34f6953cea1a5d17c45f76a35a7bd5b1cf74b2e46f1b84baec7b8232df88d484

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Size 2.8MB
Sample260930-alm1hsad36
SHA256 34f6953cea1a5d17c45f76a35a7bd5b1cf74b2e46f1b84baec7b8232df88d484
MD5 5aeff1d5982dfd030a2524758bb19eb1
SHA1 88b155345db42209b07859ffd0ef17909ef2ed1f
SHA512 3db49ae58d61ea461a218800b64aeee986b991da41ad529b42384cbf1f9f27574ce8824c87bc3c2a73b88977359823b37883b9e310ddf46028de65906887cd3d
SSDEEP 49152:7RFPhxSMmT8oWgBCaXKZt5TkFyAnh1EVRkhxSMmT8oWgBCaX:7RFP+M4FHX45Tk0AnMA+M4FHX
TLSH
T19BD523317BCBC4B3C80BD139CD61DB255A5BD938438155E3BB1C1BA86F20AD66A3E346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 3 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000e00000001c57f-428.dat
behavioral2/files/0x000400000001b1ba-429.dat
behavioral2/files/0x000f00000001c3fd-430.dat

Executes dropped EXE 11 IoCs

pid	Process
3264	elevation_service.exe
4088	elevation_service.exe
3128	maintenanceservice.exe
6064	OSE.EXE
4208	PerceptionSimulationService.exe
3492	perfhost.exe
2632	ReFsDedupSvc.exe
4804	SensorDataService.exe
6048	ssh-agent.exe
4316	AgentService.exe
3784	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
	\??\F:\	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eb92f29f4b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000009344-377.dat	upx
behavioral2/files/0x00010000000093d3-378.dat	upx
behavioral2/files/0x0001000000009cd1-381.dat	upx
behavioral2/files/0x000100000000ba38-387.dat	upx
behavioral2/files/0x000100000000a2ff-392.dat	upx
behavioral2/files/0x0001000000006223-394.dat	upx
behavioral2/files/0x000100000000627a-396.dat	upx
behavioral2/files/0x000100000000bd49-395.dat	upx
behavioral2/files/0x000100000000a314-393.dat	upx
behavioral2/files/0x000100000000a2bc-391.dat	upx
behavioral2/files/0x0001000000009384-390.dat	upx
behavioral2/files/0x000100000000a1cf-389.dat	upx
behavioral2/files/0x000100000000a0c9-388.dat	upx
behavioral2/files/0x0001000000006215-385.dat	upx
behavioral2/files/0x0001000000009b8d-384.dat	upx
behavioral2/files/0x0001000000009cf9-382.dat	upx
behavioral2/files/0x000100000001b990-380.dat	upx
behavioral2/files/0x000100000000994d-379.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081e0585e7150dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025cd685e7150dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1570e9f7150dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c79b89f7150dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	4316	AgentService.exe
Token: 33	3784	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeBackupPrivilege	2632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2632	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3264	elevation_service.exe
Token: SeDebugPrivilege	2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	2480	2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 4340	3784	SearchIndexer.exe	101
PID 3784 wrote to memory of 5004	3784	SearchIndexer.exe	102
PID 3784 wrote to memory of 1208	3784	SearchIndexer.exe	104
PID 3784 wrote to memory of 3128	3784	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4088

