b75cb15b93e221c3d00d3b00cc6c449b89e2a081438532ded215957d063f7351

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_8fbe443206623dcad1321eb49cd591b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 1.4MB
Sample260809-w168latcpf
SHA256 b75cb15b93e221c3d00d3b00cc6c449b89e2a081438532ded215957d063f7351
MD5 8fbe443206623dcad1321eb49cd591b3
SHA1 ebb235850d803e362bca32aeb040bf8e0e8147c7
SHA512 08de0dfa5408ac36441cec9b64df5b4e05abe392383b5b80565d90fd067dcf4fff2de77a92ffaf998c28648bafb0fcc34449e1ea53dfa6a7eb53c263570854cc
SSDEEP 12288:jEc/JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:R/ZnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1ED651225B9F0C135CAA603F018A3CB9397ED4D657B94429F37683CC9EE342D49A97346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3304	elevation_service.exe
6516	elevation_service.exe
2720	maintenanceservice.exe
6940	OSE.EXE
5252	PerceptionSimulationService.exe
6652	perfhost.exe
5064	ReFsDedupSvc.exe
3060	SensorDataService.exe
4444	ssh-agent.exe
7108	AgentService.exe
5984	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_8fbe443206623dcad1321eb49cd591b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c80ad48b957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_8fbe443206623dcad1321eb49cd591b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_8fbe443206623dcad1321eb49cd591b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_8fbe443206623dcad1321eb49cd591b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_8fbe443206623dcad1321eb49cd591b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_8fbe443206623dcad1321eb49cd591b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
432	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_8fbe443206623dcad1321eb49cd591b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1ccb9592c28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc5513592c28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007237c5592c28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e22e50582c28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e187ad9a2c28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
3304	elevation_service.exe
6516	elevation_service.exe
6516	elevation_service.exe
6516	elevation_service.exe
6516	elevation_service.exe
6516	elevation_service.exe
6516	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2884	2026-08-09_8fbe443206623dcad1321eb49cd591b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	3304	elevation_service.exe
Token: SeBackupPrivilege	5064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5064	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	7108	AgentService.exe
Token: 33	5984	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5984	SearchIndexer.exe
Token: SeDebugPrivilege	3304	elevation_service.exe
Token: SeDebugPrivilege	6516	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 432	2884	2026-08-09_8fbe443206623dcad1321eb49cd591b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe	92
PID 5984 wrote to memory of 3208	5984	SearchIndexer.exe	104
PID 5984 wrote to memory of 4652	5984	SearchIndexer.exe	105
PID 5984 wrote to memory of 2536	5984	SearchIndexer.exe	106
PID 5984 wrote to memory of 2300	5984	SearchIndexer.exe	107
PID 5984 wrote to memory of 236	5984	SearchIndexer.exe	111
PID 5984 wrote to memory of 3956	5984	SearchIndexer.exe	112
PID 5984 wrote to memory of 5004	5984	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-09_8fbe443206623dcad1321eb49cd591b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8fbe443206623dcad1321eb49cd591b3_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y C:\Users\Admin\AppData\Local\Temp\iaStorA.sys C:\Windows\System32\Drivers
  2⤵
  - Executes a command shell one-liner
  PID:432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6516

