287d680d090145eb863f1506179d2903cecf23d3edcbb09d72bef5485030c915

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Size 1.4MB
Sample260930-e4gnnsxcrh
SHA256 287d680d090145eb863f1506179d2903cecf23d3edcbb09d72bef5485030c915
MD5 20fdd2590dfc1ffab25a86017aacfc41
SHA1 1e5baf3f404d31727caa9f2b83433cf74b35f3f1
SHA512 5daed660c21bfcb2e82da1c34b805efe9af44cb06bd2040e1f45f80dfbcb887aee96611b272d5982b7cee97531f588b61f44623d3b8f4e0ce12a26409681bff8
SSDEEP 24576:2GaKngL2jdshRTdG1YxITqvfPkbIcbjLbfJ4yL/tNCJPXUQrPH:2GarSj8RoTCCrfJ4klKXn/
TLSH
T1546523A7B2C08570D8671BB42EA8E4441A5B7FCD591F465E9EC028CD6EFE2E11E3C712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 5 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000e00000001c4ce-361.dat
behavioral2/files/0x000f00000001c182-362.dat
behavioral2/files/0x001300000001c1ad-363.dat
behavioral2/files/0x002100000001c1b7-364.dat
behavioral2/files/0x000e00000001c0b6-365.dat

Executes dropped EXE 9 IoCs

pid	Process
4624	elevation_service.exe
3864	elevation_service.exe
1684	OSE.EXE
4252	PerceptionSimulationService.exe
3536	ReFsDedupSvc.exe
248	SensorDataService.exe
4804	ssh-agent.exe
4228	AgentService.exe
4928	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
	\??\F:\	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\38eea46c9600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3396-0-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/3396-58-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/files/0x0001000000009326-374.dat	upx
behavioral2/files/0x000100000000939a-375.dat	upx
behavioral2/files/0x000100000000994f-376.dat	upx
behavioral2/files/0x000100000001b974-377.dat	upx
behavioral2/files/0x0001000000009cfb-379.dat	upx
behavioral2/files/0x0001000000009b8f-382.dat	upx
behavioral2/files/0x000100000000ba3c-385.dat	upx
behavioral2/files/0x000100000000a301-390.dat	upx
behavioral2/files/0x0001000000006276-394.dat	upx
behavioral2/files/0x000100000000bd4c-393.dat	upx
behavioral2/files/0x000100000000621f-392.dat	upx
behavioral2/files/0x000100000000a316-391.dat	upx
behavioral2/files/0x000100000000a2be-389.dat	upx
behavioral2/files/0x0001000000009354-388.dat	upx
behavioral2/files/0x000100000000a1d1-387.dat	upx
behavioral2/files/0x000100000000a0cb-386.dat	upx
behavioral2/files/0x0001000000006211-383.dat	upx
behavioral2/files/0x000100000000df16-380.dat	upx
behavioral2/files/0x0001000000009cd3-378.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc6d28999450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccfef85d9450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026be0c639450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeAssignPrimaryTokenPrivilege	4228	AgentService.exe
Token: 33	4928	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4928	SearchIndexer.exe
Token: SeBackupPrivilege	3536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3536	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	3396	2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
Token: SeDebugPrivilege	4624	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 5668	4928	SearchIndexer.exe	98
PID 4928 wrote to memory of 1440	4928	SearchIndexer.exe	99
PID 4928 wrote to memory of 4136	4928	SearchIndexer.exe	100
PID 4928 wrote to memory of 4532	4928	SearchIndexer.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3864