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3128

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6064

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4208

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4804

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6048

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4340
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2740 2760 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ADelRCP.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
Size 1.6MB
SHA256 3fc2b22df0094ecebd78bc6cf80f1d75ddbe307151203ed5ef3e1c9916feccf5
MD5 cc2d6351035c577d02aa960d1ca7c2ca
SHA1 43e31f65fa8aa18c8c90ce775707198e59dc835f
SHA512 cedb933936fda162d09e549e9d0eaceadbcdba00f6e546bf0044da83e32bfb1f2aefca564146f41b98e7c9acdbdf779248199535cd43198ba9f82d6c09021263
SSDEEP 12288:B7EZrZxJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:FqJrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1127502217B80D06AEA9313327EFC79E44BF5BC75C6A110ABF71D4A6A253F5109236327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 0127ad9764734d7ff6bbe3bdd4991a4319994f2ac9899bec58b743f2cb9e47d0
MD5 bf102a018500b4e8b966cb8f1aa6d659
SHA1 84f694ffe33dde1440bd7d5b3311b6e4efaa0be3
SHA512 8a41b5ad7b0d29302208ffd377f86ffea27459c3a300b615d39b9fc5eeb515beaf9e35d9cbd2ea375aa8656e27111d9336cca3e59363de517eccd3d8c0b6cfbc
SSDEEP 49152:CTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJRhxSMmT8oWgBCaX:CTfiG/nzU90d+M4FHX
TLSH
T17DE5D526A2C8C0EBE5642170CC59BBF900546D78DBA28DD7BD447F16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
Size 1.4MB
SHA256 2b4577d4f7aaf7d3f6055bb23fe4d3b33c010be0b897f2f962373ea2eb7a305a
MD5 a874246bb2c0c147d76d3f53d68d7489
SHA1 e85b049349925bff5888f8da6b2cc02db62fd11c
SHA512 d029d0b05548016d82007056e85f8fff76d959600d9a4d58131e59409350f487a0497c455f4c1d6f1797381431248b177fb541ba5f10e18ff8ee277ea28d16f9
SSDEEP 12288:44JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:4UrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1716523757F0E9867DD2A8335EC329325969D2DBCF011163BEF3A2F6C3935C5A5811212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroTextExtractor.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
Size 1.5MB
SHA256 e7d99142a8af85b34f4a5df3d79ae65a00d32868eadbc1c2d763ab8eb3525ece
MD5 d1b402bc734a1c7f4910686610b0c3e2
SHA1 a9f0c7d5ad63b459596dad59e706825f1113f76c
SHA512 a42a8dcd11b77e4ede1f0f73b74677e40e023e1be1f4fc91796ac23c537f297e8c1f7c7495cdaffa6bf64b09dc5aaf5a8d8ce26908e221d98cfd3a5a0ae9697c
SSDEEP 12288:8GJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:8mrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1896523327F5A84B7DD278334DC726716DABE1DACD21116279F6A6EBC3E30C465822213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeCollabSync.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
Size 6.2MB
SHA256 4896d587691c3e1cec0255576ac5e192f4eae70464ef6e890a14ad9ad28a5745
MD5 f8df3092c1484f9e8d347fe25808a8fe
SHA1 3867a05c9a7c252855a931b58283ccb45dabb186
SHA512 290fd81eb5ea39b7518c305247f099c2e8d66dfe6b272c8a4948b46710810c17b258362b9097e8a91fcaf1e2e93e6b6a6a390702447e228610131d50c75ace20
SSDEEP 98304:4iH9MfT3NwMkKVBRr0yAk6qkKvf+M4FHX:/KBbBNp7L4
TLSH
T108668D22B902C139E15102B159ECBFE9C49D99348FB105DBBAC41F7E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCChromeNativeMessagingHost.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe
Size 1.6MB
SHA256 87215d95540960190391714db73b3c8b6691893f740844ee23974122c8e3eaba
MD5 81ab4e686c85a6aa0f9e67841fffbbc1
SHA1 7fae10b64bf88511bc8be4fe99338eb627928d47
SHA512 7454510cd658003010af48410dfcafedd4239d3506ade544217b6822bda760486851a4b409da6e07e285151628040c85f2639a7b009b7066751c2fcaaa517c6e
SSDEEP 12288:dk9WbeIlafDJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:RRgfFrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T111750261F78BC4B7E8560230583AAF7641ACEE7C572105EFF3997B1E2A702C21432667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
Size 1.5MB
SHA256 f04ce27154090ea6289a7d8df1b90b25ceb3e031717f63e9693860b90ab3cef9
MD5 970a3867c6c5b1572de726fcfac2644a
SHA1 f1b8f5a5f2a7fe14add8a301f84ac63bdbd894d5
SHA512 1c69bbb8d3cb99a7908b8e0e84abbd3d89a2308f58eea392f114483f6f6f002fc6611ea8387aea031d26d9d7dc231812076e03f55b75f5f019628943e76007da
SSDEEP 12288:5JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:vrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T177751263BBD5D4B2CA6203349E31B72796DFF9B89A20DB277F4D1B5E2D708464C08612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FullTrustNotifier.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
Size 1.6MB
SHA256 8c3a85f868ff6fa49352b734c2207376ec947e1b08675be6983285287fa07fc4
MD5 d9f8eab993c8f30c89e1684d8b2da482
SHA1 2af6c4adf0525585ec9d86d7604168484f5fcef6
SHA512 65beb4eac11ec102138a2321e09c488a87ee4c745f1a7cc5332ee7fb494cbc10b2e3ccda8f56824d85e443847528f849a3e51946cf1fba02488a730585e3a9ba
SSDEEP 12288:SwY+FUByJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:SN+qBirKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T15585F0307B4AC57BEA6301318CF8ABBF945DBE580B6511D7B35C4B6E2AB04D32E31916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogTransport2.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
Size 1.8MB
SHA256 71cca40844bf5c49199b2099630c373b9759eff329068aaaffa06f5a74ab14b7
MD5 4265fa2c6654ada41a7f81adf61910b4
SHA1 3d890a7b26ac27eab49eac5a8a4541453286aa56
SHA512 d6b96cdf4294141cd6c974a8bc1ef7f936f87595c82f794c21b4e1754f9a0dcb1ef14975fd65f180ab74ad989158ebb57aefac2753b16939520d77f225f92c2b
SSDEEP 24576:IKWyDZTRW8fdeZrKhxr+EHNmT8oW4ll1JCrLKXI:IK1DZT88fLhxSMmT8oWgBCaX
TLSH
T1AF850211FB4AC1B6DD6602328DAA631DC4BDA8748F214BD3E3DC6F1D5E704D29932B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 1.5MB
