72660af9a80be1f87ea365fc49c80ca64ef66645199a024e454ef9e4588b88e6

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 13:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_98500e658d18fc2c0014533c98428358_elex_stop.exe
Size 15.5MB
Sample260910-qhhvdsxwhy
SHA256 72660af9a80be1f87ea365fc49c80ca64ef66645199a024e454ef9e4588b88e6
MD5 98500e658d18fc2c0014533c98428358
SHA1 e1cc89d355f9e1c3650dc4215c0526f93b9fd72c
SHA512 ee3e9a1f35eb390db1493012ae34811c975fc6deaf9e0f77da63f582cea41ba3b3981a1813c573462df1ae1c9e70bfc2836dc8aeb178e71ac356df4264248dac
SSDEEP 393216:e0wnpI/Si/wBqS80swuvUGvjGwN9NEenalmjEu70MC:e0AIa5B5JgalMK
TLSH
T1BFF623632AC2C03EE2A254728C5F8DA456A17C234B3145DBBAD0FD2D2EF59C27537B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Custom signature

Detects executables packed with Dotfuscator 5 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5bd-270.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x000c00000001c5ab-272.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x000c00000001c5bc-274.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/files/0x000c00000001c5bb-277.dat	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/memory/5536-278-0x000000001AD80000-0x000000001B40E000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator

