287d680d090145eb863f1506179d2903cecf23d3edcbb09d72bef5485030c915

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Size 1.4MB
Sample260930-e4gnnsxcrh
SHA256 287d680d090145eb863f1506179d2903cecf23d3edcbb09d72bef5485030c915
MD5 20fdd2590dfc1ffab25a86017aacfc41
SHA1 1e5baf3f404d31727caa9f2b83433cf74b35f3f1
SHA512 5daed660c21bfcb2e82da1c34b805efe9af44cb06bd2040e1f45f80dfbcb887aee96611b272d5982b7cee97531f588b61f44623d3b8f4e0ce12a26409681bff8
SSDEEP 24576:2GaKngL2jdshRTdG1YxITqvfPkbIcbjLbfJ4yL/tNCJPXUQrPH:2GarSj8RoTCCrfJ4klKXn/
TLSH
T1546523A7B2C08570D8671BB42EA8E4441A5B7FCD591F465E9EC028CD6EFE2E11E3C712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro ransomware spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 2 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x0008000000022bcd-530.dat
behavioral1/files/0x000e00000002432c-531.dat

Executes dropped EXE 15 IoCs

pid	Process
3516	DiagnosticsHub.StandardCollector.Service.exe
204	elevation_service.exe
1144	elevation_service.exe
4472	maintenanceservice.exe
4332	msdtc.exe
4172	PerceptionSimulationService.exe
1248	SensorDataService.exe
1796	snmptrap.exe
4688	spectrum.exe
4256	TieringEngineService.exe
3568	vds.exe
4808	vssvc.exe
4204	wbengine.exe
312	WmiApSrv.exe
4292	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\alg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9af68ab360f3a3fa.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4548-0-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral1/memory/4548-61-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral1/files/0x0001000000017426-540.dat	upx
behavioral1/files/0x0001000000023413-541.dat	upx
behavioral1/files/0x000100000000c535-542.dat	upx
behavioral1/files/0x0001000000017040-539.dat	upx
behavioral1/files/0x0001000000017003-538.dat	upx
behavioral1/files/0x0002000000021bea-543.dat	upx
behavioral1/files/0x000100000001678a-550.dat	upx
behavioral1/files/0x000100000001702e-549.dat	upx
behavioral1/files/0x0001000000017eb7-548.dat	upx
behavioral1/files/0x000100000001780b-547.dat	upx
behavioral1/files/0x000100000000c3fb-545.dat	upx
behavioral1/files/0x000100000000fa69-544.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113156\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd7dfc659450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000719069649450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec8da7649450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2616b729450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a174c759450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000465bf649450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d4f19769450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000321892649450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeRestorePrivilege	4256	TieringEngineService.exe
Token: SeManageVolumePrivilege	4256	TieringEngineService.exe
Token: SeBackupPrivilege	4808	vssvc.exe
Token: SeRestorePrivilege	4808	vssvc.exe
Token: SeAuditPrivilege	4808	vssvc.exe
Token: SeBackupPrivilege	4204	wbengine.exe
Token: SeRestorePrivilege	4204	wbengine.exe
Token: SeSecurityPrivilege	4204	wbengine.exe
Token: 33	4292	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeDebugPrivilege	4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4548	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	3516	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 2600	4292	SearchIndexer.exe	118
PID 4292 wrote to memory of 2692	4292	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1144