SHA256 41af4244b76cb2f046774d4d9ecd61cf65c108e4b71aed343305c87985851843
MD5 1ae8a6d09b901f778313f6186a9dbfd9
SHA1 bc8d7e536fe08582bd8457210c0161bdee7080b4
SHA512 7f430d5c0c7db135e73ddbae7667c986a3c36d7155a4a7e3e6418dfb8e50f8311126428fe64efce06feaab2188f3cef09f1b542af3ecc26be15be4527673fef2
SSDEEP 12288:0YmIjE7AJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:k7crKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1EF7522317B42D033DC968234D925C7728E7E2C78A2519917FBAD2B7A2F30B95D626313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.5MB
SHA256 0864c415cd2d4357bc16d6ce7efee8cb9c9f76987af7ae937ec4dafac7f0344c
MD5 3bf47e39980d22e0f32f00908d997380
SHA1 435806f49f44a474cc0b3db0ce3992f31d5acdfd
SHA512 718f4de66f2dee75c8f9644e9e4bc5859ca75ed01aea11b0b8ce49e6482c51a62af735ffcb842ef54337be723836832ea55a94b4a89312d2e8c29335b7d30e06
SSDEEP 12288:h5ycJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:hVrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T18B751231F6C694B2DE3642328D2A6B5B905CED7C472154E3F3A84F3D69344C39AB3662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 1.7MB
SHA256 6fda420c7ff0ad7f98e1c19ea8b17207111aee45f15c030db3ce7b8771c1f5fd
MD5 0b9d38c88df2b424deba23a9494cc921
SHA1 614221ef6fa7400a5df452225da62f359bb9ee26
SHA512 e9b5e3f1025c7231ad235af7148feeb49e84ac0c4c91ae384d5c736fec880f6aaac2ea6093d3f11320d71fcf1453ea1d6b8f0c17e8afeb0b8f741563848ff46d
SSDEEP 12288:8ZKKiHMYcy2JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:EZjprKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T13785F11A37984CF5E867C239C9524642E3B13C994720D7CF6764476AAF33AE0AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 1.5MB
SHA256 077497747c998c0e82926de2b285b8061b87e38e7c5d9ebb5c6f8ab84f12335e
MD5 e9cae3171286984e0c72d7182ae5b45f
SHA1 c89732e69179dfee2590e7fdef83f686a374cdaf
SHA512 8e04408cc9f910e36702b086e31cd979f56baec4f18226f3186ff0f2da8d0d7bcd991a0f985a24ca028ae19a7e7f4fbf5dd1b8acb8f2e038fde95ec7e129ae66
SSDEEP 12288:qFtMJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:YtYrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T13F6523237F0BD963DC11823598625B35D5FDCC68EB012BB39F292B6D5D788C6187222E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wow_helper.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
Size 1.5MB
SHA256 55d2f3c3739f01bd072a065f22dbe9732eb328a6ec27a2eac9aa6caa42ef470f
MD5 0b93c8a77291922993f8c150058a0bc1
SHA1 757b7de5ae0a3aa5232e90dfe6559e108b41e79a
SHA512 36710e7667d729f8af57e48a1896d69a27381ab858eec1bcdec9bf98d3146bdd453ddf23cd7f110afb595382ee2105cf3a728971be70f4cc6e615374e6e3faa8
SSDEEP 12288:h0Ql8HoEJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:NhwrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1EA751267779A30FDE9378239C8620A05DB71BC7C52219B6F4B6807692F336914D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 81f45f38af736be21528c91d3b9013481499f439eb1e94b458227020e9fb2f92
MD5 e34899a1396d7573ad594b6b16b6b259
SHA1 82275d4631305254e641e0d382b2cd3f9ebdd906
SHA512 951a78ef7167129b86594e78ae0dc82ec8c91c9b4a0eaffc4a303cda019e5704b8969afb3717f60f61304e8b24eb1df4073895fcd7bbaa89f613c334f3a1f921
SSDEEP 49152:fSgouvAeFfenxyQTXS7uQ0NI9hxSMmT8oWgBCaX:fS1uxaxnS7uk+M4FHX
TLSH
T17B855A1267F94129F1F37B71EEB993645A777CA1AE39C50E5280025E0DB0A90DE32B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.8MB
SHA256 8c9e65f3c019ca487c3b8c419d5c80ba5bb536a8177c2b5aaaa7bd460ffb9e43
MD5 0b7c718d43feb3bd420e0de6d407a4e7
SHA1 1529af47a6d7c00834a8aa1df1cb39293aad0f6e
SHA512 500ab1548f4855bc21dda1d7c1f62fefd7d3cc4ea56cce676eebebdcae55f6aef9b046b47b5c7fe737f0a02e32825838212c38082670c512cc71b23cdff7e783
SSDEEP 24576:BHTAbD+OmesrKhxr+EHNmT8oW4ll1JCrLKXI:pTAGOmefhxSMmT8oWgBCaX
TLSH
T1DD95E01037C0C036F5B319368ABF9724556DBCB15F6882CFE3881A6D5E70AE1AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
Size 1.9MB
SHA256 7e56de3f75231419b78dc40c69d8bd07f19a6444c136ddbf6c6807760d9d7077
MD5 94fddd71c4c3bb83295462b08ceeadd4
SHA1 4cf4b039afcb0e0d3e13bf43a0b08f2e04576b49
SHA512 06f97cbf6e1e65244979936a1cfd73c2bb5897d2c34dc2b660f4ee4cc27280dedcc9ce701c2bdccd33674b44f2466349c344f09998d5e70d1d363bf923681411
SSDEEP 24576:NJ7RK5jjg/PzNWyr+rKhxr+EHNmT8oW4ll1JCrLKXI:nCjiPDrBhxSMmT8oWgBCaX
TLSH
T1FD95022439A1C032D53302314D6AD794A77EF9B44A2249E777D4AFBD3F309C1EB246A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
Size 1.7MB
SHA256 f4d88178359f302e7f95add6b9a1acaa563e8aa0ef656251c53f8905ea03de6c
MD5 46722e27117d7db309de8f816c3ed77e
SHA1 a2ea6b18e4d530cf8a2c6001dfce53cc150e3dfd
SHA512 9e4e6307c19f80fd08f15961e6ba97de9addae530912a96dffd972ee49c9aef57f8c117c1ed9a40b35e95c67c043837d7d573712da20b701b5e006cf8c948d52
SSDEEP 24576:XZMEzFVSOnrKhxr+EHNmT8oW4ll1JCrLKXI:XZMEzfqhxSMmT8oWgBCaX
TLSH
T1CB8502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
Size 1.7MB
SHA256 f88c5384a86167a48ce914b5e6dbc8357c372e95000b88ca0069c72f25c3f5e2
MD5 b12f2b1c0217ae0b6c112a5abdd3b40b
SHA1 a1c4c6a9a32899edde0fb82754dd0cbda90b608e
SHA512 b1787dc2b41b2e9e8067c7ffb6f1219bbd8a9f90caf80feba95ae2ca418c5dd9e29f705eea619bd34b07ca44db9334f1ee327402f43b124d8f10696ac5f5bf73
SSDEEP 24576:aTdaLl3z0zDRrKhxr+EHNmT8oW4ll1JCrLKXI:aTwLljnhxSMmT8oWgBCaX
TLSH
T18F8502A5B35018F9EC67823ECC628916D6F27C5A4760C61F07B8366A5F333A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
Size 1.9MB
SHA256 b06d454b6e1f758b94cfc15a0f2bdc999fac660fa6701199bc3c971c8e133675
MD5 5318663819e8075c9ba1680b208f9aad
SHA1 a825ee99b8828353f831257e6deffca796cc2927
SHA512 570e29e13db41aafa12319b949e9233519d60d8fb13036a0e06ea8f686e48ac60304653b5d6e2a9e75d497cd6f0b0c2843bd180b777284b4b92bc73776ced85d
SSDEEP 24576:U35d9CHKy7GZFrKhxr+EHNmT8oW4ll1JCrLKXI:e5d9CHKyaqhxSMmT8oWgBCaX
TLSH
T11A95CF90F3E414E9F0B78A35CD724511DAB67C995B21DE8F03A8265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