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1684

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4252

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:248

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4804

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 62fa6b467eab68e29e417e92793c56d11e4ccaea8d672892892f741a9b198891
MD5 dbb6bd50da84dafe9be0a43eae45d2a4
SHA1 ab5c5a78e2f692e50d7aedc35ac7973cf30ce472
SHA512 1b660a5ea3acac23435bb0cca9b8c04c6fe1a7bef15312c6c40626f6b84aeb4d76ce2deca60b6d12144561d1522fe0ddf60d5112fce1bc418bf3d020f5ca2583
SSDEEP 49152:rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnnfJ4klKXnH:53q6mjBcfJ4k
TLSH
T15FD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1017KB
SHA256 3b105cd9874b80eb49a8bd087cd0ce1b4c34a97ae3337a3643de6ed62983d7cc
MD5 f5582f3e45da42621eb98d2d6879aca8
SHA1 010903d1418b8a308abe3820cfb8de5e48a044e7
SHA512 36057e9f77b40101d0bc0166cd424ec103c990f71843212c42e794fe2c694c090ea950c4fd9d3f60266da1e26808021edf7bc5566870dfc3b887035335a4d6fd
SSDEEP 24576:nXY9DkczAEaKngL2jdshRTdG1YxITqvfPkbIcbjLm:MkcVarSj8RoTCCW
TLSH
T1D4250129A7D009F8EC6B927CCDA2C905EA7378554764E78F03E499691F233D85E3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 03411bec729b845fff421b13e8fee7334b0ed59f7e9ef48fc4c9f6b8d889c99f
MD5 ba24945a5e1f17287379b7edaa6b6bad
SHA1 1d73b3712d8d6857143c9a43bf0f5cfeb0696ea9
SHA512 686618a4017f6710a9a54263b7a342af318ec0b7d2592ff86a6dc8962778d80162e5f03a40861ba2c3167d68eb9e9ed4945d2b5f6eda350396c7420bf81d8a31
SSDEEP 12288:Kmw5HEjsChNEBFgl0WDm+ChfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT:DwuROWafJ4yL/tNCJPXUQrPk
TLSH
T10505014A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b9ceff51666a386c791cc47aea670c8e90e9bc02ba0dd7f657b6c1fe1f7495c8
MD5 a58eb645edee1de7d10332bf4085cbda
SHA1 d3f8f3d8b7c07ee9a2dd18b98ecbef04d6898518
SHA512 6c7ae8b0ff3ac1ffca775ceacfec4cdcd6063fb62c082e2b8faad40f3214e552d89d4e7ddfd7722f32491a0ea21df2e40caa1da6fd71480f4320ebf0cf3bcd17
SSDEEP 49152:aB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl4fJ4klKXn2:Iu6JmIxd2d4fJ4k
TLSH
T17FD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.2MB
SHA256 587aa12f3fe7b6c22a532483b95b119d022aa1d128523b4d69eb57ae9d3e5a5e
MD5 4700470919fc1ba09129dceb7a70834e
SHA1 52c2cc00485b7a1a868ed3b3b7cd2f1eb7249c87
SHA512 d4e369be63d15aedd17e297186b6303f69212fc5776e41058fcf3eb123ec4c4cd9e27685cbee5d872dfe9e1d6b7007d31513485146d35795a33937a75c99b778
SSDEEP 24576:U2wvtk9RX6wkyAIpaKngL2jdshRTdG1YxITqvfPkbIcbjLm:qMnYIparSj8RoTCCW
TLSH
T17845E029EBCC48E5E177923C99B7460AF6B278591B32C2CF029953AD0E37ED46D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 7b8970728a36af4b938e94d49759e0f1de5761b1ee661e8823e42c6fc34eddbe
MD5 ec99836182cf546578a886838de7f101
SHA1 7560f53ad811fd9b00595005979239f3d7214275
SHA512 b43046253d342684768f1a2d9ed248a2ac0bb3c14ad178dc0b2c56db39f0b0f129a4088918e1190192648258dbd9361f2bbfc59e7f90bc7410a74698ba9d73e2
SSDEEP 49152:yY4INpsyk2C7huTfFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IfJ4klKXnIn1Z:/ySzPwfJ4kluFBRS7M
TLSH
T118269D96A1A801D5C1B9C1B98B0BCC17FBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 f2c211a5555d2c483bda527af2c7ac6356667f872f6f35cea78776cf293697e6
MD5 e8a0b66beb6b5bb4fb0077daab1b8f50
SHA1 4dc363be5d2c0d38fb04f1d91d04246ff2a4e2a3
SHA512 e47d6ba5d29ac2aeda578843e8dd8598db846151de34b53965c336533d71b05b6994d9477a8816822001aefb2ee14f3392e3a2bd41fd5ae1e388d66f405de092
SSDEEP 49152:0l7JUQjAirIhCnDHUPfF/4fJ4klKXnpP145FBRSOWMmfNN:2JiglD0PafJ4kguFBRS7M
TLSH
T16BB5D01EA3EC01E5E17AC2788515861AEA71742E5F32CACF1270827D6F63ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 972KB
SHA256 cf791f7034a5eb4f3b51bbd4c0066a06399366fd2bda284e50b2dc501bfce6a4
MD5 e90ea9cae48556a047bea9226cb4122a
SHA1 43ef6a96404dc98b1e40304b9a2e9c92e1ba7c4a
SHA512 26a0f0fed5008ee2a5d7bf7989ae1935ca07f46f4b945e977975af60d32d9d66e2aa883b3656bb2d312e81f24a4bcc28eee7404f448851bc1d18cafbf428c427
SSDEEP 12288:0R9IkDU3fjNVkOimqyO5fTsckSyMVzIZTS:0R9I6UPj3qXwckSBVz
TLSH
T10C2508007626DB4FC6AA50322E76C6CCA770BD01FE059B1372C9973FC576658BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 366KB
SHA256 2bbcffce48e730af2d904929988cdd8aec424b34aa7045ea094ed9df820c72f1
MD5 1bb54a30e3f78a41918cdb2ba689ed34
SHA1 22611f7a2d8c175450754fdb56057d5914be5bc8
SHA512 888f39974c69b2d88e99e167135dc82cbabc59cf17238ed7c79a64f879c70bb3672f1fa91b5aed8e639377e14ec5343ac1b0930aa380a47383a1710167f0690e
SSDEEP 768:0Yt/TdglToOlTPBlTz2+EQMXYtxrt/TlkehlldllCglToOlTPBlTz2+EQMfjehlE:PnozwEBKLEBDWntiSEB5EBWGOiQQ0KL
TLSH
T19F84C641B735F36AD4B740328561EA9E9B38F8129F024F033BCD09BADCA72466275BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitUninstall.docm