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4472

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4332

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4172

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1248

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1796

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4688

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:412

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:312

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2600
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 79c81c7139d479c50027b51d78c9bcea16f4494fc66fc68ae241ea1623bb4f5b
MD5 50d6ce883fb9d4d73f1d1ad656e1cdea
SHA1 f33e40b5e3244c05f0960018052ae6b9d18d158c
SHA512 bed81a1b6c8c6118775275412f9e564f575cd196d989238ee147220414ee6a36746ba952bd528ddcd8f59739cca2b0112fd79c9189e2e9160a291fcc5935bce0
SSDEEP 49152:rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnFfJ4klKXnw:53q6mjBqfJ4k
TLSH
T140D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 0d750dc7944b5c224e9284ed3138bcf7fbf78ae8d37d79e97a6dde08a02e45b9
MD5 9f20c8f80695d117d50e045dc55be813
SHA1 6c843e94d5bf2b3cb7be4807a81c398a3a9bb5d8
SHA512 780301d42fdb5b68f5290e332a62055c62ff8fc3747f094c9b57cdc79c7f571e78d64ad383292ac7ff7c874822af34f2452f79d510878363d652bf468966e9fe
SSDEEP 24576:1XY9DkczA+fJ4yL/tNCJPXUQrPXjaKngL2jdshRTdG1YxITqvfPkbIcbjLm:GkcbfJ4klKXn/jarSj8RoTCCW
TLSH
T1D475122AA3C049F8ED67827C8DA1D401EA337C854765E38F47E099692F773981E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 85a6926564db5cc2db0eb2e6647b93c2146805ff069d078d912a3abdef81dcae
MD5 26cc7117f0b619ba6a2bf9d6c81f3036
SHA1 1c2e57afa8fa0b8aa6e1c68ae72c0217228eb73f
SHA512 4d873ec07491b1d0f015d865fb0d75923e305a35def3c93c01fb9201a0cfbbcbb20e34c7d408331fcacf38c0d0e0ebc08f746a8ae0adb66bd56559dce1befcf4
SSDEEP 24576:kXYfDtczA+fJ4yL/tNCJPXUQrPXjaKngL2jdshRTdG1YxITqvfPkbIcbjLm:DtcbfJ4klKXn/jarSj8RoTCCW
TLSH
T15475122AA3C049F8ED67827C89A1D401EA337C854765E38F47E099692F773D81E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 547f552f60eae429016fcd0b3031c3713069400afc7722ddd419c0360e4bbb58
MD5 f612bd1754de96c78468202b466c63ec
SHA1 f3c2adc05d57e27f922cf15b372c2a421b95c112
SHA512 134d03fc229641626e853f9cb79fa269e6ba7e2a98f95110971b56f2943310f886cb151857d4fef3a9854a889d75eca101aada76f6f519583c37fb919c55df9d
SSDEEP 49152:aB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glOfJ4klKXnx:Iu6JmIxd2dOfJ4k
TLSH
T180D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 41c65fa4fc5ae0c13de62482cd612a1f1155a2a45efa4b7ab8f8506b0a1564bc
MD5 59802db1a77bad874bdba293f787af62
SHA1 cef064ba7340246bebd58d656631141c08018dee
SHA512 1f4066945dc23a1c572736b4023e412778bf44f55725f7a0547ca126f27008d1f9107e16f2df7da33c54f9aaf126675f88370b75f39052d85de2488ba1b5747e
SSDEEP 49152:PP4m4IpOO6708K7fJ4klKXnfYtoZTXSDb47:NppOO15fJ4kXtoZDeb4
TLSH
T1C5B5E02DA7DC0095D0BA927886658A09FAB1742A1F3386CB1160937D3F77EE54F36F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopWatch.docm

Path C:\Users\Admin\Desktop\PopWatch.docm
Size 773KB
SHA256 8fc3d035815bc87c0a0a6533e74a7f2ced9d148c8fee42afc6075f861d105fd7
MD5 5ea0f93b6ee4134622f0850e592976a7
SHA1 5e1da96d0a982781bc1e032160f287df8a5372fd
SHA512 62322a6b798eebba0243adc4610cca09515609ab783146a91088d9e03f5ea4a0f58b75339332ea21f28147ee42731273b28f7c5a83aa348654ee89103f407395
SSDEEP 12288:Rn/N8HDRc5iNi0f7mqoyz+Tp6b6ngo0xoZsBjAhsYZu1FnwZN1we4FHNK5xID67X:Rn/GHNzSlTp6+ngo0aZua22MC5x2Y7Hb
TLSH
T125F433AE838A5870D9A3593D94774B37D98B1B1FDA5A90C318567B8088EF5BD2013F8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateAssert.docm