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2720

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6940

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6652

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3060

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7108

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3208
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:236
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1557c2ed880831085c9ea8775a43b688c1f4e517177d792d1952702dcbde419e
MD5 edd8f2185866e557888d450a70deed82
SHA1 46dd07c1b6740e97b4b79fd02a95c19826788069
SHA512 fd7fd1fbf42aca2bce3c5827f8c514797fb657d082ee55a77f13327b82aade56d48f6bb6e5d27c78eb306cc666c1b8083dda37a445ec291ef0473ee2ead97ca2
SSDEEP 49152:Mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnAQ/lFTjN4:23q6HjBYLm
TLSH
T1F0D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7cf6707e1ee57cb76afb4115ff50e0b4e8cc59e74555a231c8b9a319f84209c0
MD5 616082128f480e6d380dfca54a61495a
SHA1 7074e71587c0d7d96bfbfae1144073e520e0f7f8
SHA512 45853d7acd169fcb122f8597c8e650b423c0ba56fb29e8ce1605ec290437667685384897d1d78ff5fecf78ad1b935ae6850270196ddee1ac93627aa9ed175427
SSDEEP 12288:s1XLsswWkxy2lRq2czAkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:aXYfDtczAEnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T19B65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c377f596d12d0be532ad382bfff2900cd00f2b7ae1bd97e3e8a70b7e15b4cc95
MD5 612735dceccfd46a0cd3436d577bc6f6
SHA1 81463997e7b88cf6005dd2478c7526f21c983da3
SHA512 d0c0611fa889a05ac7682975287d24ba8e29c636aafa1ae5323fa38d847546fd969f51138365c66c8d494b48e69318b47e2d98aab2a0421c951f27ec9419940d
SSDEEP 24576:h0Le5ji0hmxLrMnnQ/tbw/2Mkjy6Fr7g0oX:hPji0AlyQ/lFTjN4
TLSH
T13D859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8e6bc23a19839b66a184e32af1463703eebe072f3fc1d0d25f11d714520dc3fc
MD5 1cd551c8a1f19048c25c1fcc512d17e6
SHA1 e924c918633af1302b0ff203468355b669d9c4f8
SHA512 7e3c522e30e2a32cfe5b128f7be1afdd0f59f01c9d12c38937e45aac03dddedef9a90a61bf363cd644eeb576377a6a5129054b039c1a8597ec90dc88e7aa5f75
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWE6q8wyuRnQ/tbw/2Mkjy6Fr7g0oz:j/ezSC6vUzPvxHjyeQ/lFTjN4
TLSH
T1C6755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 22372e6c51d65cddcfa8d3afd0686efe8d1f9b4ea6d1a8a5510b63dcc57eeb69
MD5 969710401c2521a96ed7eb0b549e3f82
SHA1 6417241f1096ac3e01976112af65c30895e319fb
SHA512 379bfd9ada399d02522f18603a14b05696b8aa42c38393048df79356d4a44181f173da4676d1ea391252c7ecac9ca21eb98664a3105427e212dad638a538d9bf
SSDEEP 24576:TVbqPb88hv/l+64nQ/tbw/2Mkjy6Fr7g0oo:TVO88hXl+TQ/lFTjN4
TLSH
T17F559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 65ef58d08b6c973b1801ca37043e65ad2560aaf1812661f074a33453a9570851
MD5 d77834c183726e6044c2cc6d74f29e75
SHA1 6152d8758764cba792438e8c4ee1fd2faf30a575
SHA512 8e4f63e08ed02b6c221e56695bb7d1c8b956ae6bf03ef4df85ea6b3198bb3cd55b97f87412f498fb8c063d3db99c90fd7b2423249797eee0d85966f446749362
SSDEEP 12288:0zbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:0zLnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1395523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d9fb3333a86650503a69efe377fa06288c73b5a2a6398a0320425f349c2d736b
MD5 1eabd6a4bff4ff82920370961b25c86a
SHA1 3828600cf73920dc837db1bfb770379651bf769a
SHA512 555765b6bbfdb7835a01954d3356e42d34fdbed39cf07a8f9d7a6733f384ab798a0c9e852f5713d186de3a257f384d78931e20494d4667ca717a21192c3394f4
SSDEEP 12288:3eBNUbTVO86UgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:3JIUAnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T17775CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 98bc2fa49908c7cac5c9f0dca6b38896d90fa027fc8fb104021e358927b971e5
MD5 5ea209a32be9c2118f547659ce47da63
SHA1 61187dffc2c1c8a354e1143c48edc929ec7863d1
SHA512 18fc6d81b6dcce7134b049810374a4346a48caa3d509236ff8528700fece6a0fadf49c696fdf9e008ac9d185e5e32e04fed448c148ae93d42458e7fce88bbe83
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THe:OQvGAdlCEL8c/yRNw5CmLm
TLSH
T13C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6ace238bd5bea7041e427cd8dfa02d7e6031bc397e722c228d813e1e9fccfa73
MD5 1c53eaa13e0d8d63047371ad436757bd
SHA1 e5da2d66c37d8704248e225cf4855637828de7f4
SHA512 31bd83c2831c9c00eef5c918d58aa2947109e80ea10a8101eb5e249a513b4d3d86369b44649e80e5870b40bd0f4eed76b37d7beeef7a535b2e94815e4b089dc5
SSDEEP 12288:xAwSfxL/2Dc39DLLmt0LDQewsAjiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgr:SQewsAjinQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1B775E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cf6bd9d2d2073874dfb3f8e9b9f4b9026a7e3bc72ee2a0ae2b9a11675de97cba
