8c7a3981c88e37d48205c380819fb2e4ffe0b3a758c7da49a827120250da45b1

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 09:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 705KB
Sample261024-k7hyssttcs
SHA256 8c7a3981c88e37d48205c380819fb2e4ffe0b3a758c7da49a827120250da45b1
MD5 6f3ada2af9eaca0f15e03a321aae8e36
SHA1 2230fb133774114666509122580072b98e7c69bb
SHA512 6394cef1e81d39be87deb9c47a6d1fbae56eac6e3db4a50f47d82b595ac7eadd19478cf031877a472fdd880dab7137b959fbff2399a255230bb485f12be889f8
SSDEEP 12288:ehAJZFc2ms8jVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:eKZojVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T194E40221BAC1C073D56A01B14D64D7D9A63DEF300FA494E3B7813B2EAD395C179362A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4152	elevation_service.exe
1248	elevation_service.exe
2448	maintenanceservice.exe
2528	OSE.EXE
5888	PerceptionSimulationService.exe
1916	perfhost.exe
4108	ReFsDedupSvc.exe
4540	SensorDataService.exe
5196	ssh-agent.exe
2876	AgentService.exe
2272	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\17d42bf97465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003168cb1a9863dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000726b451d9863dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a85ee5c9863dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb0ede5c9863dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeAssignPrimaryTokenPrivilege	2876	AgentService.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: 33	2272	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2272	SearchIndexer.exe
Token: SeDebugPrivilege	4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	4928	2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	4152	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 360	2272	SearchIndexer.exe	103
PID 2272 wrote to memory of 2296	2272	SearchIndexer.exe	104
PID 2272 wrote to memory of 5108	2272	SearchIndexer.exe	105
PID 2272 wrote to memory of 4548	2272	SearchIndexer.exe	106
PID 2272 wrote to memory of 3216	2272	SearchIndexer.exe	110
PID 2272 wrote to memory of 1108	2272	SearchIndexer.exe	111
PID 2272 wrote to memory of 2696	2272	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_6f3ada2af9eaca0f15e03a321aae8e36_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1248

