488d41b4
SSDEEP 24576:447Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYQsqjnhMgeiCl7G0nehbGZpbD:447JUQjTirIhCnDHUPfF/WDmg27RnWGj
TLSH
T19965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f03ac24ba379924eb4c737cea927bb3af15ba1607c457aa8efe41cd5c95a62b6
MD5 b22c0bfdc75ab572568978d8995cb703
SHA1 7b81357740c5fc3dc3910c07b283c1a2f396389a
SHA512 3f3f92972e95ef157cf717b21f2e2ecfc00c6b464c245fc319abeeb26d8c5b40180ffe2e77c0941bca514966f39fb9c4482097bc9c9003db471809849ba767f6
SSDEEP 12288:Hbsf5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T160E4015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ca890572e3ade538be13e62ad0bf0bd5b3cef60a73e2c80ae10fd3c823c2cc0c
MD5 8710268b714f4e97cba7407ce408d640
SHA1 b01b3fb92baf550886248f1ad99ed3c93a2bd264
SHA512 3ed47c3dad0b4bdbd59ae4ca6f63ae6de6055a4d869114cdd36e6d00220171dc22911ab60fa20d462c2febc1f60dd060df6952010c1ee1aa264d0557e82eb2d9
SSDEEP 12288:l8n/zsc+U3fz5Ri+E/PMj1AT5o1bXju3eaj7LqLcJVLV:l6rsrUPdreM05gXjuOaHL8cr
TLSH
T1CC350741766AC75FC6A940321E32D2CCAB707C45EE456F03B3C8873F9576669BAE2381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 8a91b8e633e1d31db28b94d1dc5c349dc82f63cdf772e78cff4a332f39103938
MD5 ce07541b327686b3f83c91cccbffa72d
SHA1 64f49605187eda871dbb3188fed366c77b041ae5
SHA512 892dd62ae77d36fb1ab5292efc4a9846e211ad143c08d7776f3c5d898477c45fa23fa15fb989ee4b1431e94535160b95af0afa0fcd4eb06c7021616fa43bacd0
SSDEEP 12288:jODfpsoLuYT7baCcbx3zIN7ccmyDuWZACQmICQGUMa9nzMr1RdiiY9:jODfTuYTZmd8NIX2p6k/q
TLSH
T14C750A816137E39FD1F6603203365B4DA7A4EC0777496F22B388453ED86AB65B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4ff2a3cab6caf1175071cdddd4a8dffff2bdbc99abe364257e65668279ec4686
MD5 7bfaf2ab72ed114dafc7f1268abbac70
SHA1 375cc85c77fb6a78b726b63c238f2d968564bd91
SHA512 b66ea95b4c5d1fe48427e038f40a676767d7e0c78929c8210f08f5a7bc61349e0167dd909e6e33dc6738a291adc919b2601edf7a9f2524f071f4f9ef3260ad4c
SSDEEP 12288:b07hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B5D4237B934C518AE93605B482EAE12D681B7E669F1044C3BA0778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 188506ad462c1d36469f1a8bcbbd035b9d8d7d81f4eef153d73ce44fae2c9ee2
MD5 ec9362a80bb503c1fff98de97483d1a6
SHA1 863ee4f17a4d38767f3b14e6f1fc01fbe57dc0d1
SHA512 f91809eee0dcc62428a4fc934174e94fdd15f6afaa40f6380ab7eade5a770f63c1a82f4276e69e48533dea5d2ff068cad72e3734d231b9f73d3d087a2fa266d8
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bY3sqjnhMgeiCl7G0nehbGZpbD:/gb4mBIBhGFMDmg27RnWGj
TLSH
T1A6659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 7df8b8a0fe02751deccbcc4cf0a30498d9f4942dcb00ff8e2e5e6503965c0aa3
MD5 450db9f6525e9efa49248678803b51af
SHA1 609a03f04ab9b718581d9bbba8f776bd3f2b6953
SHA512 8d06984aaebecc3e2168b92f42454bdd61baaa85fa90395a0b4ad1184e1d59e33cdda9631856bcfc46873a977c6db63060ff2e8439c15335499432aec60d8a59
SSDEEP 24576:7G88u8FpJqH1bzria7/mgsqjnhMgeiCl7G0nehbGZpbD:a7ZFPqVea7/DDmg27RnWGj
TLSH
T1C835F16577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4f1cedbb90c27e7b43e348f57ff5b79bbbb6e5e170402c0c00b31086be5aa698
MD5 83e2ffd328cdb67f10a1b9acbe7abe10
SHA1 563f4a0be29b2504cb240b3600c04b5b9b4f1b0c
SHA512 725d7835793681a81a04eb0cfd9f1517b1c27cb13d8203213cdc25dc1ebf1735aa3d5325043a1f0ed56d3e594754e29f46c9203ff450d97314d3d12bd7e1c7f1
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgDmg27RnWGj:7G05lO43bxD527BWG
TLSH
T1C0D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5edfbac6b30bd01a66d254547104d7173e88e3557f5ae99c85a1f3d5b4686a8b
MD5 faf2d8ab2bddc7f19edcd58125bab5ad
SHA1 f2a7b664e65d0f5aba4e54a368572bd2e3161b12
SHA512 cbc6fce5beb202555cdd5770ecca81c5e041501864fd882b198cdc25f84d494ad2f02b9898955d9ac68680a8727af3f62b8936b2050b5b85b732fd38d9c7ca99
SSDEEP 24576:Mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnisqjnhMgeiCl7G0nehbGZpbD:Ua5POZ3BJt2pasx2+moDmg27RnWGj
TLSH
T1EF65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fc8359a4fc2de056c7790de226bbf023821047ffbe51d907047dead147b5f6bc
MD5 1345c9f1b339a4bb7f7f3ad60497fcc5
SHA1 59c487b700d12c9c200512d89cb962e9f0e689c6
SHA512 4e107275d37e3b89ce7501ba5ec568df59038bf34e9c4f9d8435bc3da01436cc490145c17aced699ec7c53c008046c2120f4eac770f76dd6422d7915d049dfd4
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7FkYsqjnhMgeiCl7G0nehbGZpbD:9Nc/zEOVHFjDmg27RnWGj
TLSH
T1AC857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b77d7efdf95993aaa0ab085bb6b669d7a13b3bb4ac60b9508e5b8beba456e453
MD5 f664165d74aeb12f59002bf4e54ae597
SHA1 12e5279e8a1f878f0cb4cd88225dcec42904b76d
SHA512 4b7665b31bb6759a4731b1cf135c61d785f47db93cbd983e23097a5eb64774f40b1e6d2081a022feaf9a7fcacbe1878fb1637f6818e97469413c7d4427b1027f
SSDEEP 24576:dTkNvNnaFeYhJNtmZBmOsqjnhMgeiCl7G0nehbGZpbD:dTMwBtOmiDmg27RnWGj
TLSH
T15555AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 bb7ada3458e00b0a5182d0201d0e9c7e5fd25c9335761d4900e4072d10083b95