MD5 80b6df6978afeb6ef97c6e2c5dcec75d
SHA1 7a55fa72c2393cef5cfb4fe64ac803254affbaa0
SHA512 be95a10813e59767051f232538d54d06b0005afa9e8c2765d80f6b8f6c57c1bb63e2f5bb0fdf98feba2158ca06ebdfaad8d73cda8aa39bf5563ee5a3aa8a8148
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH1L:VUEtQevvqc2W1cpV2EI32
TLSH
T1A2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 49cb8b7ff018211e3bf51fac8de52ad35473cf14f7bb00d6beb9a293ee31d95b
MD5 e7522f7d16b14f992cac496cf397661d
SHA1 e82ba938c294c424b59ea4c4260c123483a17ade
SHA512 816cbf5c5351cd31d8293b4a1ed676e627ef174a0db807bc21e4e9a937006e291e3f7676fac9ff8ea05cad1110d85cb5fb6c2a2da0991613174b5e83e192da9d
SSDEEP 49152:8CbRquA/m2yL5zQfFiV+XenmE3/zCQ/lFTjN4:1oqtVjnmiLm
TLSH
T17FD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 205518807fe5dd03d95d88c8a0a72a75dd12bd7f6a24124de523191094e4a89a
MD5 21b7a4ccf4f151f43bb0f8b195e6634a
SHA1 954283c09be9bee84e1e1056530f3caaa66455d8
SHA512 9b251fe1ceeca6e1aab1e113ce89dcf2c545b2eac59a8aae10aada04060102629f972b37a9233ed14bc5bf5cf108690a644db804b528347750e49264ff2edc99
SSDEEP 24576:jAhGLJIFoiwtA5l7S53NnQ/tbw/2Mkjy6Fr7g0oi:jAMyFoiq5dQ/lFTjN4
TLSH
T15035AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 6ed9ad12509da13dbb3eebd89ecd395f2439619650cbf480b474a710bd3977d8
MD5 e2a17fedccc65f219c0323abbabed910
SHA1 46c1008111052b2f7a51a093455841d5df9f791e
SHA512 30ddb2084b4790a9fa0c3fd6972f101521794848df45ebb83f1263e636e6857956979eca349a1703223245c950062ca392d432de8e8e8ae2cb9ae746547970d1
SSDEEP 12288:Xmw5HEjsChN2BFgl0WDm+ChGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoML:2wuHOW+nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T14F65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 97bea908bdf3666b50a1aa02d31bf7c6ad64a30582cdcecb6701e1feb7d52698
MD5 ed3e82d486ffbb2ac145a57a02f60fc4
SHA1 8e2b4a8d990a2e757ff3feb73f2cb9b336977348
SHA512 73a651a7c7c0d0e0705a45712268cb12473297587fbb97e85facca87829531228de0b608e26bca7cd24f2a38a44ad55c65529348c14a7b8fb43c511a220902bf
SSDEEP 12288:BXZ1IySGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:JZuvnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1DD55126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a9bc2a176ce94fff2a3a0b6841a6477c235bc8e0c7473adfb0419b6c9b065f97
MD5 d96435226adb5d61e535f7a431b65783
SHA1 3c9b5560358edbdaa6f8acd244961bcf13a709a4
SHA512 c676eb7c06d89cbafe46eeb849d6919cd9af9f1194d4659533a9f9f50b7d541197d2a82371b8fe9d2d3daa45e7aa1012e67957ba9a52a5d03c53229720037f27
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:sQRQyi36YOcPQLvw2gAf+PN3vLm
TLSH
T128666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 40bad90abb47047f283c14ef3366fb9b0eb41b79dfd97d1442e2af0085e4b350
MD5 0e5879f40e9aff3c0034384f08ac2008
SHA1 09e53dbcf3e7ee0268d845bab546c76d51dc4d2c
SHA512 3a1f1a1dd8586a3cbd6b4a2870893c47b9e17e011fdf2ea36c4262e33f593c63ff77e880cfa38292cc28da8c2d5533c0bdee160326bf289e5f5427b6418d918e
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:qQRQyi36YOcPQLvw2gAf+PN3vLm
TLSH
T1E7666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2f618d67b6bf5c4d135969f110d7fd43accc5c93e9271dbee71c0a5530c72b49
MD5 edc2d428b38507bb94e6cf9d351b7556
SHA1 185296c3b3e63435e9ab80851065fcc4d5cb74f6
SHA512 ed859a264972f2f2b23e36531a49594396cc936652c5e14188021a45a2cbbd400204d0c80b6f89a9745c3e428836b367636b4424354ac59d351c507b8a105692
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0/nQ/tbw/2Mkjy6B:b68Qg55nhheWu7PNU3/yQ/lFTjN4
TLSH
T16BB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 db9416796e7480c2ae2b8f102d3ccbfe440463a280ca7a24a37d5314d091b091
MD5 7f8cd187a7ddd2c5afa406ef29fd1933
SHA1 e803d3ecf27821051a4d7b6eadaa6aea04b58f7e
SHA512 00653bdc5b4b3e3e538b863528a8ba43e49c474d5f77b4a34f4e249d2c850b1e1dd806d5cf125b0f4bf3123b589b5fc494f176f6e7a44fce2828bf825e2106ff
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99w:iy5112gYy5azzVvL69nLKnhZALm
TLSH
T178167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2d4bc7c83a21981b837e0a0125e7074e9f47ec512cc16e07deef1f990f7fcee4
MD5 b31e0022c1d4de71aed44f75a1ca2416
SHA1 c64e084d8dc0b7e13a7e4341dab6ff9f402a5d2e
SHA512 e53388e87344d28e65a00eb1fa66fb9e17d95ab6c0e95d5d49472fb69e281791a719ccbb796a457bac0b261459b4cf0e867b34281e7f160e372c3cb5aff7455a
SSDEEP 49152:aB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glHQ/lFTjN4:Iu6JmVxd2dsLm
TLSH
T131D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bb3734efd98978f4643ef1429bcc9d0cc324fc6617ac9f71e5469dac4613cb19