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2448

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2528

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1916

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5196

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4548
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7b6612d823e7240bc6dcc76bca9519f8ce9149d6bc3f7646af4841d99d84fc96
MD5 1866bb242cb19e6beb8a0fac52e6be5d
SHA1 da31e901839f7e88ea28811436f00c56efc69ed4
SHA512 f88304e427528b1c016eff6f28683b843ddbd3c239230bfd25faa3e382092d849cba74f82745c2bcc33427cfc25020ca9483e865ad2b7d03ead35d9a4fd6ae3a
SSDEEP 49152:Ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxnkWh4sCdegmZz:O3q6sjBpWIURZz
TLSH
T1DBD58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ca1cc7fabb7c8069b0e47d632112833c5abbd4438a85f8ac01d110aeca53f959
MD5 9b9024dedf20b77840d9113ccd8e32db
SHA1 f75fb631f816824a694dd0a6328c6888c9711f30
SHA512 f8038676c1ab5c79d581f1f7447e3df56864de3b9cc59718326804963fdc69af374983b1f966d58126dc0cd5eb6a143deaf84f965c5e90f6132b14521307d2e4
SSDEEP 24576:9XYfDtczAfVXXC8Ac2YV3swxhZPegenZPwC7:otcmWh4sCdegmZz
TLSH
T1D0050128A79508F9ED7B827CCCA1C515E633BC544360EB9B03E09A261F376D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b4a14499099f134baaa7e37e9302d4d55e2c579f67709368fcfa3025ac16e2e4
MD5 b5075b1a06e92f3904188f7185e6319a
SHA1 3f05257b2395995b8e9e3c32b63c47fc25bd333b
SHA512 b372c57e375b3b814779e4ce8cf540c249443da73552b8e0428a51c6099cede7da01a10f9df1fd80bf70a8e4126b005b72cc11e199e326f862eedd7122c971fe
SSDEEP 24576:C0Le5ji0hmxxrMqVXXC8Ac2YV3swxhZPegenZPwC7:CPji0AjLWh4sCdegmZz
TLSH
T15735AE26F6748335D073C0B9C5D2A68EED71348257308ACB4286D77C7E6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ccc690f18b22994be42d9a70cfa49fb52c8aa274da108e6181546ae9f3bf4d36
MD5 5e14fdac57975fa3205ee073fadd8f9f
SHA1 2b9d44b9bc147f5d5d90b96ee96088c67d61cb80
SHA512 b50e13b1685a097fc9c47ef46bba923bc7b46e8db8fded8253bf882b7a43b14dcdb95775fd8f66dd49be06f7fe05f6ea664a0d7c45004b866ea7bc07c44e62fd
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWn6q8wyu4VXXC8Ac2YV3swxhZPegenZPwC7:X/ezSC6vUzPveHjynWh4sCdegmZz
TLSH
T1DF756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7f949f90f1aafe19bc85f05c335e3bf3270297b99ae9f634018453c4a0bea8dd
MD5 6407d48299baf31619310e19b58644ae
SHA1 c6727b208055a121e0b0e31dcec2cf27bee073e1
SHA512 05bedafd175faf16f69ae8fdec7d8f2a597b36985a333af29f910a6e4f8090d845d7746f6efe1d9b3016dd21b8919ccda52511b91f06b6d8221fcd7fd3aff139
SSDEEP 24576:FVbqPb88hv/l+YDVXXC8Ac2YV3swxhZPegenZPwC7:FVO88hXl+uWh4sCdegmZz
TLSH
T1BD559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 cf9e22c974dfb02424b2eec5d56e218d89f8f495008986c4f07d1c85d94a489f
MD5 a4b1795d727eb80dee059c7ef6b0e616
SHA1 c1c43f941ec7d6064a9199cbd086f449c29f655e
SHA512 b56bb6424b9de5ef2a23499d050ec2c432a8ae1c47396b79cd5c27a9574f83e7c57c0408afab148b68b4f7160c1bb14253300c189850af8f5c708502e6f257cd
SSDEEP 12288:AL+VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:AL+VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1F4C423A2CE069467F7BF0674DDE4E7D9E2289F949084CD29D2817F1A6C3C89DA432533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ecc7b7a97ff83527ee15c376fcd114af6313e34bf3a553929796da1eb3065036
MD5 007d4181dfafd646825565080f141fb3
SHA1 463f0f8d9bbbcc957f22fb0507d04b4687413717
SHA512 fdf7473116a37f7e2394435b7bdb349acdf6b19f35107408e4625a9311395ccb7dee788d338854a67fb048a63e4a6b3dc7544211aa2f70f8f38e6c7cb7be39c4
SSDEEP 12288:KeBNUbTVO86UbVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:KJIUbVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1CB05CF3BEE28FCE2C27E4DB85A918340E77278304B61A3CBD165830E9E275E55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ad0b0f7a8f17849c0ca95aba49e969c8e5e975eb4e03c18ebae3be7bd92e2e09
MD5 9c042811da1d475baa103abc391d2fad
SHA1 058d5d7afeddd187d807cbd8f770c9e64ef53fd8
SHA512 04906ef721c02828e1f8b76cc4257b7c534c3a91c8d29289d4bf3b230aea86109fe44a9040344faeafd83ac9025fe5703008490f4bb51fa1f01f8311ff99f6d8
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THc:nQvGAdlCEL8c/DRNw5CGWIURZz
TLSH
T1B6266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 fd23dc0b89e0c5bbaca52a646fb53c4efd4826c8f9c2a679bdfe4c7df20b36e8
MD5 f8b42f28c2c7f622fbababa0189a376e
SHA1 56887b22b64acc80abf802a760d49948d7415e4a
SHA512 be81c9265a928fff0993a32cd595d8c51de620cb597af4a0df4d0aa090aa122e666c701859dc6cce61f6a2e0454d9192239e22ffb4db06d185b24878c4f570c0
SSDEEP 24576:30ewsAjBVXXC8Ac2YV3swxhZPegenZPwC7:kljbWh4sCdegmZz
TLSH
T1F015E031FE75E036D3BF0DB61B65C716542CAE204B911AC3E3E89E9E59341D22336A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f8f6464aba26c04c3a5f093ad599daa11133fc1c01d961064300b44031f13d4e
MD5 47a15ce3c582ccb3d9ec1b3cfd0f57ea
SHA1 7086f5de7394326077569784df36f8421459e12d
SHA512 f6e0dc75643ecb7e7632b8eb405158ad376d9307339cdd8dbba3523aa43fd97a078dc10775ba93dc27514e659a48add7b0a5c9ab898e9d5f84be24799b298721
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHap:KUEtQevvqc2W1cpV2tI32K