Path C:\Users\Admin\Desktop\UpdateAssert.docm
Size 772KB
SHA256 86e87eff6b298af55e9b32afdbd6b7ad5f474b62860a4dfd841e693b32e76f92
MD5 902ef48df7881570cb7cc7a7a85e1d78
SHA1 ceb77c61085dcd929651243d04e41650df12ee66
SHA512 470336b292f20988ca70ffba00f39501f9c22923c52f7c09a2193c068af3a654c412fd3f6d251de318b3e74ec2ec534eb3a922107233380a0420656a770fdbde
SSDEEP 12288:p/KZsXPJFTmaN+AvRpiEERqQr95cC/KQ5kVFqm4MxRP4DObA1OND9mWMY8ZPG8Bu:p/KK/DVoqQr9iWKckVl4Mxd4rsQaOA
TLSH
T1AEF423244FEB21E7E98747358E3255F92A82236C8333829A243331D5BED851D974EF6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 777KB
SHA256 8b472c025a264e4c5d92d30c92d8f249dd04326a1860dafd5ca373b620211909
MD5 6cfb750c66eebca8e67c6f79d0230208
SHA1 63e5724a680f372fae0b6c7962e77a4d1fe9beb3
SHA512 4956753fd1969b52f325e1a1192cccc4b4a79c4db89352c5754dd5286f0fc77fd990bd7d637449955cedb1598985b579670f2fb9a147ea61d8ed530676f53d0a
SSDEEP 24576:4faKngL2jdshRTdG1YxITqvfPkbIcbjLm:4farSj8RoTCCW
TLSH
T1B805237FDBC88F54E57B3B743AAAE84C3CA33B6C990B860DC9A0169C197A7D0593C504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 18531d81751fd88f82b75509362705bbe882189be0bb816ba14b356c6b76c7b2
MD5 b8a5984406a570c9486e8512df2104bd
SHA1 42e3783a4f97b65b348dd6c981a49fc65beac1ad
SHA512 80317abd3af19b131fe5184c740ee1fb19b035c29bb3bcd86c30ff53bfcb2215b40554c098a4dd28a281abb3c0c101628634630b34128f20a1232f66a786e32a
SSDEEP 12288:EhbHjfXkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:EhbHjPkfJ4yL/tNCJPXUQrPh
TLSH
T1AAE402BE22AC20D9E571D2BC4684D106C331BC951726A3EF67C2917A2F7BED51C38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 a6e9712f2b04711fac365b35f16eaa88ccb28555b0cd324e6e19c364d8a53648
MD5 6377133c6fc535af731a61d02f5a4fa1
SHA1 ddde77c5ad6b3a230d0f46caf8d3aeaabf88f221
SHA512 51ad84a358efe4ba5a3a29874ae74c9891af2e8d679de8e62f7710c272f82955f0c8472361f219cdf93fa27304282e79074e6be6e5794018e517d6a1c0945442
SSDEEP 24576:5XL3UTDaKngL2jdshRTdG1YxITqvfPkbIcbjLm:5XL3UParSj8RoTCCW
TLSH
T189350159E7D400F8E97B923C89B69906E6B2789D0355E7DF03A84B691F233E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 949b9640fcac4be294232c8c5c93182af0d6a91faf4c6a60d19d237263bc05df
MD5 86d2c13bc6076687b6e4906732a7fec0
SHA1 18c73cd9b8ab44b686a4dc257f8ceea963318db3
SHA512 b9355a3edc3d2cf5ccd1e1fd0341abac6e70e8874d8a1828567e69c7b23cc0da9934d52bf888d631fadc4228c65b0523ee62aa66dce01382bc9f22e323a671c3
SSDEEP 12288:jpFtvOyfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:9OyfJ4yL/tNCJPXUQrP8
TLSH
T15EE4026A32EC10E5D576927C4A85D209D331BCA6172653EF46C080AE2FF7EE86C3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e8b825ea53767b9758058855e773ad3839464d650404ea6d3aaa2e6f5e3175af
MD5 cdf1da8656b35a1866a0eed471f1978f
SHA1 af96a5103fdd6890e36690aa1d62ae06d704bc1d
SHA512 8b992804867ec7700638bb0f7d2529996c335fd82644f72bc74f04a6cff14842935a2724e6fb81ce2ae4a3857174af3d2e987089824a432e485a59680a083a59
SSDEEP 24576:D7NM9YqZqmWMUkPjZM48Mv6bEhslfJ4yL/tNCJPXUQrPD:D7cBWMpPjN8DbEhEfJ4klKXnr
TLSH
T1F165AE2E6BEC81E5D477D13DC9A28205F6B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 0f2715e2eedb21889f49f339586272a3f4cf90f8b573b20a54948e93efff52f6
MD5 aebbdc6a0c42447df14fb74bca493052
SHA1 aa3393e70dff1563e2761beb053797b6fb154d2e
SHA512 bb3a5135abd99e3ae9b7bf6cfec871ef1a191400b534804aeeaf120a33753315e914531e5b0b7a4ace24225cf8a40f67a20cf96d4bb6cf521990a107c8952686
SSDEEP 24576:2W6BApg2YuyuNDYTabvcdvNYf8km1TfJ4yL/tNCJPXUQrP+:2F2YuHNETovAvNYf8kmFfJ4klKXnG
TLSH