MD5 11e9c93497341ba22508cded0c57c7c8
SHA1 b7651648b7678e89e374bdf78b98e5c9d9f8a6f8
SHA512 9368852cc9f31317721e0ce732b84a20fa148f8ea695a26c5e90c4b2b83c89e5944780d4dd6c266d705869b8eec9c487e868ff3335617a927c9b38c112d2029f
SSDEEP 49152:51hpsNoJpF1A6UU44CwH7R4xgQ/lFTjN4:5mifPbRiLm
TLSH
T147B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7c9fd68d8fa4a76ce356ba4fe6e08d3e2ad443904cc6dfe7e387880c0bd55bfa
MD5 b88a7b7d6b1ef705b79b1d3fd9ceacad
SHA1 ee233ecdbf25a2e18a18ae9a14aa3ff72a2984c4
SHA512 b8beeb5b50f3a79aadcb264e1ece4282640447506350eda9b96347f64faacc0175f6db6c08e3ee5285125c1b73257423569f5853986ac4559c87d13fead8aae9
SSDEEP 49152:rSuZQIY0Be2KRRVtOnks6NMHqvQ/lFTjN4:55dKTi61kLm
TLSH
T165C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 720c37d9ca35704c181b245df6ebaa24ed2a4499e5ece20f0b02032efd9a3f5f
MD5 8fe61852f75a21c009060850c370745d
SHA1 6b90230f20409af4c3fd07a441e61a20d67e1a29
SHA512 5afcfe415449f1b27c69b0aa85463640519cd072f8d24501c6b04fbdbd8f99f0232c8a197b0a6879962b439643cba4be0f27aa0f2a1647a065c63f8bed23c476
SSDEEP 49152:FhtSn8EApI0figngiDn0AP5wEQ/lFTjN4:0X2iyphOLm
TLSH
T17E95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 adb0046c8f9df0e331cd7e3d3e2f0f69b0a2d98ea34ef106750bf0435fc43b7a
MD5 159daafd72e0beaeeeeb73957a1bf56c
SHA1 7b138875880e1d16a2a82f7cae8c0f7ca68b629b
SHA512 75c19c9af7c8ef3859fc3452683785fb787dfe3648b41bdc4f765b53314af3246a1c6b33bde3781057d4f4dbc7119a06a991cad742c551247690a5558daa9f3c
SSDEEP 12288:djGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:dTnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1D25523693965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1c1a614bea04d6911f3c46ff2728c965b818de714fa725437262e65d1419e9a9
MD5 4701b9a001f7713e9a0acd185c5c32a9
SHA1 12ffea0fa77113206e24ea6601466f78e307ffb4
SHA512 d9c996dd465dbe8fcca4ed2c4730ac5398fb7906cc206e6b9fffeaee65634a202fc5e1c5875043042146fe62a00c105905571278de962caea81cf527625a2795
SSDEEP 12288:AWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:A2nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1F45523797965F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6c7f0b235a8c101c2f0c43eeddee64bdc7dfe907e6b156927b121d680d13aaf7
MD5 026468869a034e748b388260fc4379a4
SHA1 9d06d0c3bebb176d1d305dd2611815c69c55d12d
SHA512 fa72e31f908616a9b997b1d3b245e6781388dbc2950050fbf57135d19fb08d4ec3fb31eca07c3c68156deee5ed2064a34473df8a049cabbf35d043f36ec3a4df
SSDEEP 12288:LIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:LInQ/tbw/2Mkjy6Fr7g0op
TLSH
T1305523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 12b0dcdfebff7bb59fb2a32eef70151c0e7c4528dd1e588e0102f7a06ce1aa1b
MD5 4ee81d0c0bc13a35495eee4e12f9ebf4
SHA1 076f5a6072d6d1b2173ad182fe407fd0e5d0f2d0
SHA512 92951aa8b3b10338a8e7e9119b4be8177b52442fcc8c6a9e7aa061b24bb53048e2480909b29d7ef8c9ce65aa4569f8a27d40e07b50358f7401d949a60f8d509f
SSDEEP 12288:UVNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:snQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1155523693A69F4C7F92742B4CC928142E77B3DC6BBB1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 80a9e32b36aac116a6b958bec5f088ae5cc7b32610e2ad97deb878178f183ef2
MD5 8a964ad6ecf6f81fe533763e3f475c8c
SHA1 60b1c93902b9eb0de7e90e18c66e63655b9bc931
SHA512 5a2413f4f5ae1ba3f48ef5b25967a81035c3d6719c149900ef4c741f7fc7952bbad03814256e2154e68c98b1a3af656670f38c2f33cf47644416319f618fe7b7
SSDEEP 12288:9lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:9FnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T19C5523697965F98BFA1706F14C838182973B0EC7BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 290df6d14a6c1f1736c0222f7e5966707b3c336c7232088ef05970bd741e9592
MD5 8ad5643bda486c4ec6e239b50f9215b0
SHA1 4f1e5f703409bf7e274f494fa034a7736ce4433d
SHA512 b5a18c2f5f2b363fef74adc6a5c2a757a656ed73e40019cb533371ef1931216c1fd020d5cf7dd20eff8e86f444a505306650271d33356fb751c1c0c7d5b2a6eb
SSDEEP 12288:6qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:6qnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1395523697965F98BFB2706F14C828182A73B0EC7BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 99599c7f7b4a8d3312fa34ee416798caf90e375c27c13cfa7732ded1cdaf9dc1
MD5 52b22ab65767c79c2b5572c6139c5228
SHA1 b831b6c82bbc99f790be8160639657cb0eaa40f3
SHA512 f0ffaed6c2f3f576eab71b05b6f8548bdac92a3aa8265706041a2a0cf7b61bf2ae093eefce2a0ba7b380573ed24f52318c07ce8cb16499b326cee4c8be6f3059
SSDEEP 12288:NOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:NOnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1495523797965F98BFB2706F18C828182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 44b72ba88cc69072b3d122c3b823966f8db62e5037c8713b9f8edf62ab517030