TLSH
T108474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6f224662bcedd8879a248d34c0eee53bf5c1b2fe9e77a0f8585e7979b3401172
MD5 83f5cd5c1957450af60da4131b064cdd
SHA1 9ae7686cf46bc7fa3a7c35aab925278a7b29195e
SHA512 c52e74f0f169883a619f8bc3d1dbc139d6200bdd709e02b96715c705f0c935af8f6cb9d305eebe6cbe52aacef9bf577ba4f3e1598d2910850ee89d9c506c6bb2
SSDEEP 49152:RCbRquA/m2yL5zifFiV+XenmE3/z7Wh4sCdegmZz:eoqHVjnmiWIURZz
TLSH
T1BBD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2d8871d191e510f1362bc8cf5b7ccee12eb4a2bfc5254c27487c81c1ade4e174
MD5 0f61747d1d43d2228fe130e66379041e
SHA1 2d2d3df58255c7fc69c4dc83fa7bd8a7a916270a
SHA512 ac5216e7b28150716a77410bf26841093c2fa54c28e3fd1c57bf1daeb98279ce800cd0dc9335086b7973bcd21dd0ec008ed1469dc459becaed5cd32973e3fc2e
SSDEEP 24576:dAhGL3IFoiwtA5l7S530VXXC8Ac2YV3swxhZPegenZPwC7:dAMUFoiq5yWh4sCdegmZz
TLSH
T17E35AD81EBF955D4F5B3AAB899B69170EA76BCA55E30C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c3e1cfb51be747fd1af34dbc4518171949f28500206e5eae3d19b4253d2352e2
MD5 e5d5df020ea6ac19e8eabe16880364f3
SHA1 01443e4a8b5784d7d365229004be745239671ae7
SHA512 cbf30c50bc352bf80a5a0183037c801688a2c5c078bd21c13423a6f7a42c65a573f3cf6f7e1a17c72dc3fa621489521b313606a8dba7e1b4f015dc89d6bc0fed
SSDEEP 24576:iwu4OWdVXXC8Ac2YV3swxhZPegenZPwC7:iwvOeWh4sCdegmZz
TLSH
T1DD05F14666A50CF9E9774238C997C136F7B2BC012A24DB1F5360C75B6F37261BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 b6cfaa8a4d9c0d0983c8418d073fa2a2e15fd5bd218a85d6cefb65976da8f983
MD5 676f52ace0b7e4d237b0cd0a6c94802b
SHA1 89a0dc9a1582b3462f79349d896cdabd8ac771cf
SHA512 1a8fde1db7f7e2b191bc0007682481d31af0158c224ed0c97d2c95596ca4efef2ad428fb69d42a828eed3b3d2547938f6fbacb699886a853ae341755b4153a46
SSDEEP 12288:BeZ1IyxVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:UZuiVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T103E41296279460FAF2BB4278CDE09789E371BC51637487CF42505B6A2E3A8C52C36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b068ab80bca8911f2b08eba5e05ed8470686a9952382cc0bf65103d04a51ed44
MD5 84d1fe94b99079c495b7115c061a3a8e
SHA1 e9f6d59e81f4ee5af75613c2e937a12514865613
SHA512 f9c81ee944938e2df9acaf686f18c25b5ad19242b1d2310b9d7237659b985df56acfe8013a346720c271008dc66ab70336431942c58d193633edabe0729116b7
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:bQRQyi36YOcPbLvw2gAf+PN3dWIURZz
TLSH
T1A7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8c0263e105cdb9567adc5bc4e8e0d6e2f3781ff0017269cd67bd32f370902da5
MD5 141c0f9c6e3d79308e8014b075b23bc0
SHA1 ceb9523c9b47cef10fb1ddcc6467d717b99b5240
SHA512 756c297321cca4c68b132f5d8dc030d5525ba96cd107d41fd44b0783f4b00c163f441cacbc6a82761e04827dfc4d405a7e959d46b391e3197ab4f0387d27a8aa
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:QQRQyi36YOcPbLvw2gAf+PN3dWIURZz
TLSH
T1BE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e4bd4a451d1c9c4452e4fc8c87f0ec7afd40a5cbfcab198152695c2f61081238
MD5 d4051b77a12d7d8e20b879e111aa5e32
SHA1 4640ac6da05f7c435b230e7182a29e7cf5dd4d50
SHA512 a4f615853f9553cc41bbc16c910f770be8db6d6eeb28b10fa94bbc4dbe024b39cfa016afb1272a7dc6edb3d556a3519fee3e80e52fdd009a2ca4658f48c7c08d
SSDEEP 24576:FwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0yVXXC8Ac2YV3swM:h68Qg55nhceWu7PNU3/LWh4sCdegmZz
TLSH
T11CB54933B2F600A9C45DE1769F4A872196D17C758FE0E7DB8501720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2c40176ece932c2bda4e890851d9bd5ae9d3a925a3c715241d70456b2b571638
MD5 260f82ba66d0ca576a85beb22fccc902
SHA1 983dd743cfdbf1103b41533cb0994304b27710c1
SHA512 049c3dd2726f1b8d0a48638c475e64c40747e0dc39e5a5e6668d1d22682c46e32c7a53b0076c418c6133e64cb31b0cb3b65058cc05e331c9db3a3c289d57fcd6
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99C:by5112gYy5azzVvt69nLKnhZwWIURZz
TLSH
T18F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c86368828d19ac4211641c17289b467b6638401b5566e1ad482a63017275f1c8
MD5 cae75c426b1a2a3d8c35f4e677cf9b24
SHA1 037ec882e2adbe9cc1586f1a04392b3b89d42109
SHA512 9590539b1eea8bcb6b33f3388b209d6c3a64e016a9473b069fde7c45a0b9890b79ca124a20a027458f4117f8d3d0113f12fdde826827ff2ce4b28fe17c62e762
SSDEEP 49152:+B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gllWh4sCdegmZz:su6Jmdxd2dlWIURZz
TLSH
T121D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9e8203833aa93c19a10857a6794a66f26d5847c3128a42eb44b2ec02c0d2c63a
MD5 0d2e14acb1d58ea2f71fcc2ed162184f
SHA1 af121e71b342fb54deb7b328dbd3108ab9e84b73
SHA512 5201841a3c74c369ef2b6b92bc10050b7b490b118e8b7e417aebb7a1f917a06a9bd5d039072851fdaae56a4d15d3225f41ce5419e3eae58f5b2c2f23fa341000
SSDEEP 49152:G1hpsNoJpF1A63U44CwH7R4xhWh4sCdegmZz:GmifPWRiWIURZz
TLSH
T129B5BE13F2D900E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fa6d940ec031c047d29c30f5e1e6ae90e63aace56a3cc8ad962dce810c7dda23
MD5 72e4ad0363372d1010345000c5760324
SHA1 1d2554bef48e52da11453eb6a5c720da16b9f45d
SHA512 040d7dbd467cbcb30583ceaa63be0f014d59bdaddec27d544ffc6237f4a022474261241c6ebfc2127cec7ab62f809a8687d213be4ec572a3d6de5faf1769af33
SSDEEP 49152:vSuZQIY0Be2KcRVtOnks6NMHq0Wh4sCdegmZz:V5dKii610WIURZz