Size 6.2MB
SHA256 9b3395c64f5f8cfe1857436600f3e4dc9b7b2b549734bc3a2a1de7c1d87238fa
MD5 600015c7488f0b85594a45fffc3a1a61
SHA1 2ef40791c1bf8e3e8e8ff102b30a4acd8c0f63e0
SHA512 2c3909d27f88a2be5293e3405fd9e88cc6230e61198cfe022133d312ab979a6c23bb3e9fbff96ba357692afb4e41969406e4ae35ae26ee26f0887f214d483401
SSDEEP 196608:Pog1P9fIlOub6IgF+I3m2MXP6HG8Qz04:PognqOI6IgF+qbM/6HG8Qo4
TLSH
T124668C23A4E04035E5F733356D2CA7395A327BA29F3145CB86946C946FB83D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.2MB
SHA256 713a877734b4bbbc39bca372ff67fc23826c8eaca3d3c2609275caef5fa3588b
MD5 acf6ba4dad3494210b3163fa88c86b42
SHA1 ab5f53b2fa5000b7f2da8a5ff13e92ea946fae2a
SHA512 2fcc519236fdb8f12a489b6885c6be370c80ddd1394cbd8fd037add8aef89484154fd6528f076f5d1dc11adc36489e755964a5623fb476d5ee265a6dc65d4831
SSDEEP 196608:hog1P9fIlOub6IgF+I3m2MXP6HG8Qz04:hognqOI6IgF+qbM/6HG8Qo4
TLSH
T185668C23A4E04035E5F733356D2CA7395A327BA29F3145CB86946C946FB83D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3fbebedb4118b1561fb2a521c0b772a186a4d8e1ee1c2e28b1acec287ffbccf2
MD5 65dcaaef3e1d3a8aaee934c6706a2525
SHA1 7593b10945c8af423ef74c0578f1709bfcf342d5
SHA512 25304a422e2d022b8b863508347c6533df7aa9b22c014a8ca7038785b7304306099fd3f12d41676d886831f9288dae828b48a502269d266dc4333f70c1e7e279
SSDEEP 49152:Nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn8hxSMmT8oWgBCaX:T3q6HjBV+M4FHX
TLSH
T191D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 895bdf5db64abd4a5eb5f979fd42e4ac28ceb6eb43c16217f56a4657ee4e0d9d
MD5 a11ebba91ee1cb6a313ed00850ce49d4
SHA1 971218c6a09b946935a212b274f1912e644ac220
SHA512 422b8e249b84b9b0b264f8d1d06b95b3890a726dc024fe73560e115a11a0839e6e224dc03cd3a98ede87a22874e75b5560fbb3c05654118e09582ab0ae543b9d
SSDEEP 49152:xtcShxSMmT8oWgBCaXKZt5TkFyAnh1EVRh:xN+M4FHX45Tk0AnMd
TLSH
T110C51238B3D648F9EC1BC13CCDA28512EA73785543D0F7A703A89A651F236995E3E742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 e599b50853c1d0318bf6acf1ed956c26a7f7f5d77e8c981f53a00ba3fdccb36f
MD5 1596f5c517d80da589a42c6cb0efde21
SHA1 c9aa9c79e6dd33809adf86031d95a0efa1ed917c
SHA512 390351bb7b73ae99c6cb66798572d2df4a0805efa7dbc197b5418a3dc223a42967e9220bd594fa55704d1f9953abed9ea78077bedb1788fa79020a4f1e985829
SSDEEP 24576:jXYfDtczAWrKhxr+EHNmT8oW4ll1JCrLKXI:mtcShxSMmT8oWgBCaX
TLSH
T19B85012877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 478eaa12b56521a5ecfb8e093022523fb1d4e9678167543fa8bf21535f7e7ac9
MD5 ddaec08b5a9db9615489c1662b0b3c5f
SHA1 562379fc74abf75231bff030bbe14b2f4a7061f0
SHA512 dad277e9e205d417e2cd5c87660352ae049b9d35efc5d9a4f3fe731d887a8a45896d3c77014fdadbfa565ef1083be6185f2768633ef4f98a81376aa2cd56e4a5
SSDEEP 24576:LwuSOW8rKhxr+EHNmT8oW4ll1JCrLKXI:Lw9OKhxSMmT8oWgBCaX
TLSH
T14985F14677A91CF9E9678238C557C136F7F2BC052621DB2F1770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 815b2bd22a90b56c100df8fb7bea5bbe06bc91fef7affa69f9a5d40562320292
MD5 e953e222971a15ff5c655c9e9aa3776b
SHA1 cc9ca9290951762fcb5647c9d6d883b3708c1cae
SHA512 ccc34f91462842798d759d6e9b33a2aef723e028294cfd65087a5d0b4464726123c8f75f957c8c7a7552a523245e82bd1b61b4cabc85ccc5581ec74fc3b0725f
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glphxSMmT8oWgBCaX:Bu6JmVxd2dp+M4FHX
TLSH
T184D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 421f7b7ef347d55fd5cb8f3808bf5c25d1779ea701dd57cd4fd7e696448f25d3
MD5 63e0c3cb5d2caf7952e08ec53bb6728b
SHA1 202eae5552eb110a7be8504f8308aa9cf0650c88
SHA512 cc4be95801c079e424e7fbcd4652e0e7c5c4ee3a1ea0920a08cd2617d2018647267f854fa2339dedcdde0f5c58c95d2c8898548b4c70f19747c49bc8fd9f6f62
SSDEEP 49152:TMnYIwhxSMmT8oWgBCaXgZt5TkFyAnh1EVRh:oK+M4FHXa5Tk0AnMd
TLSH
T156D5F129EBDD48A5E077923CC9B3460AF6B278681B71C6CF025953AD0E33ED45E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 fab6b749631c04dc570683ea03a71d32c5af2537e2ba29e70c1454ef69a5471f
MD5 fd2dbab21a0b8d8033429a6c444da473
SHA1 c6c2df655f662f1c28c3ceecd4b974162967a6fd
SHA512 1b97c705f30eb81947980b707a5d4d4495c979c5330fe2adfd9a4b49256dad9b968c4cae592318360019f85e2156b141a10b638970401f4d9086a02290ecb83d
SSDEEP 49152:cYq4Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZhxSMmT8oWgBE:ZySzPB+M4FHXs5Tk0AnMd
TLSH
T193269D56A1AC41D5C1BAC1B98F1BCC1BFA7134090335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 9131071a72d51470039c8c345e68efb0cb89b4691dfc9915045bd3713e521b34
MD5 3d856611e6f90ba360aa69fc9075e2f7
SHA1 80b10eba9679c8cfd16e6099db487d9d8615a3ee
SHA512 b43c5fd66763c5e0709e580ece2930e7a4d7edafb3e48a2fc9ae9f7468ae45ca6b03606653b29325267bed8b48eab012beb7db9a4731d9745c39f958c5b1661d
SSDEEP 49152:Wg7JUQj7irIhCnDHUPfF/phxSMmT8oWgBCaX5Zt5TkFyAnh1EVRh:1J5glD0PP+M4FHX55Tk0AnMd
TLSH
T1DBB5DF1EA3EC01E5E17AD238C5554A1AEA72782D1B319ACF1270837D6F23ED45F39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c1675943b90efe15a81d156c9843ad0e3d6c1e7fbe6e6918867e54299024b988
MD5 938bf62116f58a934815329968663b7c
SHA1 595ad7ad1f129ca749ea927c9c278e9eed48538a
SHA512 7b4dd2b7cedc91f7a8bb11e51fe4b04c897fbbf99d7830b218f72e1d9a724389357d8e0286d0a68587532f222d8b06e1f6cdb8187d36c30cd904ada8295e631c
SSDEEP 24576:MjAdDLUPimR7Q9D3lKgwTlEGAqUTZ2dPZeBE:2gLUKmR7Q9D3lBwR2lT2PZeBE
TLSH
T1FF45F6017666CA8FC6A940321E76D6CCAB707D05EE446F0373C9873FD47A659BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 350KB
SHA256 9c7fd415925007587122da768729495e6c4d2b65400dade2fe36a71015bde189
MD5 68de78fadff6e92fccb7d68f83209676
SHA1 a1a639db9cdb7adfb8dd7a2fe76b2191653cf081
SHA512 cd1967e2e67196aa917e4dad9f6caa1b44492bf41f6d789c2a78cb10a938a1ea3f3990135a4ed02eaaad6fc1a7e4e5e5860b5fec5f9907a8f4e20ca6fa561b38
SSDEEP 768:tblTP/lToOlTPBlTz2+EQMAvblTP/lToOlTPBlTz2+EQMvF0Bm06blTP/lToOlTd:AAKt0I0deaa0mNp0EErn9e0j8NpPik
TLSH
T14D74B7117734B229C4B380774570AAABDF3DF013DF524A012BD90DB1D8EA29766BAF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitCompare.docm