Executes dropped EXE 4 IoCs

pid	Process
5536	cbsmsrv.exe
4928	cbsmti.exe
4108	cbsmti.exe
2256	cbsmui.exe

Loads dropped DLL 3 IoCs

pid	Process
892	MsiExec.exe
892	MsiExec.exe
892	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Corner Bowl Server Manager = "C:\\Program Files (x86)\\SpectorSoft\\Server Manager\\cbsmti.exe"	msiexec.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	cbsmsrv.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	cbsmsrv.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	MSIEXEC.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\CBSMSnmpAgent.mib	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\log_warning.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\text-log-report.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\Ookii.Dialogs.dll	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\Renci.SshNet.dll	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\monitor_warning.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\server_manager.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\Readme.txt	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\error.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\report_error.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\tvwminusbottom.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\directory-size-alert.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\event-log.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\event-Log-consolidation-complete.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\file-count-summary-report-item.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\new-accounts-report.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\log_critical.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\syslog-view.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\text-log-view.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\mysql.data.dll	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlStyles\treeview.js	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\event-log-report.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\file-count-alert.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\server-monitor-failure.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\CBPopupHelpCtrl.dll	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\disk_warning.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\log_disabled.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\monitor_clear_running.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlStyles\index.css	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\disk-space-summary-report-item.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\sub-directory-size-summary-report-item.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\temp-files-delete-report.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\auto_config_disabled.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\SharpSnmpLib.dll	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\SpPerfChart.dll	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\XPTable.dll	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmti.exe	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\disk_critical.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\tvwnolinesplus.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\text-log-hide-duplicates-report.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\monitor_critical.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\tvwminus.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\tvwplus.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\account_lockout_alert.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\disk-monitor-error-summary-report-item.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmui.exe	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\ActiproSoftware.WinUICore.Net20.dll	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\directory_error.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\disk_ok.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\log_clear.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\account-lockout-report.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\syslog-hide-duplicates-view.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\auto_config_running.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\back.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\directory_critical.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\disk_error.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\log_ok.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\report_clear.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\tvwnolinesminus.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlTemplates\file-size-summary-report-item.html	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\ActiproSoftware.UIStudio.Dock.Net20.dll	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\shortcut.txt	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\host_disabled.gif	msiexec.exe
File created	C:\Program Files (x86)\SpectorSoft\Server Manager\HtmlImages\report.gif	msiexec.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF1B37E6E2A0E2F932.TMP	msiexec.exe
File created	C:\Windows\Installer\{97FC5A65-83D3-4D7A-B76A-F985EBED9B46}\NewShortcut3_15946E080EDC488B89198F75EFD345F3.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{97FC5A65-83D3-4D7A-B76A-F985EBED9B46}\NewShortcut1_6FDDAEF1041547F0AB5841131773361C.exe	msiexec.exe
File opened for modification	C:\Windows\assembly	cbsmsrv.exe
File opened for modification	C:\Windows\SystemTemp\RES1947.tmp	cvtres.exe
File created	C:\Windows\Installer\SourceHash{97FC5A65-83D3-4D7A-B76A-F985EBED9B46}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI718.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6FB565A092628A2C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{97FC5A65-83D3-4D7A-B76A-F985EBED9B46}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{97FC5A65-83D3-4D7A-B76A-F985EBED9B46}\HelpShortcut_1F78316C5AD1408DAA3E90A86E301917.exe	msiexec.exe
File created	C:\Windows\assembly\Desktop.ini	cbsmsrv.exe
File opened for modification	C:\Windows\Installer\MSIF96A.tmp	msiexec.exe
File created	C:\Windows\Installer\{97FC5A65-83D3-4D7A-B76A-F985EBED9B46}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{97FC5A65-83D3-4D7A-B76A-F985EBED9B46}\NewShortcut1_6FDDAEF1041547F0AB5841131773361C.exe	msiexec.exe
File created	C:\Windows\Installer\e59f11f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF73ED5AD6F916107C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFE5B96A3FC956C77.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI748.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{97FC5A65-83D3-4D7A-B76A-F985EBED9B46}\NewShortcut3_15946E080EDC488B89198F75EFD345F3.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{97FC5A65-83D3-4D7A-B76A-F985EBED9B46}\HelpShortcut_1F78316C5AD1408DAA3E90A86E301917.exe	msiexec.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	cbsmsrv.exe
File created	C:\Windows\Installer\e59f11d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f11d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_98500e658d18fc2c0014533c98428358_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\GPU	cbsmui.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.26100.1301\"hypervisor=\"No Hypervisor (Microsoft Hypervisor with SLAT support detected)\""	cbsmui.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\Version = "201326592"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E9024922259554A41835FBEF420551E5\56A5CF793D38A7D47BA69F58BEDEB964	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{E0DA7DDC-DC1F-4089-A261-962BFD87C7CE}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\56A5CF793D38A7D47BA69F58BEDEB964\ApplicationFiles	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\AuthorizedLUAApp = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\SourceList\PackageName = "Corner Bowl Server Manager.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\PackageCode = "FECC25034C43E16439516BA3B619D668"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E9024922259554A41835FBEF420551E5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{E0DA7DDC-DC1F-4089-A261-962BFD87C7CE}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\clsid\{32E54952-EB8A-4158-9FDD-6F170E77225B}	cbsmsrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32E54952-EB8A-4158-9FDD-6F170E77225B}\id = "639246466009976512"	cbsmsrv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\56A5CF793D38A7D47BA69F58BEDEB964	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\ProductName = "SpectorSoft Server Manager"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A5CF793D38A7D47BA69F58BEDEB964\ProductIcon = "C:\\Windows\\Installer\\{97FC5A65-83D3-4D7A-B76A-F985EBED9B46}\\ARPPRODUCTICON.exe"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4964	msiexec.exe
4964	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2256	cbsmui.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5856	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	5856	MSIEXEC.EXE
Token: SeSecurityPrivilege	4964	msiexec.exe
Token: SeCreateTokenPrivilege	5856	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	5856	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	5856	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	5856	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	5856	MSIEXEC.EXE
Token: SeTcbPrivilege	5856	MSIEXEC.EXE
Token: SeSecurityPrivilege	5856	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	5856	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	5856	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	5856	MSIEXEC.EXE
Token: SeSystemtimePrivilege	5856	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	5856	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	5856	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	5856	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	5856	MSIEXEC.EXE
Token: SeBackupPrivilege	5856	MSIEXEC.EXE
Token: SeRestorePrivilege	5856	MSIEXEC.EXE
Token: SeShutdownPrivilege	5856	MSIEXEC.EXE
Token: SeDebugPrivilege	5856	MSIEXEC.EXE
Token: SeAuditPrivilege	5856	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	5856	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	5856	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	5856	MSIEXEC.EXE
Token: SeUndockPrivilege	5856	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	5856	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	5856	MSIEXEC.EXE
Token: SeManageVolumePrivilege	5856	MSIEXEC.EXE
Token: SeImpersonatePrivilege	5856	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	5856	MSIEXEC.EXE
Token: SeBackupPrivilege	5584	vssvc.exe
Token: SeRestorePrivilege	5584	vssvc.exe
Token: SeAuditPrivilege	5584	vssvc.exe
Token: SeBackupPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeBackupPrivilege	5648	srtasks.exe
Token: SeRestorePrivilege	5648	srtasks.exe
Token: SeSecurityPrivilege	5648	srtasks.exe
Token: SeTakeOwnershipPrivilege	5648	srtasks.exe
Token: SeBackupPrivilege	5648	srtasks.exe
Token: SeRestorePrivilege	5648	srtasks.exe
Token: SeSecurityPrivilege	5648	srtasks.exe
Token: SeTakeOwnershipPrivilege	5648	srtasks.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5856	MSIEXEC.EXE
4928	cbsmti.exe
4108	cbsmti.exe
5856	MSIEXEC.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4928	cbsmti.exe
4108	cbsmti.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5856	MSIEXEC.EXE
4964	msiexec.exe
892	MsiExec.exe
2256	cbsmui.exe
2256	cbsmui.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5728 wrote to memory of 5856	5728	2026-09-10_98500e658d18fc2c0014533c98428358_elex_stop.exe	89
PID 4964 wrote to memory of 5648	4964	msiexec.exe	96
PID 4964 wrote to memory of 892	4964	msiexec.exe	98
PID 5536 wrote to memory of 240	5536	cbsmsrv.exe	103
PID 240 wrote to memory of 752	240	csc.exe	105
PID 4964 wrote to memory of 1888	4964	msiexec.exe	107
PID 4964 wrote to memory of 4108	4964	msiexec.exe	106
PID 4964 wrote to memory of 2256	4964	msiexec.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-10_98500e658d18fc2c0014533c98428358_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_98500e658d18fc2c0014533c98428358_elex_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\SysWOW64\MSIEXEC.EXE
  MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{E0DA7DDC-DC1F-4089-A261-962BFD87C7CE}\Corner Bowl Server Manager.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-09-10_98500e658d18fc2c0014533c98428358_elex_stop.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5856

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 27FDAF06E2BCE8DE11DCA33F8830CF7C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:892
- C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmti.exe
  "C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmti.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4108
- C:\Windows\system32\Notepad.exe
  Notepad.exe "C:\Program Files (x86)\SpectorSoft\Server Manager\readme.txt"
  2⤵
  PID:1888
- C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmui.exe
  "C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmui.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2256