MD5 7c781a72e8a7679771bee704be08aa1f
SHA1 85180774ef2ad486d24af5c1be9000b731820932
SHA512 39a5b5e93a6e1f36355f43dea8269106ae5f72376cc9f983539edcedaf2c0ed7e09b04bd8c55aeaa00a0f131abe87e30519c48702e527952f12f504af8045e3b
SSDEEP 12288:piZwbDzzFEoS2cPvy2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:sZM3zFVSOWnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1A47501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6a494cef4563ab6c01eefcd574c91a9ed81fa13296aaa0c2cab13dd8c8fc9b6e
MD5 58d8f377ae2c5c1c3f1b858b84c17bde
SHA1 3aff6fe8a7e678fe58612f866653e7a825863f41
SHA512 aff385aaa7bc33050c36ea413c0e9c24132d6fe2c1424edcea98133d388384749c9667b0421c6b669e4c9b5a9a03567974611038ba50d38a1d211329b456464c
SSDEEP 12288:k/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:kfnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T19E5523697965F88BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 51c47354aca8b4bd226bfe3f53e35be7862e8ad7505db78ae3da870dd3b8c66d
MD5 0bf3a6f095c92a561577ef02e5d0386f
SHA1 9346b6014171f7bc8863b6055b670d7194b54140
SHA512 b14b9f7ad2b2c11758f8bbc887d3af8739f93912a91eb9a2a57c4105308c87978f385c471cc259baa58ac5a3d1344f758ad4284ee203ecaf5888516fb25de7ad
SSDEEP 12288:BLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:B7nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1AF5523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 43cf1e42c99f0ae42cdffdf6c556d90947b056c6f3083e772fdcfcb2db3d52eb
MD5 5ef568c6cf8e6ad3a159c5a1f09d50c2
SHA1 ffa85833c9364cdb4fdbce7333c637b3df05aa06
SHA512 c52e12dca294b943bcef6063ed1f95cc13468baa0910004d59f009adb5311bfd6d98412c5adeacd71c803e9d61ea211d4c9af3188cbce5b8a0ab48fc25fea085
SSDEEP 12288:7yPz5L8SGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:2zySnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1B765021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0f691036cb534ec0c4fc2d069769bc1855992efcb9fb884114c5cd8d3f2e81f3
MD5 830190b7a455388bc5e4b9567ba6a3ab
SHA1 808cca39bda1dbe1f77254bab0a74142625d0677
SHA512 65ccf02717a90800f3569525ba5f5fb324f13394751e5e3b32d9a2db98fc616f4a203da0ec643bc3025e58cfc0e578e78c45ff9bee985313416e4ca5e7daaa48
SSDEEP 12288:4/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:4fnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1D05523697965F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 03b3e18fa7850e84900e88f0b08f3777c8fd29100fc23c58ae05505b646741e2
MD5 8292e9828732cb497ce474686e153b10
SHA1 de458e429ca1fb02139b33e0441c85aa28a46c4d
SHA512 d085579b209160528b0c6135cf732d6e6c62126ae9e24d9d4cf022be9ee5661493e3b929ad4819e06e156a2d3558d890d6a153effee8a8bb1ddce50ba541a7e9
SSDEEP 12288:q/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:qfnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1D65523697965F88BFB1706F14C8281869B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ea23a4527385d1ab1865d68d6daa717a24bc82ecd052fd1ada091bb918c3451c
MD5 d63c43492780d2229192034639c2f0a9
SHA1 13cf3ee39b65c20ca9db638775b465003e185345
SHA512 d93a1be4c6244e770ead2f70c69f5288c861f553163840e03e6d71d7d0735714257af1c4f30c10a446abd26ac6841dedded4220cc2fedd97d27663cb2db88f96
SSDEEP 12288:SyPz5L8SGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:PzySnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T15065021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 e4243f675eec319445f4e8133463c9e74219765137b83e4923c8651c7f9e2520
MD5 546220d9894092c6d8eb1c2769f2b5df
SHA1 e2e5dcb6f03ff4a4dcb35d36d86320e8d48d0781
SHA512 bbdf618dd50723529e252c79705ef208598e41bddde1dc86967010a4e7e2aeb821dca8e0f2c8cd4d3a9e21218f540001c51ff8d2f27cfd5e8b9cc2f555e3a86d
SSDEEP 24576:3T0aLl3z0zDYnQ/tbw/2Mkjy6Fr7g0oNi:3TDLljRQ/lFTjN4
TLSH
T1A07501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f91ff0a025a12250856485004d5d57b64ff628aa9bad9afa6a56ba8ff73a8b38
MD5 8a0ca28073547f48d93746e47c70e1ea
SHA1 ac5248aae5cb96d875213dc1ed6bfb73cc49cf06
SHA512 2f6d4bd9a559830d10cd884e5a08d88154c3ab70dcfc7c7b0f44d28d5a4914bf08cd1154d8cbb6d5bf96bf1973922a2314358c1f1ed494c7f90b7340abea4aec
SSDEEP 24576:031d9CHKy7GZsnQ/tbw/2Mkjy6Fr7g0oNA:+1d9CHKyaaQ/lFTjN4
TLSH
T16D85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6e563e11d4c7e44735961f2970c363eaf67c89ecc31db06a144ac05681201a8a
MD5 fb783fbac2fa897fd6fc62f083201cb1
SHA1 057b68d69993a092a2c824942ff3f7c3937bee9c
SHA512 fa7baccfd31e28acddb5cfbfba12893a57768fe1a68c36e105cbbd3301c4f36eb82d2c6e92b00a314f365493af93b090b5f5e3171ad71d773c509764c3d83e34