Path C:\Users\Admin\Desktop\ExitUninstall.docm
Size 778KB
SHA256 a01f0cf444a686d23ef4aaf40abe997bb1c5e6b6dc4f32ab97bc93a013930340
MD5 98b070e78a75172266808bf10debf67d
SHA1 bdd390897a39f940a4f90d09715158d8151db1ac
SHA512 24e81cba321c51a02afd512c88f6e2847f345b5e36142e2c0263758e8429a7bd9ea3025c0893ab9a929c5eeafbad15c4153dad8f83ef20bc8dd3389dd598028d
SSDEEP 24576:dWThgmUdcQ6Fmq2F7e6UvK5HDleBrF3xaZm3GVaOCpy:dYgdcVFmhXUWHDleVF3L3GEo
TLSH
T1CF052328DC315C68EF9A67B1462E399499FE641E36A765F30E0D307C3D2B2DB105BE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveOptimize.docm

Path C:\Users\Admin\Desktop\MoveOptimize.docm
Size 775KB
SHA256 f2a27362a1ac821a6272818b49d8da3f973e526d7ca5b7dfc064278310a2f89e
MD5 79b1c54f18ed3ee301db603556bd5a86
SHA1 faa6aa396765214faa8bc51a3d8b9d4b50dd5667
SHA512 a1eb4c85ef42de1d478261e4bd06e2ba3f3d1b6c0da80e86b4a6a05d4f002f45a7ede17630ec2cb2e62897a28f27ebaf2f0ee11ab4c565876d2429246bb9d3f4
SSDEEP 24576:KBS5l6YvTKusAOS+YlSx9wUDyZZxr5xCv7gX:KGl64OhYQxCu+zCve
TLSH
T192F43364C3861058E7B7347780BA859FDE272C3C8E868AF30AB64315D5DEF2564A7E0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PublishUninstall.docm