Path C:\Users\Admin\Desktop\SubmitCompare.docm
Size 777KB
SHA256 1e54262f9b85e71d326e1acc410bdbce75d13dfc897ed0871bf49f4d6e6cc3b2
MD5 415748d244a15fbb7e6f51404e2eb90f
SHA1 7fb3b978bc07bef47db7af8476e4454365f6a891
SHA512 bdf30246b25c60844bcd93bbd35dbfd4938f7dee30ad83ec79cedf31c697c29f23cb5d999a8133ec94260d4b595885ebdfa67aeff7d18625f67b9c29c46959cc
SSDEEP 24576:++NfIGj6UTmOlqEElzrFAgyG1AbZ6maEe:+cwtUBlqEEl3FAkU6mPe
TLSH
T161052349E492EDF4E9934B77012A35A0C8EF2913E0F7945107C43176BFAA6FB2947B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectSend.docm

Path C:\Users\Admin\Documents\SelectSend.docm
Size 779KB
SHA256 303ee135ebc7deb12c9f1972b13a2ea9c839dcaca258e73096311460e8362d9d
MD5 c7d28bb608c4b324a8b585626ed0eb95
SHA1 69fb74dbcf2eeb126eecef15d2bfbc2983f0d1a7
SHA512 db5a5ff0a6142f5c37ab1274a019094ef2e6f5e7cc584c5de8411557a6e5c03d02153d87703097d781576a8adba31135d410d1670846c4bdde073e4fbaa46643
SSDEEP 12288:/gy1axyDva/RVcSnIyYAM0RHO3dx5G91Cnqqd7h1bdriuyM6M58b1kYzFWpqG:YIa8CTcS/M6Oj5g1C7d1LriuyC5eQph
TLSH
T1A70533106B4C58CBDB10593824B9E69E5CF6173E4ABB8BEA543383425FEE2F85B04713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateUse.docm