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5584

C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmsrv.exe
"C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmsrv.exe"
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\ck74ms-w.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES1947.tmp" "c:\Windows\Temp\CSC1946.tmp"
    3⤵
    - Drops file in Windows directory
    PID:752

C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmti.exe
"C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmti.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59f11e.rbs

Path C:\Config.Msi\e59f11e.rbs
Size 29KB
SHA256 1a8a18e3793f2c8abe9732e47bc80862c2e5393cb9c44067015f06152354d9e6
MD5 6969b3051b21787e203a1aac786afcba
SHA1 a91e472b6c198ec4f8ff9aaf5c882a0a202aa703
SHA512 b9ee2da5dade9cf6c011c038e9d22644e4603448b708f7765cc29380d5cfd1603f4661d4ae422940fcf5bf8083f47246ccec6a13ffb572c2bbb9df1f3cf513d4
SSDEEP 192:9sTmciMVKOwRE7leAGuKdUQk2LiBGEKhC29EBV7iGjAeSN+XAwIkN+XAwxQIgoOf:9MlVKPruKdUP2k4rN+QwN+QgQZ/
TLSH
T1E9D25E1ACE5782C9F62764F7BFE31D043710C997BB648499228D87BF5AE1B1027BC162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.Shared.Net20.dll

Path C:\Program Files (x86)\SpectorSoft\Server Manager\ActiproSoftware.Shared.Net20.dll
Size 224KB
SHA256 b57924b3a5cc06b704d6c77203072e14e6e4af11378eeab9f5392ac7210c1425
MD5 67ec38b4fbd9669b2df902b7bbf32216
SHA1 0a0eb36a78b815839e3e679a5a6642c3285b2cd2
SHA512 7e649710a615d0e6c59593354af6a6fb34dac24a55c1004b79594715d566af28284cd67a60c42f95a706980f98244466bc44f24ee0ed9a0d5e422dd2ed9ac29b
SSDEEP 6144:z80MDMg+WEXUE232WK10puzip66hDamgnnnnnnnjnnnnnnnnnnnnnnnnnQJk:zl8Jk
TLSH
T1FB240914B3A88C25D2EF0B34A15781568BB5D227D05BEB8E1CC52AFC5DD73D88D2B09B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.UIStudio.Bar.Net20.dll

Path C:\Program Files (x86)\SpectorSoft\Server Manager\ActiproSoftware.UIStudio.Bar.Net20.dll
Size 584KB
SHA256 342749b5d8ea0b60bfa8c2d8bd9e9588ad5b686cfe15dac90d53c4b5bfc8dae9
MD5 5ded51376b8b1d18f05b8c4e56c5a520
SHA1 a5a06a39c50198e86e428de43d1dadc77f93b2b5
SHA512 f51f27a2e39e1f8879d80d7de9953b10121fd3c9c408e9f9718005119e14b70b763d3afa17d829d5370baa52333d845af95005f19aae82500bf8804eec14573d
SSDEEP 12288:s2igeqlcmkbPUnKl3yKJ94DlhIAENi6Ih/u1SVC+Xu13S:s2i9+cmkbPUnKlCq94DlhIAENi3xXVhc
TLSH
T15CD41710B2648D9AD2AE07758199102087F5E617D1CBFBDFAEE069FC5E8B3D1CD0609B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.UIStudio.Dock.Net20.dll

Path C:\Program Files (x86)\SpectorSoft\Server Manager\ActiproSoftware.UIStudio.Dock.Net20.dll
Size 580KB
SHA256 c047bd5c794915bf796e245e261192ade45a6587830f9e3eb010f7056ba9e439
MD5 b2a78591bb673e48d931b413470d2c51
SHA1 4f9f1cccd6dca8e5c73bcbbeabc1dd35301b12a2
SHA512 cc5e8124dfce0510794f1e7791a00450d33ba882c4fcd03f07d9d006bc4586f15507f9838fabd70a6637367b88164212337f34cab8644fcb9ecfa2e0c3429c77
SSDEEP 12288:TDjiORf/NGqFXyXxEwsiIt6eFmyN9KEwnSw+Ntb25:zia9FFmyPInmd2
TLSH
T16FC44B422B64CA36E2BF0371E092501887F49D53E2CBFB9EBD94B8F81DB77519906097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.WinUICore.Net20.dll

Path C:\Program Files (x86)\SpectorSoft\Server Manager\ActiproSoftware.WinUICore.Net20.dll
Size 160KB
SHA256 773e9dd53e7d0526dfebb441d0c6b54b0f166292fb2747cf0f784bcba123a50a
MD5 fd03f1fdef53b997746344915a3ce8e2
SHA1 083f39bfdb9804b411ac3bd056b00b290171d021
SHA512 e341924c950f5ada5c00496873a8e43002924c9b0d3de3b1f0fb8e9288c0c428af32a3273c5e973ed61a604a1c39ffa7e6192bbbe612448eaef3a72e7d37fc17
SSDEEP 3072:QXZQrHols3JksGewtyOty42risTVfQZCoP/8xy5NPbq6h4qq52LP:HolMOty4FWoCo5Hq
TLSH
T150F32A213368CD27D7BE4A79E094127457B0EB22A143F79A9ED03DFD9EA7391C902097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BinaryComponents.SuperList.dll