Path C:\Users\Admin\Desktop\PublishUninstall.docm
Size 776KB
SHA256 2dc1a08dd834f0801d26e415669380c83147c31f27474d2764e88b5fbd9f2a0a
MD5 939b874f265bb5db82f5e72983cd0272
SHA1 566032db28d3d397ca68405c1cc79f55c3c472a7
SHA512 67398595e1a5bd83ad927d042785e9ebbe3bc7fff9bc2c9f60fa31692bff9c4c2c35e0c0e35a0c061173217942978a565ce0d1067328c1422e5c58ee84f769a8
SSDEEP 24576:Vmmsz7alj5wZvulTpSBa0o0azsxSzblm5xN671:QHa1aZITpSBNo3KSzAzN6J
TLSH
T1DB05237CCF2651A4C4D5B63AB8B787A289791F4C5D4FE09681BE739C51CA8281231FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveGroup.docm

Path C:\Users\Admin\Desktop\RemoveGroup.docm
Size 774KB
SHA256 41973e055e446ec6e4829c2d10e6bee352036fd674408eb72f4bac32b2e9f2ff
MD5 1a70af778dd528a78ed0119fbe4da40c
SHA1 68fc07331b042a79a2770d3544c77cadf3b1dbf8
SHA512 d9983168b9bfe1b42d141fc6fa1a87ac29091c09d9d21d92947e7fb1b396dcf0ba8e6d179dc51c5ea146ad71d1fd018290cffc50eca8a5666ec2aca96c204a60
SSDEEP 24576:7C+o5TcaV6aM7/Sx6wFR/XnVgUg1NbZ6mgE1:7aYY6aMWx/XfnVWb6m11
TLSH
T10AF42311D6ADC5C3FA215AFB50C9CCE18D509A8A81FFC8B09093047B85CADA79E1B17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnprotectMove.docm