TLSH
T1F6C5BE13F2E940E8E0BED674CB659232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 070f478c05cf96c0a2e991469ec90239b6830989f238f6f7b7cf4c8bdbf2024d
MD5 2992b48782eef47e69933568a1e2a8d1
SHA1 088799b5b443ba167fd407f9e3881aa6c157e318
SHA512 106f1f5bc4ef4adbe6ebd82b377d86569806c52175e0b32e4b9574e3f15523a261d2c45551e68ec0bd6d6ae10f544273b574aae8ef733eabcd52ca1b34ad28e1
SSDEEP 49152:KhtSn8EApI0fig3giDn0AP5w1Wh4sCdegmZz:rX2imph+WIURZz
TLSH
T13E95BF13F2D900E8D06ED174C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0269ab8cad1b71eb5c1fcfb28599d89d03ffa96bd43352db4b921f92899be432
MD5 20957f397ebfea637313b14124f10100
SHA1 783679654386b48b8a04ed7f87df63dc617defc5
SHA512 66c4d9644d6415abdc674e128e244539986d43ddaec63705afa4bdee8e4a58f297fdbd41fb87e07b19de6f7cef0aa870a7f397812961ebf5f01267b3e8f808ef
SSDEEP 12288:T2VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:T2VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1D8C423A5CD07846BF27E46B4CDE093DCE2289F84A094CD6AA2817B1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 d6c88557a18440c69ecd3d6701cdc17eb499a80bf2c881d1297514d3cb8d04d2
MD5 34dc830c7a372b177df0774d4a66835b
SHA1 f3e796f511c0959a69e34416ff5bfd7cd7af23d7
SHA512 413ea687df7a941a8c1caa539dbe011740df0468ebf08c506a08eadccdff254e182668998e290fbaf87502f7020dca7787e5ce29f62e2d56a3f48408a672fc78
SSDEEP 12288:UFVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:UFVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1DEC423A5CD07846BF27E46B4CEE0D3DCE2289F54A094CD6AE2817A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 a846c11e2a3e3e0db0eeb077bc71aea59a64af93ac97a0b1f496ad42f99e7e23
MD5 4a2c4640e14ed9ba19c4aa7365859500
SHA1 6a1a82e84f7c3842c46bfddef49fcef1642f9d4c
SHA512 7b10c4d415636cbe59e8757b19dfab50f8dba59719c36a5c58444f3339add9dc60c52eec09c9e1877e8040de6cd93713ad5b35aedc43ff39e3c2b1ae42fecf38
SSDEEP 12288:9TVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:9TVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T14AC423A5CD07846BF27E46B4CDE093DCE6289F84A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 2bcf2e6c38f7a672108588764770553c7b937a366b0f4e409dd192d1bc747b46
MD5 a404c3908367d6caf4f8499a14475e59
SHA1 98f4471809f57eb09858d53f3d26e28055677d8a
SHA512 0beed9d1640ae1d85cd4b31d5aacb2cbd2e117975a5ef98bea89fc10cd627c2c98262e571d8672cb078826cc508da245df5605e94c8ad899751ca010c7750639
SSDEEP 12288:UVUVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:XVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1E9D423619E1A40E7F57B8674CDE0D3D8E378BF94A264CA6F93412E1A2C784987431B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 e6dd6f0f2b37467cd477ad29dd06f07660721de3b77a40a186974f953f02f634
MD5 b889343ca269a39910325a44c0a2d36a
SHA1 009e4885e72aa67a546b02e7e8c3f245f9508b4f
SHA512 642be0d284e61e2c96d451a4d7ac3ffcc82d9b0a3ed413965637797ddaf6368c7ebb7fa9a11ce1d471fb4a7c5fae9819dfc0c8b654f289cafaf023bb4c5b66f8
SSDEEP 12288:GcVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:GcVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1E9C423A5CD07846BF27E06B4CDE093DCE6289F94A094CD7AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 7660831a4f62562eecc9a8e5b6ec75cc3bf6d4f34c1fd448d563b1c891317d46
MD5 71cb458b7d273af78b920d3910d2e348
SHA1 b659081d6f098cd2cf2ad9cd47e38952c0e1717d
SHA512 8a744cfacd438242a3f93e32355c35c2322f011153d7d4eb813cb4b4d23a57835efca6909d3a4412137c77a9254cc271eaa0b05f7b650b57716289091212a28b
SSDEEP 12288:E5VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:E5VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T190C423A5CD07846BF27F46B4CDE0D3DCE2289F94A094CD6AA2817A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3517390f06876d4f6ea861a8ef8998289b425d55c34c82e34832cd7e57d41fe0
MD5 7457e87f6c9bd40fedf3120515f1860d
SHA1 bca07c9d81a4a2ec90a7067d0d82831644c606d9
SHA512 19afdf373677e80fd3c180469fac7a06466c925860860b4a65d73d8c940e85380a542fdef9e886320efa62cf978c8f6db775ab0cc15488fce3350520050d25af
SSDEEP 12288:4tVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:4tVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T197C423A5CD07846BF27F06B4CEE0D3DCD6289F94A094CD6AE2826A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d6da5af067bddd466b6e759b3fe0e275c540f0731d6941298e8bd6cecd4a00c1
MD5 d461b212916309cbac60996fdadefb84
SHA1 66b3713912691c378561e70a4b98e06148d227a3
SHA512 1a110e945128d7a41f859806bdd3e2a21d8d36e78663957d4686e8dd9ea5f1316ea756295fe12e5b1518f2fb82119b4709fa1e10588959bd32c44b73aa06c46e
SSDEEP 24576:9ZMRzFVSOlVXXC8Ac2YV3swxhZPegenZPwC7:9ZMRzfTWh4sCdegmZz
TLSH
T14A0502A5B35018F9ED77823DCD658A45D2B2BC590760CA1F03E4362B6F372A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 de685b89d2148e8193ff218f49c61bd35df3aadc258d9615b57bbe29b757da4d
MD5 bff38696f1f67936be8e83a549998d12
SHA1 b19f1b0efb0025eb74444e422c6969d5bfa94f0d
SHA512 6c19902647cc2454f91bd5bf9f53a845514ed443e47c4108c417f5a1b3b04209156d2633d5cb58cc0a968c6c44b24152d284c77c9380f12648d57eb1ec5368a9