Path C:\Program Files (x86)\SpectorSoft\Server Manager\BinaryComponents.SuperList.dll
Size 150KB
SHA256 a232059c6cde392d356e00a0dac3fd4571f9e65276b26b1e0ec9a0be30b31139
MD5 4442848a5f1c38028c553a3ca1e6d642
SHA1 7ba4672cbd496ac55274f3b8d6ebb6c2cd7ec0bd
SHA512 0b39778ca796aefc7bb3bec0f67089d49aee23ca032ebb1054dbfec431ce42c60946257740fea39bd0a8bf68054c6f20d8b6b0d49f4d45fcaba68755cd7281fe
SSDEEP 3072:KBLFb6usLhghqeREdOiwpVNxXDvSGna7bYhnl11qHRxmbCoSPWiPRqtZvF1p:KBRbD3+HwpVNxXLSpfanP1aRxWkyrF1
TLSH
T1F9E35B2E33589E27CA9F027DE1221511D7F8DA55EB43E78A9C41B1BE1CA33C1D622397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpSnmpLib.dll

Path C:\Program Files (x86)\SpectorSoft\Server Manager\SharpSnmpLib.dll
Size 189KB
SHA256 f1d2a313d362f89cd1d01f6927ed60829a796c6fd0e355ecd347d47c5a8d3b46
MD5 243c99c7e23d0ba00ef1cf32e1cd1894
SHA1 d8ece0faace583c5aae08ad5dfd36fc2bde92afe
SHA512 3c8420c77c640ff3859dc75c6e91689d4ea02106227a9de0758935991410651ec3bfc574d47d62d7aefc625992a2414fdb8138ad24ed1583e5c4b4a1fd760272
SSDEEP 3072:dxUO7SB1vkCa3x8CDiiaYk/jiApKcaSnjLzGkraKwVZ1:+18Ca3F5aYM+4a
TLSH
T1A814F91C17D4963AC7BEDC35E43C881A8274D60AFAA3EF5D7C98A0E93C01755B58227E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPTable.dll

Path C:\Program Files (x86)\SpectorSoft\Server Manager\XPTable.dll
Size 320KB
SHA256 87823164870f351a03dcf99817ae24db4b97ddfac1b9a22f6de89b0d6a75777c
MD5 8236158a5d2c38e3713fe03af561e3fc
SHA1 3259559adb1a0c727d6cabc5dc43aed211f0c15f
SHA512 0e4c9dadb525a73df86b1ffe7f3b867754c61961597f591164a952ddce7debc00163abab5a8583d71b60fc43362405d35547d2d072237bf543dda6a6dcca9070
SSDEEP 6144:L/h6UPdSfSXf35D4qH8gu77jbcmoVXKqvW9LbGPlZGB:L/hVzft4
TLSH
T125643A61236D9A2EE29F87B9D058409587F4D327F18AEB9D5DD050FC2CC3B52E5232A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbsm.dll

Path C:\Program Files (x86)\SpectorSoft\Server Manager\cbsm.dll
Size 6.5MB
SHA256 4ff8937db31dde2dab127b0b7c921fa52f0994e54de8a86341062bd7944cd1cf
MD5 f6309d1cb17a890967eab879e9e1bd8b
SHA1 f56e192619d3cdca95be88d4086b62649a51442f
SHA512 9a3f04bece23540f815ba180d2518610206195496369139265b0548a29ea0fde726ccf597739431917c6ce2564a1f3958bd80c07fccc7e7c1df8c9e1c83794e2
SSDEEP 98304:5mrCpTgfDbWPDMjMfbtLmCuu3TjOpfUqZ4YZ3L4FLwk+A4IeOEe9U:5ylcDkaBLXVjSpZiYbg81DQQ
TLSH
T14166190073F8495BD13E9AF8902551504BFBFA1AA7B1DBDE4C85B1AA1CF17509F02BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbsmsrv.exe

Path C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmsrv.exe
Size 155KB
SHA256 37b8591b38d667b1334bfed4493e60d45ba48a82fd4a56025a5372dae99af66d
MD5 d479ec2ec77540f8055f87dedcb53f9f
SHA1 3694f4adfeb5effbad859bfbbc538f966c274d90
SHA512 c7458462a5efc0d8fd077bb53496f7f9da14ea0fbc565e7f97144cc7a715a1be13665d327eab95421fa51df0faaccf7b72044d2411d84996e30c39601829fd8d
SSDEEP 3072:jw8uNtAfmxMBeJfLLKv83nitkJx2IsHC1pv8vDTx:uBBLLKv83nykJoIsi1SD
TLSH
T171F31A1537D80A0BF5BE1B7320B54A450B39B463E7FBE38E08C1A0B91D62791965B7B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbsmti.exe

Path C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmti.exe
Size 46KB
SHA256 8198adf64d7ff175357842f3bc435f3c2f01f861848ed28178b70441403cfb35
MD5 b4f3fccc1ad5c970b61a2994051d5198
SHA1 6a820d917c06a67b70adccb03846c2c561fddc2a
SHA512 19abc8bf17f756b3925eab4f998a644fb8541501c2f55b56e6668181b91ab3ac20146cdb5cd5df2e1898568ddda000190a2676ce448b09a3e35a2727680d46e4
SSDEEP 384:/RMvtKC22lzYLzlVCChKmKYlZRNOxrTNvwMC4Tvm96u9q96uz96un96uhjhDZ96W:ZM1KP2lkLRMChFuxO16jhD9uHw8Zsh7
TLSH
T1BB23074127A8016ACD252B7A6A52B0F02E74BD0767F99BFDCAD4378077BFB020709567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbsmui.exe