SSDEEP 12288:koGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:konQ/tbw/2Mkjy6Fr7g0oh
TLSH
T10E5523697965F98BFB1706F18C838182973B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0a961386d3a31974f9c6d6771b1400c04ad04e46dcd9d55b7969db51288e54a2
MD5 0966099aa91e84641c1c4853b5c3675c
SHA1 86d75f0c887ac3d5ad87cfb4b3a7744543ddae0c
SHA512 fba67be0024c2de0386985eaf193ff1550d5a5e3813633cf5d8a4d69b841d46fdb86e13c9514475c97d4ef8151c8e181187e6050f0ae59e6b018479d32f8b427
SSDEEP 12288:XyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:XynQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1645523797964F89BFA2B06F14C838142A73B0EC6BFD1938F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 cea079ef8d2f8aa6f8842140634794a1f2fedde2331ef303dce3b50f98bb0ffb
MD5 7e1e692d497a868fab8b611ab5127d57
SHA1 8e68708d2cc43c3842167688f0ca9dcc8876e73a
SHA512 658063f6bdc423d66d16623c3681460f26b8c6f79108908df928e68cfd6a6f3504fb343cd79a11d7c63786784c59dbb4a8f5410ea9b4c1bbbea091065a8980d2
SSDEEP 12288:e5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:eJnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1DC5523697965F88BFB1706F14C8281829B3B0EC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1cef09c3f244518f47bd7d73b272812d54ed76ddf98891b93180d40321f400e5
MD5 1546c0acd356979b54b2373cb15493ef
SHA1 2cf802de44cd8b5d58169407bb0d526b517c42d6
SHA512 21ea5832e81d59190cc3c300e445491ddd4dbef2c47304ada596ecc1be35925f4c9d90c65bb8e052de6ef3142d96eaf8d2e9c094812ea67d3ed863f59aea4dac
SSDEEP 12288:b/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:bfnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1A55523697965F88BFB1706F1488281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 338aed23f1913032caafc4fac6c3669f270d8aa1be48f6c58f9db1d7f51cc2ab
MD5 aee356e740a71fce24dbb594d1065c34
SHA1 41280e0d0e99c7349f106bce176353930ced4565
SHA512 e056af6c1b6d759d72414821fd34a6f50208f5bf27d5423b38d2d6025196f15437118ff82406d5a2cc763037894a9fe0eae6e401c91b90f3591411372e592841
SSDEEP 12288:6oGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:6onQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1025523697965F98BFA1706F18C838182973B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 55613c5a4a6a2131d1e1d252aa655ebd7304d9486a3b5b8b342368198498847f
MD5 cf836323f6dbb757e85d049916d4aba6
SHA1 4060e3c3363cf42ae3b5d94d8338a7e3354856a6
SHA512 6f7c31d56f61d525ad666cbc252dc59b5cf63aa73f7596f57e6e740bd7066f0ea31565fee7a03186f09b0a447d7b36142bf89ae71dd1a7338df431244e764e1c
SSDEEP 12288:7XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:73nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1065523797965F98BFB1706F18C8281429B3F0EC6BFD2938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f21cd97b70d6e4a373ea789fc20395032ce4cdb2c9683d36d8f4a0b5c82c54bb
MD5 031eed2cfb47a7692e4676a6c31a96c3
SHA1 b0def1f9731eb4e4faa0b3320045ca53e28fad10
SHA512 158a12bdb4b8441dbba77b4b9f610cf4919894622c486e4d1fcc84a66f83c3f12397e56f162c3ac591ecee57668b7834870befeac4e9780157f273ed4efbee49
SSDEEP 12288:nlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:nFnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1B15523697925F98BFA1706F14C838182AB3B0EC7BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 a91ab2e1c32216c38f19ff1f135523008efcecf8324b232a239945bb6a5953b5
MD5 e4cbb1c98f8e79270eb9ec326b0c30be
SHA1 821cce49df6921ebd64e27a2f26d5fcdb24705c1
SHA512 3674c9d68431e6ee699d69c7f5568df063862e08ed10808aff856f25092a238ccf17b20154f00636a4a1eec1ee46af1c6d5647999c7ba8bf22ef556e4f5d9225
SSDEEP 24576:dfwv/k9RX6wkyAIrnQ/tbw/2Mkjy6Fr7g0op:MMnYIrQ/lFTjN4
TLSH
T1B485DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 30c4e68d054655aaae020b62ffdcfb63e663fbe8c8b49b7582d716a9e91db34d
MD5 81d8c76e4cf1e806faf47fb87b5a9412
SHA1 684f0191d1085347e96edc15c764bd806ed2261c
SHA512 a713316b8ee03b7e886cea8cc2a935260e318f4d59cc80f41e1c14a8273d3dd4acb24b2c277c8d13d3e6a12159f812f0623b331e0a5dfee31e66f94424ea1685
SSDEEP 49152:gYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kQ/lFTjN4:OySzPPLm
TLSH
T179066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e7ccd8cb73f5e1a3b8025545ca73731561b20a7898a161b635020b8c76bd405d
MD5 7ac67faf07f9713baba1c18a02ab72a4
SHA1 7d4dc9873c43ce3354596d564135b8492c414f8f
SHA512 db973fcfa828387234d955d4ae01830fdfd4eef2c021be4392dab306a14501d698c30dbaf9d82ce8a825ff85cc8811b978326ab1af5332600ed503e90867ccf9
SSDEEP 24576:N47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYGnQ/tbw/2Mkjy6Fr7g0oM:N47JUQj1irIhCnDHUPfF/UQ/lFTjN4
TLSH