SSDEEP 12288:sSVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:sSVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T11CC423A5CD07846BF27E06B4CEE093DCD62C9F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 4caeb1f4f469c30811c3266c60a3b2232a076fa13f03b71aad14b7a3bf4203c2
MD5 8fb4d38df7bbdda03a75382e09df6b93
SHA1 7de3bbfab99ce2c68e7e3955eab6fa9c1b9ea50b
SHA512 ba1d83005d8a810dd6539fd3f12e29f1691e5e46796da45e65257b4f0119da4911bdda3046865805fac2c3cd5076efc2a23f3f2a41f4cc7eabab0a95f65cfbec
SSDEEP 12288:BuVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:BuVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T10EC423A5CD07846BF27E06B4CEE093DCD62C9F94A094CD6AE2826B1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 230b86643a7d8c324cc2caa825818b70af32ae7310b73a163515529ec2f48866
MD5 c90ceccd2bd0b62a9c45fef36c3d9bf3
SHA1 81379377e18d542b81689afb728145b20f844984
SHA512 65c16a3e88a478dcac3f9489da30a58d9ef2e17cfbd87934632c9bd5cd1c3ea0b45a1a19ac011a7afc1d3542f5a758ff8caac7543c9bf96f4ea73a6ddb5f0f77
SSDEEP 12288:ZyPz5L8xVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:YzyxVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1A7F40257A76620F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4a31672b3c5a9f39bee63a6a3fb5e90dfc71dea939928301d1a53f30ecae321f
MD5 98bd63e29cf8701d2efb3b37f2c9144d
SHA1 79f08a883003bcfee7a0eb4227b7e069a2e757d8
SHA512 18113c67dccaf3d9bf9ed0af58a480c7f3b9d9d2c8a42e03457e21562cf42ee52b5cda14d12a83f69a4a3d419345864941faa37ad6e21da72d5dc3eb2ad35f9c
SSDEEP 12288:lSVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:lSVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T15CC423A5CD07846BF27E06B4CEE093DCD62C9F94A094CD6AE2827A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 0b29afd84836fabd41bc0711a1a27db8692ae695f8f2143b24ce73fee912fcd0
MD5 0850c53972c0e51b5de5cd5273734dcd
SHA1 472aeb38de8d5f7634a3e7f7a1d4765df104de8b
SHA512 803323daf6ef30c9d030300f1d269f6f1103eaebf6c770e9e9f3f407ff13687016b4bf256248c54f7ed44e937f19104d5d3fa22fcbc767b618199bb81bed0b9c
SSDEEP 12288:ASVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:ASVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1C0C423A5CD07846BF27E06B4CDE093DCD62C9F94A094CD6AD2827A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1f664f5a72d9f4cb3f053362b51850304e23f65fa6b0f8ed1ca5f1137e54ce9e
MD5 5ee339b161a0fbdb0c0aca4a8f231c26
SHA1 6b53b255c05260237a66a701a85912478178606e
SHA512 1d200094dee98d7b72537b4fcfe9be91811d58ab8823f87f3a1ed3c398f7b070477db1314e55c91a5c14a8edaf4c59091cc2381937ee2b57ca187b91fe588631
SSDEEP 12288:8yPz5L8xVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:lzyxVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1C9F40257A76620F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 940144e8b2916f1a7995571b22fa61e4a9171a1b161b644d8ad1474f2ba1258f
MD5 17a2446c8f33224a72d704d54928648c
SHA1 561ebf62ea2ed168c1b065f036d400f01f10136d
SHA512 404ac707e6268fed331ff43dd7e294e5cd554b8b39af609adfb41a33d9f809dee01b40dbe5af33f5edc61f793b1eb60aa5239c96878adfe6b3a037828560dfcd
SSDEEP 24576:9TDaLl3z0zDjVXXC8Ac2YV3swxhZPegenZPwC7:9TuLlj2Wh4sCdegmZz
TLSH
T1CA0502A5B35018F9ED77823ECD658A46D2B27C590760CA1F03E4362B5F372A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 ef379d2f91b0f9557b137dd947ba24f7a471fc61d8e104e9a71fdf494aada4a4
MD5 1ed028fdcc19f895c8c3796e51da7626
SHA1 790bd31dcdf90723a2ac1c72f21feeaae265d0c2
SHA512 66ddd34a70aa87f656797ca7aed888bc79f40eded89cb3cd2c0e83259a78183791d4d920875c828baca7aa240ab8a46c3e654be95cde32aba4f7c64f3a41b1d1
SSDEEP 24576:w3vd9CHKy7GZXVXXC8Ac2YV3swxhZPegenZPwC7:6vd9CHKyaTWh4sCdegmZz
TLSH
T16025CE90F3E410E9F1B78A35CD769611DA767C991B60CE8F03A4261A1E33AD19D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 e7a85ab76511b14eacf468c7316f64e3b800c892a4e0e63076d13524e868b0ed
MD5 b449cc5b70992ed2b794d702e58bdf72
SHA1 73ea29c8923f2d569f5f3ba11924335a06782675
SHA512 071b2f84135ce7784a5e8b1f89643a137bed4ee018d8cf64a5197b5417c8cdd594d1808317cec7fc0d1b47df5dc0184c9c518fd33ca54eb00acdd9d548eae0b1
SSDEEP 12288:qzVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:qzVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1E8C423A5CD07846BF27E06B4CDE093DCE6289F94A094CD7AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 1b62926758187c7e65e63d86d50ba797c8abac38072eb6a6fcc9832c74dba5a1
MD5 ce6bf0180fd4d08cc50703a5fb79b472
SHA1 a4ba95a3e24b669f45ad1914ab33afc7908af61a
SHA512 d806de2f5d66c07852f05a6f3c0bb0fc06efa90ceaee570e8fb58908c0325b683fdbce2b40fe7f47ae40aac2db9e85104f8b3dd925fe61a8c023e88ff87cd99b
SSDEEP 12288:gRVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:gRVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1D1C423A5CD16846BF27E06B4CDE0D3DCE6289F44A094CD6AE2827A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 80db4101284683b83db757f5abc801626b8898e804ffc6225f277e786a97a2a4
MD5 a23bf449dd7aef9dfc73add05f7f57d4
SHA1 a54f94ba8014be53e7e9cad8661f5a09a9ec3b75
SHA512 a32cd9de5580943ec0012f7e7090988a51ed6d7f61a3296f9e61e0ac8810bb9b5484e1298c349a3cbf1379777372624b3e570891be57539ce384448f80b2697f