Path C:\Program Files (x86)\SpectorSoft\Server Manager\cbsmui.exe
Size 381KB
SHA256 067c8241d8ac384349f1b7844340a9b419ee3f0b90673a3bb6cb336dc7fcae74
MD5 d9a833c37966b95dff988c8a373fa88e
SHA1 e13fcec2c79632dcdffb1ffca82f9c9d9fde6d92
SHA512 d59a8e6f29c3539635d5c3725c8e1e17d279e5cab2a2995d33bfa157ee94d406e8527c797ba1a3735340bd1e57891ac8b445950f2e8c50b454bad9a455d2113d
SSDEEP 6144:beN875q9x9Hh0QUxGuYyKsOPRvKwNyalMZUw3VeWABgtXgv3G3aB:b3uHh3UEiO
TLSH
T1F284290233EF1908D8762FB51A7550E0AA367C9B69B0C66C0D94B64F26F7BC19B507E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

readme.txt

Path C:\Program Files (x86)\SpectorSoft\Server Manager\readme.txt
Size 100KB
SHA256 93dde6cdcdca1f299354e7fdaba19433eea0041a0a5d49b6e3dd071d069471ab
MD5 e122814d2d8e80fa74426d785589a2da
SHA1 20c71532dfceb547f720a83d81e500556f74b6d1
SHA512 8db3871cd32903f64e9f42d3b122c5f06b1a470538bed9658187a47d5489cc3e9b8dab87456780e282ed1507b28855b33764584ccdfb19f27abd29fb59bd1cd9
SSDEEP 1536:uqUUx9Al43nYa6kunEEdeEj3hIPFALWFAcA0nT6wbUykNEb+Bt0WXhGb3ME:v5xGl4I6uEEdeEj3AANbjRGoE
TLSH
T143A3D92B2F0EB3764262E157A74E21F0E325445DB39AA310609ED37C25650AED7BF1EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Config.xml

Path C:\ProgramData\CornerBowl\Server Manager\Config.xml
Size 146B
SHA256 8125472c2dffc43d15414388b810910e7e54ca077474adc891a9a7e408f6a29c
MD5 0b959efe1676a3bf70e6c537a6cbd738
SHA1 1a4e4a6ce053b685752a0485bfdf11120bf3f589
SHA512 2a61c5c6de5e4291068137214060d78210251138d70a49f70780ff2501a61e8c7f1005870d1e76fda71411f55ad8453d9751c27b15082ea7c08b256f28783497
TLSH
T185C02BD709016CC903FA04F3C408D244C841048F0404000CF16F01136F74057078264D
MD5 SHA1 SHA512 TLSH

Submit Download

62B5AF9BE9ADC1085C3C56EC07A82BF6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
Size 26KB
SHA256 0795f8f0e616d33050adb4bae2c724ba3f8007a5998826f1200d27cef3a13a6c
MD5 ff690102c64e4baa8bad0c6a7a0fcac2
SHA1 b540a742f34bca1ad6b1541a7fd372025389a138
SHA512 36f8fc1fdacb07bc06bb32a8562663eb035d665e04cd0124b9abd3d55d6313adc48b7c0eaf335814a8996fae47a04eee24ab12ea5168a2acc55404084194f2ee
SSDEEP 384:zUkQFwszgMxAXQjBnzqzx80qLnv3B9xKjtB1WGTz02kq/9w9HvDdWBtudAJLqE5I:zgbEMxASm98vnvR9rg02ku+xRgL5I
TLSH
T12EC2FADCAC5539D7A045E2B2C98B9EA7DDB4B58437C2D00B96644F454822FCEDEE80E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7B8944BA8AD0EFDF0E01A43EF62BECD0_247FBCB64A3A3ADFC1CF9559BE6B38CF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_247FBCB64A3A3ADFC1CF9559BE6B38CF
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

8DFDF057024880D7A081AFBF6D26B92F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
Size 834B
SHA256 e852a91e3a5c2e2ccb590d261ffb7e96364ce2d23b2227e1a7e7a1478063869d
MD5 ae5a16dd582afe70c9d0a93d886be511
SHA1 936b7792ddcb54faba1ea23e2b37a87441354a6b
SHA512 e002aaf8a89c8aae6eb04700b39057af86dfe326d03e18ffbe0f884e258b60a39bb6d2f8baff13b53a9abf8db6ce4c6d760b2e728878b706136126aa4df4fe97
TLSH
T11F01129680183061F8895F21D649ECABC9B4B30D0FD9B005A5E8C6AA5813FD45B525AE
MD5 SHA1 SHA512 TLSH

Submit Download

62B5AF9BE9ADC1085C3C56EC07A82BF6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
Size 212B
SHA256 0913dff5f8179ddebbcf5d3bc0ec21e4fe66e4cbcaed370720205ae1ca14d58d
MD5 8c58a9b0104efa917fa73291de6a49c1
SHA1 b174b95628479782e5f8c06918d221fd998cfb9e
SHA512 6456664da99efebbd3e01fa3237d7d344c63735d201347f60b20539a3a5c34f05116cb6643f1a37757b66c2e28a4987abed7445c9f43e31261d1162cb4ed0952
TLSH
T12CD08C0417294143F0664B3E1AE2172B6E67AFB28551CB08577017098738E21EC38C6A
MD5 SHA1 SHA512 TLSH