T179858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 6c0dc2d1643aa74e11f13f879f09feddc53a77df07f8ff85e4a2ea030de61f00
MD5 b7656110e480365857f732e3e993203f
SHA1 743e10260eb2d4eaf4237edb17912cadb702db7b
SHA512 397630cad961bb33b42d79d88499c40bc201424b5d6e4eb7f1d48c6abb436d2baf0788079a0ed69574a88408261eead7b94080512903e2158863d25b1dcf10a1
SSDEEP 24576:pAFs06+Omlf8NXEbToWfJ4yL/tNCJPXUQrPv:uFs060loXuXfJ4klKXnH
TLSH
T1C965AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 e5e26c7c0f304c090af709299baabc53189f1b5d4df3af2772d4aab2108f57f6
MD5 105e0accccaa306f5a020ddc054173aa
SHA1 a683e99fb2968621bc9d482bb784bc24ddbfb38d
SHA512 f80e0bd6d5346caac075b7c81d94bb158bc687872ccd8aa6621f8237c8f2bea8512aa515c86c980d4ee6b97e5716d2644d9cc467eb4590b5e9fde1e7af0af9a8
SSDEEP 12288:SCJnJ5D3VkrDzxFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:TJnJ5D3WXXfJ4yL/tNCJPXUQrPX
TLSH
T1DB15D02DD2A810E8D4B7C3B482596746FF72386D2F226AC768B4D4353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b7966c28b0541a8bc5cac9dc5b18eae12d7e45e1c07995996e0adbbd197cf0e2
MD5 2299fc1aeb2dd7467f914c2e2f31c728
SHA1 91e3f918e1cabbc30e0a303a10a8b5f62bcdee1f
SHA512 19e21098585bb7cc812655a3389c2349fe8fd56ae673353abd1621804668a03313df2ece16ee516346a2f49b921517fe0d7c4454e2988d3d80fa4b94a1f85589
SSDEEP 24576:TEPghm6/7IIXdwcXrif7qQncjlP65i3VuMfJ4yL/tNCJPXUQrPQ:Ug06DIKdwc+eQnSt65aVRfJ4klKXnY
TLSH
T1E0955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 aff4d1bfa798a2eaa6d4063030eb8f4a98ee7126ce3d395ba4a0717e3c4d423e
MD5 3fc597e60320cc91fa4f0241359e13f3
SHA1 ed07135619c24ffa05c45f536093247d601ff9c1
SHA512 bc6af6aa4c52696effe0929617b7bae0defb231b8838784f4d5b81a2cef959eb4b79e023e1b9aa429fa818902362d13101645e2e57c6134f59be85b37f0384e7
SSDEEP 24576:kisaKngL2jdshRTdG1YxITqvfPkbIcbjLm:kisarSj8RoTCCW
TLSH
T1CB05226EABCC61E4D02AA23C6AA18549E7B3F168570357DF45E0C27D4E77BE52D3CA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 f40da02052e0ceaf649d40edace5b2a873b66111f148ac926e1d1d4143e1fb54
MD5 785fbd736938cda464c1441ea049083f
SHA1 405dd63f3c5ac073c4903a0ae890acaa0b623f74
SHA512 8149b9189b7057ec67117c5acf1477769ba08a7a0a7e71151dc28a04ca0d781f73f9297bfa9679d885bfaf5f58d5152472c358f4542bfea7d444901b5395076b
SSDEEP 12288:1jkyUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:1IyUfJ4yL/tNCJPXUQrP7
TLSH
T160F4224A23D4A085DAB647BC4A55D140CB34BCA02F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 f601d19288603bbb8cd789cd39e1cdbd70b23293455c92dd65da34ddbf97ba68
MD5 435297a2e229b8ef3528b517d3497451
SHA1 ad1e40ff483706824106f433ad5b6212ece3b9a6
SHA512 306b7805db23222787da76988b7a314832d0b064072ff828199b9677c16d4076afb67eb0c8f055fd438fddf1a6fcba3c2884b233ee1dcc36565b7365f48a0822
SSDEEP 12288:yyifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:7ifJ4yL/tNCJPXUQrPS
TLSH
T10DD423AF2194A08ADE2687FC1648E000C3147ED5272B62FB9DC2F4A17FFD99615BC791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ace7a905cf1585233f3ef75b0bfc764d92efd998c02324bf339cd0c2ec170416
MD5 0d59a466716459dcc07acd9f5c24f88d
SHA1 3e38daaba20e3ed0d24269daf8bea1a34e5bbd84
SHA512 904e63920d3a1b1bee7453b91ea062b0e35adc68a0158597d1a61d2aff869e3922c79f5273f903b6e836c8e109e1bff5a29fa2d6cbfbca06a479191b1d178444
SSDEEP 24576:hQ9MxZKdcz9dw39fJ4yL/tNCJPXUQrPX:hVKZ9fJ4klKXnP
TLSH
T13F558D2DABE9058AE177D27595A250C3A633B4301B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 5ba9fbff745018ddeba84a036358bf7a8755ed65403379c91d9cfff59cabd6ce
MD5 dec64587012f0ad8763f5648fd4d09fb
SHA1 0d733a0571ddbed2c1f4a125e2361816cba33934