SSDEEP 12288:ngVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:ngVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T193C423A5CD07846BF27E06B4CEE093DCD6289F85A094CD6AE2827B1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 796102e068fff4871f13791dcd81844446d45590a22f029e1c24a6c32c7b675d
MD5 cfd5e4b181d419d4bdf011e386a25786
SHA1 d5ed8f00ff1260574db73128d1e979d260f8f844
SHA512 49a5eab7083fb9380b6e9a07cdb6580ea8838ffa6be5798ef74bd2837424ae818acf3945dd3c1164101c5b4c09049ffafcc0ca5ef73e45b9db8cd6c025749aa0
SSDEEP 12288:uSVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:uSVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T17EC423A5CD07846BF37E06B4CEE093DCD6289F94A094CD6AE2827A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 ce3d70146c26883ec6601cd7b953610c93722cab7c58937b7919934eca1b0142
MD5 39ffa843e2e8f207ff64f4a2ac85ebfc
SHA1 01006b07b6671c030a1a8474520a80ddd1093961
SHA512 c4665d28b5d21fb8fc5917ff6601629d8a05b7f82eb57a6982909add092f39db0d2279ef8dbbe14188fec5e867d22a3cbbd106ee839a60aca220b6c89d6404e1
SSDEEP 12288:JzVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:JzVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T136C423A5CD07846BF27E06B4CDE093DCE6289F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 4256cf7cff8236b7cc5a7e82650925fe21430a6e40ee6e38a205e367c0b4a028
MD5 1f4fecc06c7617a8c126d3f6afdb7cd6
SHA1 5256d4f45a9af71151d432fb7359fae5639c5894
SHA512 b69570db46aefe8c1156db9f1326971d074f0602472fee4673695f90a1733e2ba24982cc8602dfcc86bd21cfb7e59ffa522032c5aa6be808b705eb6104142e5d
SSDEEP 12288:+6VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:+6VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T120C423A5CD07846BF27E46B4CEE093D8D62C9F84A094CD6AE2827B1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 036bd97801e19c841168b5ac97e87f7fd98d63021c93f88f3d5e92041b4a7386
MD5 6e8b2c70831b2e4bea8d3c32d3c76522
SHA1 4308e3e2c109d4c9986382cf5e5ff7954e094e78
SHA512 5145a0287fd1956eab700bdc0bbb6ee542ad7f7b480c891201b5832172b588e267ce0eab30e7f02fd62b44ad196cc1e84b1baa3804ca80a50a609644d3216f36
SSDEEP 12288:gcVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:gcVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T11BC423A5CD07846BF27E06B4CDE093DCE6289F94A094CD7AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 05565d592a2d2fca68a8e235cbf9a51d7c6bc1eecdb5e4db6ab2efeea649baf5
MD5 7a1cac6fdf23e00172dc48a5da008541
SHA1 a1983a9aaa645b1cab0f2bd306f91c508a7f7c80
SHA512 bbe56b8f1fe819fba9275175f4b206575efe2d044b783b50de1b19db0dc56e0839e2fbefd00bdc9b1e2d73dd5eeee3f2a0266c3e052a6a38defe11c01496147b
SSDEEP 24576:mfwvUk9RX6wkyAIeVXXC8Ac2YV3swxhZPegenZPwC7:OMnYIQWh4sCdegmZz
TLSH
T12A35CF29EBDC44E5E177923C89B3464AF2B178581B31C6CF029A536E0E37ED46D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 16bd8675ad603a73dd95ba4e0e71e472c492f59ca0b0c961c646b036bca23b8b
MD5 adfb07c2365262cd768be7c936abba78
SHA1 af82ad397fb87aa723cbd58ead1b780ae437ab90
SHA512 c3eed50c085e910f14b91d86471f55578e169c47cb3acbf077e66652c7137c799441841ae4d7573c0fa394df3fd0aacd24a4c8db81c657859799186c4914ee45
SSDEEP 49152:hYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VWh4sCdegmZz:sySzP9WIURZz
TLSH
T135066C96A16801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cb74709f272152347618cb726829badc3b0dccf13c7271e1b9cc45b022a26cf5
MD5 f9a74ebe5679a122461b47a2f6ec0d3c
SHA1 599e2a85bd095fa3e3e4902c367ad3cd79b36cb0
SHA512 3849697ed9c13c0299e71da2c3129fe5b4f6b64a8ebb8a2bd5c597ab305c3220f292fc891e13fa28846745c60c47f55a7f2d67e9e17996aa89fc506c9dc9895a
SSDEEP 24576:747Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYVVXXC8Ac2YV3swxhZPegenZPwC7:747JUQjTirIhCnDHUPfF/lWh4sCdegmB
TLSH
T16D65AE1EA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 582db7d5582d290185054d8bcd78b2ac91d646c9185d5c28684bc2f4e3693c8e
MD5 e44d12eb4a771b1729931d25c850ae1c
SHA1 c20da980468657b949f762e4b6af0ede1c104020
SHA512 de3e3f0de301dbe3b498d3994aa95f7f6c10491e2c86f4fdbf4edcb56e88103fdf66a6a690541d7041f4e5f36f8ae4794debf11b55c688e0d2d36bcbbaf0ec20
SSDEEP 12288:ibsfiVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:ZiVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T17CE4F05AC25801E9D16E5278CB918684F3377D6493E0D7CB52C0FA3E2F3A5946CEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 da0109a626cba7807319b10035d78511167c39c6efc1a84c78cf66712e258f97
MD5 097dedf71a7b19849dbf3783a381ab85
SHA1 51a2ca42f49b53d75b6a0226f22cd716b3478684
SHA512 0732133e5a59272a1da5f90be6bc61bd5fb3beabf4fde949a4e8a84d68ceb38a07a853853222282bfd82d15dc01bcd076d0e93aa9487c0431caebe59f35e3436
SSDEEP 12288:8Rb5PXFU3fqNm63w1PeNjfMcp5RM5KGj:8RbV1UPsm6gsx7p5RM5Dj
TLSH
T1BF3507017626DB5FC66940322E32C5CCAB707D41EE08AF0773C9873FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 7eeb1a2433f5a3a6323c3ec510d38cb365011f642ca52b0f41ae1dd8bb35cafc
MD5 9f5baf664addf4fd2d1bb05e9691a45a
SHA1 d5d55f35fc0e9dccf1e88a27c1129d4f3bcc042a
SHA512 f9db7f55610eb00ccc305c6aac8cc3c81cd9ad594eea16eef776b8601e3d85cea9f85c78a86e5799364eabcd9d2b8d3e2d1c0f2077ee77ccf6cb23c96c35cd50