Submit Download

7B8944BA8AD0EFDF0E01A43EF62BECD0_247FBCB64A3A3ADFC1CF9559BE6B38CF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_247FBCB64A3A3ADFC1CF9559BE6B38CF
Size 404B
SHA256 5212d48063ab82aa4fbed773caf41ec748220fd838a6d854b440b5f10e6be9c3
MD5 9742a51139986f1eaec42e68c498c72d
SHA1 08d6d5f28984dd362fe473f2a40e866cea2632d1
SHA512 6553d877be9d2fbfa3da4ed93a025ece66ee5f6b4f06b3ec471ddcc60d7872ea9017b9d798f2329f932d8204e0dc716111b22fde2422fed3c15378fd5cb6e514
TLSH
T120E07D243BFE827CF071C938C7F6A160C54EFA1214A081BA4552224AFE125019E72839
MD5 SHA1 SHA512 TLSH

Submit Download

7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
Size 404B
SHA256 df41b5899cd68cc9044bedb18e51cc376a2015f3690ccfd27b6cfdc1a7e594c3
MD5 243b76cb43c139d65ebb4b1f703adc2f
SHA1 baaaff7c2ccd07377a716d01648010fc6ac403b0
SHA512 a976fd88c6f9ce33c7c06e8661003664862bc8a1299ec8b6733b98cba07d6d1d1d99f39402d2ffba5490cca8666a017b25213b256511cdc5a2de22633f61e1eb
TLSH
T1FDE07D0829FE51ADF0B4DD75EBE5592A6B27FD01046043FA81C16256EB23E100EE1931
MD5 SHA1 SHA512 TLSH

Submit Download

8DFDF057024880D7A081AFBF6D26B92F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
Size 188B
SHA256 e600e9aa3ea90c51126c84ebe9a9117bf9ce13aaf255b56fcafcc951b9d92b15
MD5 6b70afab397b6c73aca66cbc6fef431e
SHA1 c0b92652a0b4f81615757bc7b40f8383e6f2d9c1
SHA512 f7b68d020d634a818190b8f1d28066ec5edcb2419682a2a13384b6e34bbf09182eb4077a904628b15a82a53ffa4f1172d57efe2a9f6f00eef61f48d4c06d0109
TLSH
T1B9C08C1277C80201F0EA05392C205E88AB74EE00C741DA2A4F3920048739B010FF2D25
MD5 SHA1 SHA512 TLSH

Submit Download

_is438C.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is438C.tmp
Size 1KB
SHA256 f99d5e5d153a19b689e1015ae66dd0d37d9febf56a80b043b1c2aa4fa0321647
MD5 e96680466f9e8c3470f2ad8554ded0f1
SHA1 96c847acd9add3b55219da71cdfd2b3f5e8c51b1
SHA512 b6ea5a9952e39ec1bc9b7acb10a1169fb2e109e74f1c828905bfbbdbfcabedea0268121615c676d4cabd15632e725b1c184ea65aa3d21dfbeba2b83f06199a7c
TLSH
T16A21089AC8206327B9793918EFCDDB25BF41657FC8788CA78D5BF30452A0C1C3686670
MD5 SHA1 SHA512 TLSH

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\{E0DA7DDC-DC1F-4089-A261-962BFD87C7CE}\0x0409.ini
Size 21KB
SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
MD5 be345d0260ae12c5f2f337b17e07c217
SHA1 0976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA512 77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
SSDEEP 384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
TLSH
T1FBA2B95667F94219F6F77F50FDB802221E7ABC82AC38D25C1280499D09F1E84D8B1B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Corner Bowl Server Manager.msi

Path C:\Users\Admin\AppData\Local\Temp\{E0DA7DDC-DC1F-4089-A261-962BFD87C7CE}\Corner Bowl Server Manager.msi
Size 14.7MB
SHA256 6fc0cf289486f141af2290baa54a18709d1a1705f33564e0e731bc459c83787d
MD5 45dc12bd49153f21ba1af379a01fa489
SHA1 79cf60e6b05a204542df88f52567c054988fc792
SHA512 d3eafa5bebc2e1a8265b083b8e0971b58e66f0fc6b2a26fd32bf9876f1b9c3955dcddd11b622f0ac0aecec52b3673902c1a329f301dcf17e5a7764ae1d936231
SSDEEP 393216:2oiXYsdxNyyWGls3OcenYNG+TOZPGIoc5MR5v1W3UaXnfnnV2V:ONyBGlGO/3KWPrr5M38kwn8
TLSH
T102F63359B6068533CC460B3285B287B08BBD3D136EB553DB63503A1D3EB32905BBB6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{E0DA7DDC-DC1F-4089-A261-962BFD87C7CE}\_ISMSIDEL.INI
Size 20B
SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
MD5 db9af7503f195df96593ac42d5519075
SHA1 1b487531bad10f77750b8a50aca48593379e5f56
SHA512 6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
MD5 SHA1 SHA512

Submit Download

~437A.tmp

Path C:\Users\Admin\AppData\Local\Temp\~437A.tmp
Size 5KB
SHA256 6eac644e677ca1ed14589f963e93424c59e8c89a2cf4860331b4fdf6ae22dcae
MD5 29b8144f143ab5a2b489bdc24b0fc659
SHA1 144a7f38def629f0ed69205f09bcd4a8b036a3b4
SHA512 52d128002bb977610e85ebfdd3bd269cf1894fe2c0d12a359357baa8d88ef8531053dcce430aa88d712fb2d6122478e0f7a2788796410b6df92aef65268c2436
SSDEEP 96:rEhkMTEHq8SLo7DTwbON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOe:YhBEqAX1cuQaEZhdxoIWRGcQbPr/p00Q
TLSH
T112B19B172BF6001EF6F36B45DAF0543797277D12282CDA5C55D0835A28F2D828A27BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ipcservers.dat