T15065AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 30834be4190437c6b9489f6c9005be971b04cc27baa49cae7a5ada8eeef0a710
MD5 5dbf9a7b728f55ca2e24ed421e42df55
SHA1 af9fad58fe2b7ca1dd1a99a52a4c43c80086de41
SHA512 3b3cb6219959e3ac63cbe6f4b00a6f2213968e0d7dd38b5adbc62cb8b7557ebcd4809ffb754813f7953ea24d20965cb29999979077ed523c09ee02e8c3657a1b
SSDEEP 12288:BssfPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:pvnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T11C65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 2231bd749d20121013b6113867f1c9bc91dba33c6791551f33828c0755a0f185
MD5 a21a9c31d19b29d343d5213763ddb110
SHA1 1295483d9ce0a70a16aec9aa609bf00d648da3ef
SHA512 3c429680e49237eb748e47a2b95ae81cc16b2c5c4f6bf702eca09bcc519d656271c71a52725be5b878fd15d4059e6c0e7658fe150280226b83574315af810f88
SSDEEP 12288:MxzBWpU3f0Ol0VMnY63s1uvfqUQL3FB+WtcyPpJojFpmHiCu7:MJIpUP30VM5rjiVdPPpJ4qC
TLSH
T174451840766AC75FC6AD40321E32D2CCA7707D01EE45AF0373C99B3F9576668BAB2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 fae1c756351be0069bc084671ce8728cf59c1bc9b89b1e34552241e20c7015fe
MD5 a1f940e01ff3d25fe9e3b2ea968d2712
SHA1 799020e22cfbc54e579262f9b791d69e2ffe64c6
SHA512 0d494fcc2337fa7dfef35976fdb608e5042aa36145c0dc706ebb9aabcb054c54399e8fa0503d6723fd8493716c65f97552b7a07b0107ac6ef3c75733f0e678d3
SSDEEP 12288:blw0H0wQyip8mrO8sDBsVQkvjkaDvyWwSCa5wTigLsSVJFvxVzuzOT7endj6t:9E1oQOXY56t
TLSH
T1BA65F981613BE3CFD1FA503207295B4C6764EC06B7096F2677C8493AD86BB25A1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d7db325804c5505d52f847cdd46f03ad7cb00f99f57c816d7601e2d62770b275
MD5 78e22f45d8292bbfd2f5e38b56efead6
SHA1 87118d099c92b0aae75fe442bf6426d65de129be
SHA512 7c7a1af3a06f3133e4e5a59efed5f908e4eb0185c84a88848f0c8a1ab2e7553dfe2725a938f3842f64a915a1a715c88940d1e7f8c636a8b6eb7462d99f6f224c
SSDEEP 12288:k67nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:vHnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1765523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 43247d68daf16815cee6248a862b3e30b6dd5805ccbe1c70dcecadf347fc457f
MD5 0bccac1ccd3c3321de2da886e8d5be39
SHA1 a986f5f56134cfd9bb5ce06d7f1052f43d933fd9
SHA512 d3b51c325598cffbfe0eeaacdba33ab2ec61e7397a7c01426770cab77bd2909ff1d687e9e9d28bd25b36d69fbd6c6f9c437828d2014654f52147fda1af28c674
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYRnQ/tbw/2Mkjy6Fr7g0oz:Egb4mBIBhGFGQ/lFTjN4
TLSH
T11B65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 08c1c52e2e2c1b0ee121c25cb2e04f885976eeb2291481c2aa637e07e1c05f27
MD5 ee1496c3383d6e36e7160746528f6c71
SHA1 4a0c19e355948037a85e80a4c0dde6cdb6d41706
SHA512 bcab714265f552a9e8707c5dfc8007048d326b6c26008f7ef5c0d8bd06d9759ff568345e7b5065715979e29fcfcf156545d62c0914ef840bdff497205b412f78
SSDEEP 24576:IG88u8FpJqH1Qzria7/mWnQ/tbw/2Mkjy6Fr7g0oX:r7ZFPqVva7/pQ/lFTjN4
TLSH
T13285F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 038ecc78931218e9f16feefd63c6d377dd947392137e2a4a50da2815b8cdd210
MD5 b5c3ad34906bec8f4995893de71403d7
SHA1 c056abeefdf456142b9793c573dac24df8765b9a
SHA512 d9ba72e8d2611e130c4bd20507b5532f4cbd15a695a4b224b61f8edccaed1e87216bf38d91276b152f7463836466499d7a8eaaa91b21e782e2ac70fc06958272
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjqQ/lFTjN4:LG05lO43boLm
TLSH
T12DD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8da0aab2db601f0e3085ff330c81c170a3a7d6d6d798e03e08047cbcc52df23a
MD5 042e364fd63e9442ba294de235c98dcb
SHA1 72d8daef447c58bb694910a6032f3f74cfb753e5
SHA512 f0a42cd0d2299e8d8e2be9b2c9dc99888e9f10a48d822992408678e97a297fb06a7c26d072759488e22238a48bbf97d6b5f4ba7b62f3dfe5b92a8b80d7ba108b
SSDEEP 24576:Mfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnknQ/tbw/2Mkjy6Fr7g0oO:Ua5POZ3+Jt2pasx2+myQ/lFTjN4
TLSH
T10A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f9cce2c50dd0c9140a5c4a4ced2ef59b37dc28dac4ade9a4def6e0c10d87fe92
MD5 c6b285413dd8b6c661379a3854efad51
SHA1 b1397f0d80da76c47afd40e9a1659d3704a64960
SHA512 38e5eaf0d86ad0d41689f7e32a1dfd24778732404f7afa4412c415dd7a43325ce1fafefc008313b14e55f9af302107b934b47dd3452990dbe03db87f6e10f5a1
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7FkenQ/tbw/2Mkjy6Fr7g0oz:yNc/zEOVHFJQ/lFTjN4
TLSH
T1D7858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f696417923baa64ade11d6b44ed3c5c7031f7f2f3d8a5161d1facad3a734f0d8
MD5 cddae258cefba743a50bf72014e8a15f
SHA1 b440205cac9e56c44fef96da2cf53d069c62f0bf
SHA512 2922d93478edd88f5f0b156e61ed60cfb3f357c5b045b7beaaa2760a2038b392fbb1ef4bfff11ccaf22bdedad055e186beda24051a3934ce8d3facf9a8c50db0
SSDEEP 24576:88kNvNnaFeYhJNtmZBmbnQ/tbw/2Mkjy6Fr7g0oR:88MwBtOmbQ/lFTjN4