SHA512 483212b977e736041c4cd7e509c4c9d16e83d9bfff5af4b25f7416bd6d08ebdebaaba409cf1c2afc5d42d5d9f03c45426a733173004ba20cf678ec0bf7000e83
SSDEEP 12288:CyoKo2JRple9p4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:CyocDAp4fJ4yL/tNCJPXUQrPT
TLSH
T169F4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 500d6a4e9cb2ea54177725489d7e0230468703c3d5555993ffb1e39080a9b40e
MD5 de29f737beae101ff5e0743983214734
SHA1 1b3e0ef29f2ed8984e66ae0053282e5365f84cef
SHA512 ad4d05d72ea34cd475fe596a4e397feb8b4eba5e53a545be3574df09fcec3320323c20bb9bbd0c661c39456c65616eb4290090ae93a1c1f6f5fdf2f3ba19ce0f
SSDEEP 49152:pWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK4fJ4klKXn3:R0zuNI+fJ4k
TLSH
T14EA57B3DA2F800A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.9MB
SHA256 87bd9bc3a5fe02bcc4678083b32bbc84f2f8381a5e4f8d2651d8c3d8ccaaef36
MD5 066b51d5531ea4bb01a81b9c86117df4
SHA1 bde7294737ae419415c8b7e896fd4eebde8b4ded
SHA512 c6ec71274a471fbe7fdd6bfa496405a77a1b5a6443b2c928b2d5c7c056764944caaecd02a41fc9c03dba72824867369d7e434b39bb1031ac755ca55d164cd3ac
SSDEEP 49152:ta0h2GEkuAe73q3ppt6zwwQTarSj8RoTCCW:ta0hNYGtJwYJTy
TLSH
T17295AF1E67DC82B5D0BAD278C9A6854BE6B2B4260B3156CF1190853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 45cf1db37959b7d745fe86212e212f9a6cd6568886ad3af87b53a80e74752fe5
MD5 e7bdf5b54dcb01cd5fdac0eb95e2d6c5
SHA1 500a1602bf6b593b960edb4a7dfa90e31b2aa574
SHA512 3fedb871ce02248597b118f5f132a8d73fc37d31bf6d434ec13686058671cf5952a0919c97350dc786f4f861ebaec98c467468352d63e2b9d0e5d645b9345b33
SSDEEP 24576:21QT7EcpfxR+N5AWAz3ooiYhjMqbjaKngL2jdshRTdG1YxITqvfPkbIcbjLm:bTDxR+N5YzTTjMCarSj8RoTCCW
TLSH
T10675C12EA7F815E9D17E86799B23C506FA727821033193CF42A0C17E1E6B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.0MB
SHA256 0b8382408d9dd5527593e71a9f96d4bc0cb49a1182963df6ce9a4997ec8511d2
MD5 a6e3c445afcb6ab753401f4672a48a87
SHA1 7d05849fadc8d9a3d9fcbd89ab61172541bad707
SHA512 f219b3894eb4d63eed1748375e0436a2babce053e80b1a927185af6912b234b0524badf6a1a7e32e79e177f59bb16925bcc16b86cea38fc5ed1063ff39c34107
SSDEEP 24576:eTMdOz0FFS+HmSLJaKngL2jdshRTdG1YxITqvfPkbIcbjLm:q0K+HmSLJarSj8RoTCCW
TLSH
T1B135F17EA79D04E4E47BD27C9A53890AE97234650312A6DB06E0C1BD2F5BFE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.4MB
SHA256 9d97e3ed32a385bad025f18600782a4ddc3d8182c248c72bce0ff7d97afdfb1b
MD5 ab0d5e254ade4116be769da2c3bcfe38
SHA1 e6e144e333ecc77783f6d4f0cf5274f59d6c1114
SHA512 81467cf92f4bedce52f731c276a2877f82aa988948358699fdf7471018c362c31d9ba9bcdbaf3dae5ece3b58000385819ed548e02867d14f7a5c82c0a089ef44
SSDEEP 24576:9HYgnJcRTk4yti+R5dUR/xaKngL2jdshRTdG1YxITqvfPkbIcbjLm:94gnaTk46pUR/xarSj8RoTCCW
TLSH
T13965C02EF3B910B8D8A6D236450147B5BB71782D1F219ACB0170C538AF1AEE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 767KB
SHA256 8385739909d6879bd89d3e9b6c46e895e6c655f65e445fab4d81546471895ea3
MD5 463dd86f264db6d5d3ac3aea22fb9a70
SHA1 38f6ba74f374c71e405486fa8a67842aaa19a36d
SHA512 43155303b7ea9560e52cccaf5e99bdf0d2f55602f345d47c11a7752b396fd445a0662dc82a476ccb89f0f698926934cf7b64fb277426e20e32f6f139b435551d
SSDEEP 12288:JGacZlnnaA4BL2jacsxvRTdG1PZ6xITq02h1RPkb8mnU034cbd3PFLQWlA:JGaKngL2jdshRTdG1YxITqvfPkbIcbjK
TLSH
T1A5F423AEDBC58B64D52A7BB43AEBE98D3CE33B5C950B474CCCE0559C19AA7E1253C100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 824KB
SHA256 d7c1a2c86c1e2c5ed14b5bb069e749b6b8ceecd6a33c7d266ca52659d00b22c8
MD5 25088248ac751a2c135eb2d3083d4e61
SHA1 aca5e2c75cf6eff89cf6de39f3d78cae7142280c
SHA512 be1601bfead9fa0a367cdb150a687899f25934b38c78cba09083ea02f472841c6669ffafa98091ec7e07e0b165d29935c279b3857d4118a4858dfe244affcbf6