Path C:\Users\Admin\Documents\UpdateUse.docm
Size 775KB
SHA256 09c4e1357c184c516f178b284cf2af56ebb3b02a890054a1aec8a3d57f3e863a
MD5 c24894c6d45a7dd5dce028c2108804f2
SHA1 24ef716184d562385a5124f40c0d14807cd26793
SHA512 ed7f29047abdb841cb554356e4f24036ae8198141447b03738152b02ffea18c7342237300a1724dd3f043bf2bfc4aef078465a60895aa7375c259eefd0acb94d
SSDEEP 12288:uNCSbleQ6HMHcJwRWY8qpwNj0oTTlzs4F8MMkKfCZHRCW2KuZ6jSrkSs8B3oAG:uNpqmWY8qwj0oTTlzrFA1Cv12bZ6mNE9
TLSH
T1DDF42394CA73F6A9C1834F3687089922F0EFA24781B544B716E4373A3E549AFE446D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.9MB
SHA256 7233352612ed154a28deb18f7fb24c90a4c383962f388c816ca7e8743a57387b
MD5 367fce93d332ac7078e09ea98ebb85fb
SHA1 40ab736d1a621f7059dfaec3538097f8d71bdfd9
SHA512 3d8056dba24860c437fd248ce6703aaf91bf3266d71c8ccf126864bd92772e739799a5c1047598f757287cb42e340d83abaac007a2542eb1876aa6cc79a4cb84
SSDEEP 24576:83n9i63igrKhxr+EHNmT8oW4ll1JCrLKXI:8X9iMehxSMmT8oWgBCaX
TLSH
T1CB95BF12B7E99035F6F31B31AEB592615ABABC719D35C20F23D41A0D0DB0990EA75B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d6e4517229f4bba182a627688b3bb1a830730e1c7c000a279847479af6d6bcb0
MD5 d01df3b9d2a71b0af5ca6b71be4ae91a
SHA1 9f718b546a4796ecaf3d652815dd68d907ebbcb3
SHA512 7dc5d779556bdedea30d6ea27232e75564e71b79cd47d2ff6af60d8900ae211ef516dfe32be2108831a62effc8344aa462a9fd2479c257e436deb8fcb41aea1d
SSDEEP 12288:gO77JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CXD:L9rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T14E6523719B0E989BFC3A8334E8664331695D2DACD30055FBEF2A2BA87931CC55D72712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d7f4a48cb2715133db85dd8aea5bb9637dd22f652e759aa81ba82923650dcaa4
MD5 6a58bf7c8afe8b0808ef87f129c91eac
SHA1 195b00b5a15dfa6ded58665866c2dbb6b9545d12
SHA512 293e7b67a8ac85d66461b819594c3e8270d0a4dd4494886eb1b069dd44497faba802d8a5fa5db5a0b3293215b078bb91bdd5881e6670eff1fed2ba5606f397f3
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYTrKhxr+EHNmT8oW4ll1JCrLKXI:Ngb4mBIBhGF3hxSMmT8oWgBCaX
TLSH
T1F9659E1E22EC02F5E0FAD2B8DDA64417D6B278161331D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 2a96e6134d15041ce9631a40ea5a61bc695a04ae9e6f0fc358acaaab62fc4782
MD5 e8696acf7f6f8e8c4c0a46ef1ae5dc28
SHA1 ede5f8c77346c3fdd83dd488b11fcea9d0d59c02
SHA512 3c023a33cd744df78b79981711a045911e45e715467842554d89d9608024cc72f5cf0bdec8c528b38f34055a36d2238edfacd954d64dbbddca999a99ebc3d127
SSDEEP 24576:DGh+lZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:DGCZt5TkFyAnh1EVRh
TLSH
T14B052329B3FBA8B4C12BD13DC9B9A9973863712007C565FB0488D2745F016E66B3DF4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 9fa29bc96637ac9dff2e797864fb2090b991695f549debe21dd1817a625ab3d9
MD5 66828cc259bdbd543bfd215a7dd0eacb
SHA1 bfdd5fc136da97a1bc9f01c1e2246b6a49fd2eec
SHA512 90150b0eafc341b0554b28a861b4db64e13bf6b4726dc624bb2260bf18fd29149ed3c10055bb37d1538b2944c0dd61563968c45ae7d8c62cc3642974ac27c5be
SSDEEP 24576:nG88u8FpJqH1hzria7/mUrKhxr+EHNmT8oW4ll1JCrLKXI:G7ZFPqVoa7/ahxSMmT8oWgBCaX
TLSH
T1B195F16567E501F1D47BD138C9824663F6B2B8250360EBDF0BAC8B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 9f528d0535ba6ed9706a4ddadb7148640aadcb0c89d2c6924eac6650d68cff21
MD5 9dab095e03014ac055ac5f8b424a4c93
SHA1 d0d801a533384c16447852fe842bc4da0d02ec6b
SHA512 74ecfeeea182907258795408413212dbb6bba7b5d5fdc99cd58eb52f768c243d70a0d533d0c4d7f8d69c201dc77f0cc1e21033b3a9b5624363f400dc5bda5f94
SSDEEP 24576:1PUr+NQwrKhxr+EHNmT8oW4ll1JCrLKXI:1JQDhxSMmT8oWgBCaX
TLSH
T17985F12F269D18E5E67AE13DC9828719F7717866131292DF02A1817E5F33DE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e6f3654eb3d0f1e6df6089b9a6dac1b986c8466be3c7caad934c639cc3b95130
MD5 9f1e19e92f5cc9c700f85e430be4808f
SHA1 3d83028fe732827a2b727facc469adba32c77541
SHA512 45b5cf1d01bd6786e46fdf0c36cbdca0678e1b1133f718a444457e7c14885fe7391db8fc0f20a87b389ef1ce6ac6d57be9e9dba34809ebc0563b21ece510bec2
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzhxSMmT8oWgBCaX:eG05lO43bo+M4FHX
TLSH
T1EAD5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 30d4eaaa9e39124916f5a5a59dfc1c4250e806331be5887843a221a0208362ea
MD5 18af77060b099b3f368c5887f90d07cc
SHA1 33a42d86e75bf7b2ac0dde4ca5aee67e539d5b0e
SHA512 796c45e7a52bb7899caa208249b15775edcbc02eab9a0c652bbd223db972bb68b90ac2a01def7fd41af2f7b9e928fa9893c867880b2c048372cbe5539a863626
SSDEEP 24576:pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn2rKhxr+EHNmT8oW4ll1JCrLKXI:5a5POZ3+Jt2pasx2+mbhxSMmT8oWgBC8
TLSH
T1FC65AE5EA7EC00D5D579D17DC583861AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b4aa97234588e3ee2d3d7eefdf8da6a482332e8bf91a873fc04c5e530316daf2
MD5 c9347520d579d9f1d3ed0bba8e88a272
SHA1 cc08134916d4d30e003c90799cfe1fdb9b5d61c4
SHA512 a99335560feab41c9d2a6c3e1236f56e7ede4998105a0f19ea0616229ab4e64ccb6f99d969f372ad13250935b13b95a52f6468973df9ba0c9957fe369a6f737f
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkcrKhxr+EHNmT8oW4ll1JCrLKXI:3Nc/zEOVHF6hxSMmT8oWgBCaX
TLSH
T14B858B2623E900E4E5BBE1BE89779546FA717869533086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 357aeeb097955359bb4cef8afb60c43cbd7e72619bdb08e179e8b6b04d05f4a9
MD5 71892997dcd268542144b19f1d8909e1
SHA1 4043d7f65f0f50af68ad4b1bcad327e886a607a2
SHA512 d145f2fd6fc8b2e8fd5afc10b45442e3430a561d95b1870afc3d062118a914d3743335f6dbd5e39814ec70feb80ddfb3f3765c494180ba8d6ac15a95b85fa1ff
SSDEEP 24576:66DINlZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:66DIDZt5TkFyAnh1EVRh
TLSH
T17525011D73BB10B5D16BD03DC6920546D2B3B03187926AEF0688C5B95F93ED9BA3CB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 27688141fd527588009c2354a80221c395b570272547e460e45fa3137c6f5ba7
MD5 cd2b2dfac55233f804fb06a5337ff7e8
SHA1 f03b9afbeecad9bb7e8bc4bd0bc4754063a8c19d
SHA512 a604dfe15344dc5f7d73d498c6256588a29efad13b620e72c2800787e47ca93c13a8c1b8203622c917cb0b898c8957c58e62a9e317c8d9be5e8bd7750bfc1f30