Path C:\Users\Admin\AppData\Roaming\CornerBowl\Server Manager\ipcservers.dat
Size 111B
SHA256 c8baecb38d0a81d22c10941778cf380cd0b94bd44a2869d2545f241a0ebfcd9b
MD5 b60bf194f78fd2c8cd580fe0652cd122
SHA1 96403f0cbdfbd844ad3dd1c7cdd0e3576ced71c1
SHA512 e6d4871e2bdafb6204f62f65c84b3ece1a580c1b8102d613697ae0601060f025adb19e9134b9fc2eeac8a44e8bd7aee945be944dcbe4f290afd4a3ff137f4e1c
TLSH
T13EB0926E32AE87DF57002D6510980ECB490453E2AC6A980673D2588D49800E1E3BE0D4
MD5 SHA1 SHA512 TLSH

Submit Download

startup_wizard.css

Path C:\Users\Admin\AppData\Roaming\CornerBowl\Server Manager\startup_wizard.css
Size 1KB
SHA256 58b72ad00558faf8f6dabbcd1ae7c9e7dfc145e61d5273c016a2babfe0ad937a
MD5 dc879443ce90091adfbcad295f31fc45
SHA1 e5fe609241394abe762db1deae76494af654ec5d
SHA512 b6cdedc46a12039cbe1449677f0f4461fab033443df55121c9047fa2822012321c4e14da5acb8d12494202cd82aa054caaf6ac5537525ee8cf4e344c284ea732
TLSH
T17A212C48DA936014F6726FB4B7B243A2F91545674E0AE13536E86714CFB0CBD5690FCC
MD5 SHA1 SHA512 TLSH

Submit Download

wizard_corner.gif

Path C:\Users\Admin\AppData\Roaming\CornerBowl\Server Manager\wizard_corner.gif
Size 1KB
SHA256 a76a2e3e91baff8b5e64f2709840a7ebfb6593259eca1c519b9f406f0dbde386
MD5 2e11711b724e27c0e91cbcada4d083f7
SHA1 3f109c2fc9535424959e07c1409b85311fabf900
SHA512 396e3ad74179415961aee27deca6db1c7bd8452071b1dfdef6091aa14fca2fa67661843ab17b0f41eb2382c1cd31ad984e288e971a4ff7be9485e9131629e7b6
TLSH
T1B5314D084B104E49F9611DD293105323EA64110583298D3BFD3DDF37334772C76DEA52
MD5 SHA1 SHA512 TLSH

Submit Download

MSIF96A.tmp

Path C:\Windows\Installer\MSIF96A.tmp
Size 76KB
SHA256 daf30366a9a72ec9a44fd691bb78079e821c2034d4008f06b7a030b9b46a768c
MD5 6a0a41a92b83950739093376e6783d41
SHA1 41fcc3bccad2f32076fe1df376d8c79886293b34
SHA512 f2be66cb324f156dd05ceb1ceb8042dc4c870021600109ef1e95d05b1e69a1da70978b68cbac99278a8fee5d51f88ea3703668e1e03f25945aefdad84fde9187
SSDEEP 1536:V36lH0KaLw7e3q3a7kuo7mrY1LK90mr35iB7:V4UKhrl8aLK6mr35iB
TLSH
T138737D107250D0B6C0962479952AC2716B7D34316BE9D5C3BB8B1BBA9FB13D0FB3A306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES1947.tmp

Path C:\Windows\SystemTemp\RES1947.tmp
Size 1KB
SHA256 15098171abf2197f3c531163365e8f7934dcf647fc954a2fe58fdd1aca23ec8e
MD5 b0bd5d398d129f3fd6e70526ea7378bc
SHA1 db93e9eb29c310c380ff6183321fd6a614de3254
SHA512 6a3e31818f96e5bee934acb9b24808003c7869ed9b80924f01f5e9ce2dd1fe85eaa023723dccfdd06f515188290a6e1fa292e42f6b09235ded75e4720e305ff5
TLSH
T15C21290957EC471AF0B34B30F8FA17275628FD60DEB1936F888451682C62641EE71AF1
MD5 SHA1 SHA512 TLSH