TLSH
T1F655AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7d953cc4c57be21ed4167ddeb3749bcf3340c1806deffc227fdd2b5637a0f6c9
MD5 4899b0bac0ab2d2b3641181bd1669e6c
SHA1 78c931475e360833dbdde5c21575521d4feca2c3
SHA512 4875b7dbd55f97052dbf0f8e1734fe5d71f9e68176547aa49f454ab64810f05521cd0efa3d692fb840da2020dc0f8f0eddf218d67976057732a21d2057d13fdc
SSDEEP 12288:uHvUrBFrEjwaQaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:uPUr+NQanQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1DE65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3ac224933a2deabade91732cde77d4ba922bb1521457353ddd3f7254d63e1817
MD5 68eab8343378e7aa8c456e86de8508b7
SHA1 0912ecfb95dc258d5be6efa332f6a4d60968874b
SHA512 bafea4a2d56cb86aa3ebc11470e34dec3663d89aacf567d618b55f5a08b5413dbf6ccb7c9d37cc16b9f774f163a85d015f9f25502d2a232dbd3c0ec2d83ff92d
SSDEEP 24576:tD3FHshBIYQgAznQ/tbw/2Mkjy6Fr7g0oQ:tDVHeBIAAzQ/lFTjN4
TLSH
T16F75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2720-42-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2720-49-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/2720-43-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/2720-53-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/2720-55-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2884-6-0x0000000002280000-0x00000000022E6000-memory.dmp

Download

memory/2884-29-0x0000000000400000-0x0000000000569000-memory.dmp

Download

memory/2884-0-0x0000000000400000-0x0000000000569000-memory.dmp

Download

memory/2884-7-0x0000000002280000-0x00000000022E6000-memory.dmp

Download

memory/2884-1-0x0000000002280000-0x00000000022E6000-memory.dmp

Download

memory/3060-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3060-315-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3060-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3060-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3060-110-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3060-104-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3304-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3304-13-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3304-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3304-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3304-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4444-123-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4444-317-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4444-115-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4444-117-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5064-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5064-97-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5064-91-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5064-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5064-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5064-329-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5252-310-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5252-68-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5252-70-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5252-76-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5984-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5984-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5984-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5984-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6516-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6516-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6516-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6516-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6516-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6652-80-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6652-86-0x00000000009C0000-0x0000000000A26000-memory.dmp

Download

memory/6652-81-0x00000000009C0000-0x0000000000A26000-memory.dmp

Download

memory/6652-311-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6940-64-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6940-57-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/6940-58-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6940-295-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/7108-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/7108-138-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/7108-134-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/7108-128-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/7108-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download