SSDEEP 24576:MtyxlZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:MtAZt5TkFyAnh1EVRh
TLSH
T161152311A3EB98A5E16B913CCAB695955E37BC2007D163FB1084E32D2F227D56E3C70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 beb0e35a58289ad19e41035775f7134793b169072da80681c0dbe9b9f1385f3b
MD5 b7b9d5b6e963e62fe0d59538992afb23
SHA1 7f467d40e45a741cd1b51cd94d33d2f73631a0cc
SHA512 3e65250e4287b531eeb70a367260178246a56dc3fdd4506fb2286d7001411a86d9fd04e0a7b36d825e90abf38c173721792b48845104e31c469414e900c135fe
SSDEEP 24576:zAlZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:zKZt5TkFyAnh1EVRh
TLSH
T108052329F3EF9C75D10BE17CCAAA699B2517713407C666F31488D2A41B016E71B3CB4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 6b0824cfc15f92891052573f5baa16b6a2f19cb7d5e34038fff2c1e5371d4dbd
MD5 1e2321e1c3b103a6e91d1324c870e950
SHA1 dfe0935ad4d1c2bab2bd2eb4addd1a177b38909e
SHA512 9e60aedcffd2da65d6b950fd64081d5ca7938d4c61cc73542029838547f3c331fe303d2c3c302e8b2b8108acd44927e9a0c73d5b7c32177e4eee8a10b3ac3ff2
SSDEEP 24576:cggILoTfaidZt+lZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:RgHTrZeZt5TkFyAnh1EVRh
TLSH
T13265AD1DA3EA09DAE2B2D239D9721493D633B4311772D6DF2448C03A4D9BED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 0ee20949c5069a68825e5a988bcd1642f1045fc7fd7483433c2248b0ae030639
MD5 02360d620a832e560c48c5905ab85be7
SHA1 4cdda65542416df0a425399946917cf2e4133d57
SHA512 be09d8b11fdba7e2e9ecc79994637436a9dddbe5f39da2b55baa0d7a617df1e698827cc3c66b9fb1bf97be8b18b22c06eae082258536eb8d7c41bf186688c5cc
SSDEEP 49152:Sgb4mBIBhGF3hxSMmT8oWgBCaXEZt5TkFyAnh1EVRh:Stq+M4FHXu5Tk0AnMd
TLSH
T1DAA5CF1E23EC01F5E0BAD2B8DDAA4417D6B378160732D2DF115142692F2BEE89D3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 4e2640daea60b005d8c6ea9c196958907ecb2eab1b23b9eca57f0e2016dc4673
MD5 8dbc53159c9dd01634dd878ccd0f79ec
SHA1 a8d8acef01fd527004990454a10162835bc5f625
SHA512 77ca336d082b6bedb55906dca56871e2ace0d7941e95d762c2e1a6cb9096264d1f33ca5567a4256000228f2d346e1b18f47d280d7e2f9e9121b06afe3846cdbd
SSDEEP 49152:wDMwBtOmdhxSMmT8oWgBCaXbZt5TkFyAnh1EVRh:aFF+M4FHXH5Tk0AnMd
TLSH
T1FBA5D02EB7B945E4D1BEC674CE238512EA737461033293CB5294C13E1E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 f1e41fafa5402e9a7ce8d81d6072a67f204b95f495325cddc85f177d5d8c7e5a
MD5 ab072575dfbc37a3f6edd711a05a0b9b
SHA1 98712dd7cfedf5385ac4fa94190081ecf17bec36
SHA512 49d7ed317c441eb6baf20146dbfa83f0642c6208887cf7985f80bdd7e5f54fee0867e436ffe7326620791b1bf5a0299457963d802acc9d871ab6fdd44ed7ee20
SSDEEP 49152:gDVHeBIAA4hxSMmT8oWgBCaXWZt5TkFyAnh1EVRh:H+M4FHX05Tk0AnMd
TLSH
T13AC5023EE79E04E5E57BD17CCA638A06E67338AD036266D7059482B91F17EE42D3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 12e6a2ca1cf4e5ab5c5f0a4a3f873b03b7bdf2e069c103cb8c2f8e4019e4e2ea
MD5 7481ff5dd06cd70150390a70011cc621
SHA1 5c3e3a3238e1040f71904f1367110f3326437ea3
SHA512 058aef325e970be429ae320f8c7c771207b2ce3c218043449b804ccb7d54f962cb8439438013374d7953e355bbf57d24d7d879a9e4fa59ace48fc8a3232661b7
SSDEEP 24576:WJnJPbzB4SDblZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:WJnJv6SNZt5TkFyAnh1EVRh
TLSH
T16235E13DD3A910E8D4B7C2B4C15A1A5ABE32347D2B1669D719B4D5343F02EE0AA3DF09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 baf0834b9f8d8a2edca72fcd1a79da27f645d9c8c9460787959a4ae0f6051a35
MD5 df3e51f0a0ac6320d5463b1692fdb0af
SHA1 19573b62f7cffcc5086a521c8b5d87344cb228d9
SHA512 5527ea24594d5ece70a058ed5592a75fa7a217909ead36460314f74d237862d21edbcb34d0aba7aad955a4def4936a0c7b3b51c4d7760dde8a5e2b57fc90fd27
SSDEEP 24576:fnlZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:flZt5TkFyAnh1EVRh
TLSH
T1C1052325F3EFCC75D10BE13DCAAA699A2917612507C666F3540CA3852B016EB1B3D34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 f04fcddc0f056d814d200db35b0fc0f429e3ad0f8f0e268ce2d539e252aac440
MD5 e0d9b510ef7d84a731be3affd517a5cb
SHA1 43d898042cb681747b17e8d0a51719caad1f1372
SHA512 cc1f5deeda4b48a0dbe3353cb056f499b285e8ae21144a4be145b04459a1ac9c7b86bec18f3df32073015e5254ea82616fbe2a014b3951967ca05d4da686a12f
SSDEEP 24576:y6UqjpblZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:y6UcZt5TkFyAnh1EVRh
TLSH
T19F15231EA3EB58F5E02B9138CAB585264563B83103E665FF30C8D37A4F31AD5563EB06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 c2c121e672cd8c5b2d81289dba066a8c7155510589459cb9363b286e9f9e7e7d
MD5 8151acfefbe4c999c103ca9555a57ad3
SHA1 72189d5e1e5573f60b4c040e6e309be66efc83e7
SHA512 e7173e4d6a058cfef04a5cdfc7fe9fca1a77b114e1fbf8d0a201fc86a9a91a448a2793c05c60f4291e11fd690281a8e6d9409e61b963fd0fced6bca4ee8a737c
SSDEEP 49152:JCLHGeeV5ijCmlDWDkJZt5TkFyAnh1EVRh:Qj5Tk0AnMd
TLSH
T147A57C05E7EB4184E8F3CAF5CA2694169A337C549B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 57154709fa42ff80069feec67f4fafec1c72081c3c546857f365c9cf2e854498
MD5 917c469ba7e0697486dd3412ad06e6fb
SHA1 8a21b3ba790f1588a40f513324b60fc73b2b5a16
SHA512 b7b511ac64617dae9ba42b070e90c9f3eb9db7030d3347a4eff18b5bc6fa17ab623039ad0e0f78bb989c352803dd469f6a00933b544d964360854eb0b4153bd5
SSDEEP 24576:9rcmRnlZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:pcmRlZt5TkFyAnh1EVRh
TLSH
T12625F11AB3AF00B6E16BD13CC9964556E6B37030139267EB0194C77D5E07AEA7E3CB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 0b0b082021c23c8a7315c423758fc1acfedc792f8629a52d5d43943a0fee5d4a
MD5 6de5b26a66769a269d3ea2def96f4c00
SHA1 9d50893669ee2b0b4066db580022aa7afe562e6f
SHA512 13e53c1d101beec1c2debdcefdba794b563059988f652ac7e34f21b2cab7685e17b375f9854d70aa622180307b3f149968151b86413301357e25bc661b0eb68e
SSDEEP 49152:5DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3TZt5TkFyAnh1EVRh:q3Upow8sBM5Tk0AnMd
TLSH
T130B59D3DA2E800A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2480-6-0x00000000024B0000-0x0000000002517000-memory.dmp