Submit Download

ck74ms-w.dll

Path C:\Windows\TEMP\ck74ms-w.dll
Size 52KB
SHA256 c1d3ea61a2f0a36175c9e8ad5ba977f7c1e487dcd016af7c75450a35300fe7e9
MD5 104065b1e81479169a9c6d225e0efa69
SHA1 94e40e06fd125acb8296003559a5c93bc7fff2c4
SHA512 ed739e23625a8c1b9137f88bc4d57e1ae4a2f277916af113a40f270403b4dfaf270510ac96c4be9d6058056786923f44b78ce0ca9a4cc235781ebd97a00e8f35
SSDEEP 768:Pn4fE8aLoNl0x2qTjgB7teW7fxFJVnPDbm9eNbcp5407chYq82:v4clSdT9P
TLSH
T17C331E01B6D45E6EF77F4F71AD75904146BABC6ABC06C38C098811EE08BAB44DA71F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 b83c903509bab4e504ba7e7f0611a1c4b81921df8795983abf7572616d81fb72
MD5 55be886ff7aff05631e523355455673d
SHA1 1ae0267aff01db5b6fa25724963dddf369c120c9
SHA512 949a27337ed009c2d2d66d1a0ffeec2e68a72120f9b1413c95b3405f1617ccb36f92c24021b394c84a793de6c73d7fa265c56e86d09719d6dcd909227c5f022c
SSDEEP 24576:9Fo3DMPLdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+K:THs
TLSH
T16057B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{da7d1ad5-9503-4f10-a029-48b3b59e9e02}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{da7d1ad5-9503-4f10-a029-48b3b59e9e02}_OnDiskSnapshotProp
Size 6KB
SHA256 c976bbf5d0c88a7e9cf0c17be548bc5f83d0cd79b81262b9693c174da4479098
MD5 f2c500823441b63f48c0ea50ed0f1cc4
SHA1 3cf4309d7e6f50933b7dfec4ac881b819ea61625
SHA512 c9c31b64f9396f8aadb90e7809e2ab6e238a06090bac999fcdfa4f813c081a64efda3353bbb68e41e4ea01b4d5cf3bd634ddf16a01be2d5c10069640590ec4b7
SSDEEP 96:F0bq8l7XCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:+bqyeb++uVm
TLSH
T19ED177085AE54711E2B3AB7129F14557A837B911FF33CB8E0198238E6631A10F976F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC1946.tmp

Path \??\c:\Windows\Temp\CSC1946.tmp
Size 676B
SHA256 a287ede9aaf20974fd6ce9a1d193714e65564be3c037e250b8cfcec0d38fb867
MD5 8dff4cfa5041c3f0439d1d8a889828b3
SHA1 343fc5f69296ab4cff1e19332a69b785b01e8188
SHA512 9cbfc781e0c5828ee5190f1fbca974cd1596f70b7e1024b866ac1da49ea50323dbc6307c35030fd266f35ae38784fa48e470c066cd8197c8454647a1ad5e3ca8
TLSH
T16601670863FC031AF0F38B70FCF553A794A8BC20DE7253ADA84493592C61A00A921FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ck74ms-w.0.cs

Path \??\c:\Windows\Temp\ck74ms-w.0.cs
Size 85KB
SHA256 e90de44165be1326699492ca10396059613205be476ff4b715896fa4aacfdceb
MD5 d0d0ea11a1ecdc715c94e289edb5a3f6
SHA1 afc0842bec4dc5f7258c292b272d53e78146ae88
SHA512 eb9894de27ca8a7c32d235d34daae99af5da401e75532e0a5f6bd8dc974d849afbd122172b2cd1fcfad3b0b2803ea4b31115c48193082a10e588dc29d29d0ffc
SSDEEP 1536:a6OKsDxCfSw4wbYASJj4uKlSfqm0H5AZc:9
TLSH
T1218336E9D5009F0751B773F5F6625847ED250123180EA6A1BACC889BEFFA489D330F96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ck74ms-w.cmdline

Path \??\c:\Windows\Temp\ck74ms-w.cmdline
Size 559B
SHA256 5205798885bca9cb6d5ccdbf09d234da3f575096f1e799c403a980e6a94f5c2e
MD5 0bd44adae98d5786c040d38e66bbc15e
SHA1 5013ee1a399717bded55c2d990b9afcf9e5e10f0
SHA512 5e0d6a20d0f91e2c80fa07b1d3084914865dd933702c08adee85922f907ed483eaf183f38c7ecad84ceb575d234b11af8987b8b81f684fa64875c5d1640cfa9b
TLSH
T19FF04C3D0B7EC1F691B235922D8EAF4C5283D35B74849D6893C46599A8938210750AE4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2256-408-0x0000000028180000-0x0000000028926000-memory.dmp

Download

memory/2256-374-0x00000000206A0000-0x00000000206CC000-memory.dmp

Download

memory/2256-396-0x00000000207E0000-0x0000000020834000-memory.dmp

Download

memory/2256-372-0x000000001DF00000-0x000000001DF94000-memory.dmp

Download

memory/2256-363-0x000000001D9E0000-0x000000001DA76000-memory.dmp

Download

memory/2256-370-0x000000001DE20000-0x000000001DE5C000-memory.dmp

Download

memory/2256-368-0x000000001DDB0000-0x000000001DDDC000-memory.dmp

Download

memory/4928-338-0x0000000020690000-0x00000000209A0000-memory.dmp

Download

memory/4928-313-0x000000001BAF0000-0x000000001BAF8000-memory.dmp

Download

memory/5536-321-0x000000001B480000-0x000000001B490000-memory.dmp

Download

memory/5536-291-0x000000001CBF0000-0x000000001CCC0000-memory.dmp

Download

memory/5536-289-0x000000001C7B0000-0x000000001C7E6000-memory.dmp

Download

memory/5536-285-0x000000001CA80000-0x000000001CB1C000-memory.dmp

Download

memory/5536-280-0x000000001B960000-0x000000001BE2E000-memory.dmp

Download

memory/5536-279-0x000000001B410000-0x000000001B472000-memory.dmp

Download

memory/5536-278-0x000000001AD80000-0x000000001B40E000-memory.dmp

Download

memory/5536-276-0x0000000001540000-0x0000000001560000-memory.dmp

Download