Path C:\Users\Admin\Desktop\UnprotectMove.docm
Size 777KB
SHA256 32de7719015f82eea110c9b58e214c9f30222b8261cb018b6ef68868995e5b3e
MD5 9d66fdea13a2cc86045b308ce1094689
SHA1 3fe801a46ebba0cfe1e6e475f529feb0f5f6f896
SHA512 3e7196bc8017e941e29c4ab08c2155fc85d80d1351230143c0f024232670398d72c8c0005ef51a12d91c95da1b038ca4b2aad924a02b0a8f6e5b5f43e7858c0b
SSDEEP 12288:nhoTrDR2yiNz0fhmqODg+TpiArDyxQHf4XEuk34i9/Wz4tqBPQ7+lVyADLz9Gi30:nINfIxTppWtshWz4q57LXzZAH
TLSH
T14505235EBE93A1F4F8A66E7EE8B744D082ED5023735BE046488131EC5D8A3341676DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 778KB
SHA256 8a8e8708fe5736a247c420fadd26f9df454153bcce095a8e8995b5e58564dbd5
MD5 38d513f0d6883b1f7fa67bdeacf9c971
SHA1 91bc38810ab6bfd4b15c7e34c320a874517155da
SHA512 687813ac7d0f62e7401c6ba0bd56d0c73f501b913123141628b41513c8e109c2bd4ca59df2adbcf97a555121a3beaa2cd4ef536ae1d3499d07b6b48eb55c2a62
SSDEEP 24576:SQaKngL2jdshRTdG1YxITqvfPkbIcbjLm:SQarSj8RoTCCW
TLSH
T16D05237BDBC88F54E57A3B743AAAE94C3CA33B5D8A0B824EC990169C197A7D05D3C504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5fc9a4ac7032cd24bd910c5a2e81e7ad01b36d1e95f1eadf830cb502dcab5e43
MD5 2764bd9bc73316c3d2a1b0d335cfc4be
SHA1 506e43be48f0205d3a0b4960a2bd8c3b66b0170b
SHA512 fb6ab065d712c6f12f881ca9d1bfe273a7f7b3c453f621ec40c31ef9eadc0a699d80190ded1cf509e25385c4992abb4cc3e41393de05bf3ebfc8acf99d7848fa
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYBfJ4yL/tNCJPXUQrPN:ygb4mBIBhGFCfJ4klKXnF
TLSH
T13965AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 01f6ee88e381daa41dfc26871dc234bb90496271b71f45bfaad0a368ac59cb1d
MD5 cb2554efddf391192aa12f1c0650a056
SHA1 f7478d3c79f3197e9609e5a7158d5c5d84f8a664
SHA512 8c6b3f135ba24114d42ad5987c18b43dedd042f92946c091ac3ad4be0b09672e0d59932026eebe629e300f272af5c557e634dd8aadd03430f255d79750fa5c11
SSDEEP 24576:TGxaKngL2jdshRTdG1YxITqvfPkbIcbjLm:TGxarSj8RoTCCW
TLSH
T1F505237EA7C566A4C43B977429B6A84A3CF33758970A46DF88E0957C5F6A7E0323CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 c8fcf4978060c5e4d7f677261785d1c1ae75c85d39f0e24dbfdf1b2f2698d3b3
MD5 fa82e82f13843963bf7c1eed722d49fb
SHA1 864a7e043d2491f6356af099f407f8a4d6c8220a
SHA512 1d5fbda310b3309acbd3c23995c759ae186dd80f3132d5a799864417d0dbc233611e1c5e219fceafe7517abc5f2ad97cf6f7d26dd56258248ba61a18e5e592af
SSDEEP 24576:zG88u8FpJqH1vzria7/mSfJ4yL/tNCJPXUQrP2:C7ZFPqVya7/ZfJ4klKXnO
TLSH
T1B835026672E101F1D47BD1388A858663F771B8150335FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 77519799ab406e4026741d39a323ab61445357424b578132ab078b00d9d8220d
MD5 26ef89aa1784b82ebbeac88ce1648ef0
SHA1 3846a1122c7034cc37a5ea3a33f3501c61b85c6b
SHA512 bbcec385939dccf6d950f984a1d94f1ef980cfea190e48b5ab2863b7145e7e2aa75b5366548efda5e1cf9ce31617b8f0849dcbe455c95f468b84889be091f971
SSDEEP 12288:mHvUrBFrEjwaQmfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:mPUr+NQmfJ4yL/tNCJPXUQrPa
TLSH
T1BD05F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 16350eaf56d501099b98b82b740bc34026fed37bd0c959bf440a093c35e165a5
MD5 cb4da1c3a0fc4633b901c48c6160e4b6
SHA1 a17d89c6e97784a17317446470c12119b1fc9157
SHA512 29d32c22d2a3b4c3b30fd1bcd36d54f32d99ed46c662887ff86f80679d36af3be4871499588b169ad79af2e3fa3fcd171cb97b15bb6816ce2a47d59c8bf3d0db
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2fJ4klKXnV:IG05lO43b7fJ4k
TLSH
T1FBD5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 310da76a8687e3e85d4c3758138998d197ed93dfe17586f4cf0b14f9416a6fe9