SSDEEP 6144:Ij+CT0WnqkFljLG3nGHC9PZIPWP/lLqKGeQytMxtQytMxHkgl2Z7bTDKoRxg3fYE:Ij+CT0WnLLG3JPCPdbCSmIdE91
TLSH
T10B55C5816136E7CFD1BB2131072A5F4C77A4EC06B6495F27B3CA453AD82AB51A0F83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 39d9224b6e0343d810aeb47de06152819c7a34545972a4643b13c6c28a0b4ca6
MD5 57f7981f57c201e15efff41e4e571235
SHA1 bebb1dcbfd487ab52a618be65ce4ffb6233200ab
SHA512 c8f89d5a12d2aa3111712b2aa6062f0fede7313bffabadae99f36154c1b5db81a92afb6a86030b3735ecd9658e2ba39e433c3be4664069b90b195f56447c36df
SSDEEP 12288:5z7KVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:hKVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T167D42361CE0A8427F67F0674C9E4D3A8A22DAF545744C8EBE1417B5A7C3C8D96C32637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8fe99138a39bf69aeabc66a43a3a40692bd04405cb597ad7626858447b24133a
MD5 705b4682e53ac65d649eaa91aab16123
SHA1 7ef57f6d591b2a9d0393bad847966c9bcab9509f
SHA512 360bc112667c12b72aa47269e813cabd3bca8a8f5dcca5eedebe84803156baec15eeee209ad42a347a87eded7d8ec61b03883a1779a834f4ab7bb96e9de12c49
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bY4VXXC8Ac2YV3swxhZPegenZPwC7:/gb4mBIBhGFvWh4sCdegmZz
TLSH
T18965AE1E22EC02F5E0FAD2B8CDA64417D6B278161731D6DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 36c7de43a87eb43341677646fcf35e99e5f3955a56ca852cd5d1005f6fd71174
MD5 286c31fda01640684e06f2e7b1383302
SHA1 4d0cbf91ff6b50f7e20133c6cd5e00e4b9e506e0
SHA512 73c4e5f2329e6d7004ea33caf42a23e684b8dfd9412b313969713a26df929f3b51aaa99998977baadb5ae659de47d599e9d0d90f6d206a12ce495980de9ba09f
SSDEEP 24576:oG88u8FpJqH1bzria7/mlVXXC8Ac2YV3swxhZPegenZPwC7:L7ZFPqVea7/uWh4sCdegmZz
TLSH
T10F35F165A6E101F1D47BD138898246A7F6B1B8250364EFDF07A88B551F33AE50B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 80f00cfd0f31a7f63f50dea8146da51d3a7e90b13934c766bc897fcbc6c025bc
MD5 251c8617ff9dfe3ab8269b84228e7b76
SHA1 d16677060685829f1b7cf16548db9627557d2bd1
SHA512 0ae6bf8d44b0ef5ec708bff3ccab20305eaf7ce2645105d46f9c33c957382fcf12837bba100831cf2b0a1575d8a050ef9b5481442d0d77bb2634806ae95ab30b
SSDEEP 24576:6PUr+NQpVXXC8Ac2YV3swxhZPegenZPwC7:6JQTWh4sCdegmZz
TLSH
T1B105E12F66A918E5F67AA17C8982870DF771B8611311D6DF02D0813E5E37DD8BC3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 514b8803ede996ed7c4f19560daa25c10a66200f824a62a968ee60263052180f
MD5 eb1cce75159e8aaf3d51a134e9ddca97
SHA1 850a310bdec02750efa6cbfb63150ac8af27fea1
SHA512 287f4863d4ce0132575d092b44fbc67d6b51e9ee22f37a14514ee726b7819e883b3e3703300d840d97a65673f47a0c8d46ec682959c7ec1a4774d96fcca774aa
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDWh4sCdegmZz:qG05lO43bIWIURZz
TLSH
T117D5C06A62EC11F9D1BBD17CDAC6460BEBB23815033456CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6838cd3bb39f9b43ac274108fb3ef8c7efeb1a2e338ae46e504b14001b9ba072
MD5 4e9be5fc40dcec9374f7cff45af34f5b
SHA1 ec61152437eac1667ce2455562db16da84b839a5
SHA512 492a548a717d369b3a4af86b1fd46a4ec3433ac9d3d51ac9f5666cc44c2dc31bc29930d7c7cd948375376bbf8f16f32e762b468ee38b10d8d5829d415438de81
SSDEEP 24576:vfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn/VXXC8Ac2YV3swxhZPegenZPwC7:Xa5POZ3BJt2pasx2+mLWh4sCdegmZz
TLSH
T11365AF5EA6FC00D5E5B9D17DC583861AF5B1382553319BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 96eff71890bd6daddd0af93219cf5205a48e32815c5a07376fc968ef8947c621
MD5 36098d4843feeb56c326bc831271006c
SHA1 5ce044ed3dbf8aecbd3bb0a479e009ec07ff763e
SHA512 7b88cfa46c5d60af2bb0a0ee8d4fb521d42bb33fbcf01f04697dc846693a58030651d2151af73ace859ebdf73786cee3426d158f5ae62800e857d1d428888d99
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7Fk9VXXC8Ac2YV3swxhZPegenZPwC7:zNc/zEOVHFOWh4sCdegmZz
TLSH
T161857B2622E901E4F1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a605bd860da449460c3ca1f317874850f1938119f3843274c4bd4e10c087aff8
MD5 fef4fdc46be192aa9c2630cc2c331de8
SHA1 b8159c3c2ee417156fdc3dbb45bb94d0908383be
SHA512 55e810e34f958e1ed3bdc1df993f5257c9aa7707086b5f9fefcffec87cd882cc05c87e64cd9e6748eef27ab9e0cb010a624288808cbba9f2fa538d5e31689882
SSDEEP 24576:pTkNvNnaFeYhJNtmZBmLVXXC8Ac2YV3swxhZPegenZPwC7:pTMwBtOmRWh4sCdegmZz
TLSH
T14855AF6EAAB845E4E1FEC6B4CD238512E6727861173293CB5390C13F1E279D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 65a6469a193de5a3e8a0ce586cf5e162501a2c9bc44df60db02cccdc9f2477ba
MD5 78610e3678a0cc1c9d0dc8f25e6157e8
SHA1 09c88a0a060fc05d724c34383a8023bff73e5f61
SHA512 8f87e381e91d5c8bb3fd8778be253159e67de6351ada4531ab66b7555c46747cc96194790d651dcdb1be3c80d68debb7712f1ea5d993947af0474abde6011862
SSDEEP 24576:zD3FHshBIYQgAWVXXC8Ac2YV3swxhZPegenZPwC7:zDVHeBIAAYWh4sCdegmZz
TLSH
T14A25E17DEA5D04E5E57BC1BCCAA38606E77138A9032159DB02D081BA1F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1248-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1248-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1248-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1248-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1916-79-0x00000000006B0000-0x0000000000716000-memory.dmp