SSDEEP 24576:ejaKngL2jdshRTdG1YxITqvfPkbIcbjLm:ejarSj8RoTCCW
TLSH
T10D05226EA7C825E4E43767786A77954928B27A79130A47EF28E0C9BD0F377D0953CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 997KB
SHA256 e88277a53292f79438b42f3fabeb438fb2f62b30e62b0fb7157eaece9d0757eb
MD5 282552dfda483fc5e79d471a20d20d89
SHA1 d6d53f11e6002de4872bf087e5c76a53eb5f42bd
SHA512 578d91347693d33f921035523fc28ace257f5c587f3c2211e23fb19c0e9ba848292dd94b22f0e9e206fd5b7ec5f6fb31b72d48c4ab0fdb189078fb2240d70df5
SSDEEP 24576:dwu7OWnaKngL2jdshRTdG1YxITqvfPkbIcbjL:dwIOcarSj8RoTCC
TLSH
T10625014A77D40CF8E96756388697C536FBF2B8052A26CB0F07A0C65A5F37361AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/204-52-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/204-44-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/204-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/312-383-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/312-167-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1144-64-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1144-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1144-148-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1144-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1248-379-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1248-215-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1248-126-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1796-131-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1796-241-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2692-416-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-427-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-430-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-431-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-432-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-433-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-434-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-435-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-436-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-437-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-438-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-428-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-429-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-426-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-425-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-424-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-399-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-414-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-415-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-418-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-417-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-420-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-421-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-423-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-422-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-419-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-411-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-393-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-392-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-397-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-396-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-395-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-394-