Download

memory/2480-62-0x0000000000400000-0x00000000006E0000-memory.dmp

Download

memory/2480-7-0x00000000024B0000-0x0000000002517000-memory.dmp

Download

memory/2480-9-0x0000000002F80000-0x0000000003005000-memory.dmp

Download

memory/2480-100-0x0000000004040000-0x00000000040A7000-memory.dmp

Download

memory/2480-0-0x0000000000400000-0x00000000006E0000-memory.dmp

Download

memory/2480-16-0x0000000002F80000-0x0000000003005000-memory.dmp

Download

memory/2480-15-0x0000000002CB0000-0x0000000002DF9000-memory.dmp

Download

memory/2480-1-0x00000000024B0000-0x0000000002517000-memory.dmp

Download

memory/2480-95-0x0000000004040000-0x00000000040A7000-memory.dmp

Download

memory/2632-282-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2632-364-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2632-366-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2632-110-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2632-104-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2632-112-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3128-52-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3128-53-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3128-54-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3128-58-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3128-46-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3128-60-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3264-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3264-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3264-28-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3264-29-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3492-258-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3492-90-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3784-161-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3784-168-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3784-337-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3784-162-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4088-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4088-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4088-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4088-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4208-86-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4208-235-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4208-74-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4208-80-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4316-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4316-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4316-143-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4316-149-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4316-151-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4804-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4804-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4804-322-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4804-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4804-117-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4804-123-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/6048-136-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/6048-137-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6048-130-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6048-319-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/6064-70-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/6064-64-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/6064-63-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/6064-211-0x0000000140000000-0x00000001401AF000-memory.dmp

Download