Download

memory/1916-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1916-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1916-84-0x00000000006B0000-0x0000000000716000-memory.dmp

Download

memory/2272-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2272-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2272-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2272-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2448-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2448-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2448-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2448-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2448-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2528-293-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2528-55-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2528-61-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2528-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2876-136-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2876-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2876-128-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2876-134-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2876-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4108-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4108-95-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4108-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4108-331-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4108-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4152-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4152-20-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4152-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4152-22-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4152-14-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4540-108-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4540-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4540-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4540-313-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4540-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4540-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4548-409-0x000001FEFBA40000-0x000001FEFBC88000-memory.dmp

Download

memory/4548-328-0x000001FEFBC90000-0x000001FEFC310000-memory.dmp

Download

memory/4548-327-0x000001FEFBA40000-0x000001FEFBC88000-memory.dmp

Download

memory/4548-410-0x000001FEFBC90000-0x000001FEFC310000-memory.dmp

Download

memory/4928-1-0x0000000002320000-0x0000000002386000-memory.dmp

Download

memory/4928-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/4928-6-0x0000000002320000-0x0000000002386000-memory.dmp

Download

memory/4928-77-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/4928-7-0x0000000002320000-0x0000000002386000-memory.dmp

Download

memory/5196-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5196-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5196-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5196-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5888-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5888-73-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5888-67-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5888-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download