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-398-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-400-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-403-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-402-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-406-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-407-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-405-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-404-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-401-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-409-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-410-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-408-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-413-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/2692-412-0x0000027F07B60000-0x0000027F07B70000-memory.dmp

Download

memory/3516-102-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3516-30-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3516-31-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3516-39-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3568-369-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3568-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4172-113-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4172-171-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4172-104-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4172-103-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4204-382-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4204-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4256-154-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4256-359-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4292-172-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4292-384-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4292-197-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4292-213-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4292-387-0x000000000B480000-0x000000000B488000-memory.dmp

Download

memory/4292-388-0x000000000B470000-0x000000000B471000-memory.dmp

Download

memory/4292-390-0x000000000B470000-0x000000000B478000-memory.dmp

Download

memory/4292-181-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4332-163-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4332-84-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4472-77-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4472-82-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4472-80-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4472-76-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4472-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4548-61-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/4548-0-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/4548-20-0x0000000002E70000-0x0000000002ED7000-memory.dmp

Download

memory/4548-13-0x0000000002E70000-0x0000000002ED7000-memory.dmp

Download

memory/4548-7-0x0000000000940000-0x00000000009C5000-memory.dmp

Download

memory/4548-1-0x0000000000940000-0x00000000009C5000-memory.dmp

Download

memory/4688-133-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4688-139-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4688-308-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4688-141-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4808-160-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4808-381-0x0000000140000000-0x00000001401FC000-memory.dmp

Download