MD5 a9fb5cddbe6d862740e785d2f1df10d8
SHA1 b4d69eb91268c7cf659ad8548fd6084345e76900
SHA512 e84cf3bce90576adee2de20875a105ff9b2c15df124cf596833327f2ff098704d91a79857156fe4c60f4cb686668ae478511f361c12f10698e8798d6b7669bd8
SSDEEP 12288:WHvUrBFrEjwaQ0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:WPUr+NQ0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B05F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 10a9b976109d8ce3853b8df5d14d5671c81144a0a29822ab5807b2035338e22a
MD5 a7593271121edfa49f4690f299f962c6
SHA1 4b26652ae9b9f8a3ec3653905ce872f9f79dea89
SHA512 4e2caf22d239318c6ed29b4e3c6e25ff8cddb2a2d1f5fe2884fb555d403a2ff9d7c8799d80a25f999b3efc968c8b9fe1d3975204062a26033773abb0739e649c
SSDEEP 24576:aD3FHshBIYQgA9sqjnhMgeiCl7G0nehbGZpbD:aDVHeBIAAhDmg27RnWGj
TLSH
T15325E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/248-22-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/248-28-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/248-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/524-66-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/524-60-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/524-293-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/524-59-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/696-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/696-83-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/752-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/752-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/752-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/752-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/752-42-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1388-390-0x0000024D827C0000-0x0000024D8298A000-memory.dmp

Download

memory/2072-387-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2072-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2072-389-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2072-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2072-94-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2072-88-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2964-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2964-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2964-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2964-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3172-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3172-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3172-134-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3172-132-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3172-126-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3392-52-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3392-110-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3392-45-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3392-46-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3392-56-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3416-71-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3416-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3416-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3416-79-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3460-70-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/3460-8-0x0000000002220000-0x0000000002287000-memory.dmp

Download

memory/3460-0-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/3460-324-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/3460-1-0x0000000002220000-0x0000000002287000-memory.dmp

Download

memory/4336-86-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4336-16-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/4336-10-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/4336-320-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4336-18-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/4516-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4516-115-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Download

memory/4516-316-0x00000000007C0000-0x0000000000992000-memory.dmp

Download

memory/4516-384-0x00000000007C0000-0x0000000000992000-memory.dmp

Download

memory/4516-121-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Download

memory/4516-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4516-423-0x00000000007C0000-0x0000000000992000-memory.dmp

Download

memory/5992-106-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5992-313-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5992-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5992-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5992-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5992-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download