MD5 4173495ce72169ac866c03a66b784ecd
SHA1 07c5f41b4470c556ec0110d659281cdfcd5c3fdb
SHA512 e6c9a8d6a099872186c3e44ed52ae7aadf7b066317152d3ea83a587ae3c8b2fe41c52d0f31693e0f567011e726b871090c9fab2c9b7eecb92526d5f05ee6dc93
SSDEEP 24576:jfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnIfJ4yL/tNCJPXUQrPx:ba5POZ3lJt2pasx2+mefJ4klKXnJ
TLSH
T10565BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 51dc899e0b23ec3ec05227254020ba0037b6a2e4d5b29aba7a47c1c08a35127b
MD5 61bb5e2b1f48c6694b36f0e5ffc62e84
SHA1 cb1b0c3cc5b60f3f366eca82b79755dce6180173
SHA512 dc8f17017e96cef54f011914c6d9bd09efe98d7056d7814db8f8dc9b4da2bc93d3ab50880de1e547eaaffc97696d31513b06bdfa1353ee2cced63a7cc6c4e9ed
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7Fk6fJ4yL/tNCJPXUQrPx:CNc/zEOVHF5fJ4klKXn5
TLSH
T101858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 6e06a6adcb77e0b09dbba46d7e37e394304a9388c1ccbeb6445b1ad64073858b
MD5 5e25854d8ebcbf4f2a4faccd0ed8be90
SHA1 fbce784c479905a5905d85503a3eef647e22fc2b
SHA512 363bf52397da975b18c561c3e4bdae71927d7dbff8ef72b0ba9b4ac3d5218c129211cc1f4ef5912b92bdab807dc3fe5ce900bf645f56af1ac00dde11443487f5
SSDEEP 24576:t6DIKaKngL2jdshRTdG1YxITqvfPkbIcbjLm:t6DIKarSj8RoTCCW
TLSH
T15A25125D63AA01F4D06BE13D96934506E5B2B17487074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 e35f73ba923f42fb773b165021b513e8139c2738d73b4b934819dcb44db25ee3
MD5 e893e223e4ac8d05692be67ed0e95224
SHA1 0d6246126dde67e521263e7f149af4eb0bba910f
SHA512 a29410509e429357d7c5e142aa71d007a02e86341f65f4abbbded5a1db16a9da55c55f04120c0c7b3ad66ef1b92c7301f781fdb935e17ec0b0b798bdf2d204b5
SSDEEP 24576:NtyXaKngL2jdshRTdG1YxITqvfPkbIcbjLm:Nt4arSj8RoTCCW
TLSH
T18E15235AD7C456D4E97A27786EB385882D727E249B0783CF89E0E63D2F367D06934B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 48b7c67f3665d3a2fa7d914d47ba5bf735a8c3332f0d6712365520c276eb5d4b
MD5 bb8c472cd091ac99a0423ab91d297668
SHA1 f4efd674f0529fbb4462f0d4066d3b381e91bd8d
SHA512 42993cba17b1265913f9871bd3425ab60b8ba418f2dbe8522f2717f3cc0ec1bc9e7c067cb9cbf851cc82ccc1b22d2729437fe3d439a1d074782e4cfeead8526e
SSDEEP 24576:iyaKngL2jdshRTdG1YxITqvfPkbIcbjLm:iyarSj8RoTCCW
TLSH
T1D30523BEDBC45B60D81A7F743AA6A94D38A3376D570B46CF8CE0597C5E7A7D02638800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 96cd09f851a595657794634611169dcee22e51d907c3b75e4fbf193bc41657ec
MD5 ebdeb0153e81743a83838c5c19c39610
SHA1 387a2a01c60c252e93c67c4d1d64a8bbba83a1a6
SHA512 50420fffa341f39e8e98206aedf8b0b2ae217c6d70049ea3c908d02e7f6493994df5b71072fcf59214c5d3e5c7a1a9e6122675c03c5de9ff8574f95829d5399a
SSDEEP 24576:xKg2AoTfaidZ4j31145FT99c+vVUWZ7S2RGRMmfJ/ay:ogcTrZa145FBRSOWMmfNN
TLSH
T16465AD1DA3EA05CAE2B2D275D8721493D633B4315772C6DF2548C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 817fb9863c38585ad5703974ddfb29367c7c7ce9643409cca23673e993830e26
MD5 d85673ddc2cceb154e3bfc05f0034de7
SHA1 5b8bc297af868365dff312db1706776aeb93012f
SHA512 161b41a60ff855ee208222fdd47674fc11f7ec09ed511ce54c60ad2a2bbe6f77e61b998b4c9a9b9f195f4a0e55c38565bebb1ae09f1fe61400549da2cc928e29
SSDEEP 49152:Ngb4mBIBhGFCfJ4klKXnF3145FBRSOWMmfNN:NtJfJ4kIuFBRS7M
TLSH
T1E0A5D01E22E802F5E4F9D2B8CDAA4417D6B278160732D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 4d4ced31675063c20a3780e58ef1978967eff92ccf6d4daa8e6f9d3f7c890b3e
MD5 1b1445f6f72af365b0f9aad10eefb6d3
SHA1 4fe41cba5df3861f9be6fabc80afad3abc4d692a
SHA512 f70e5e17998acddd85b9be257e3626f67e9c9370f2236ddd6acd818e1289eafe75f604e7850f0ea84cdc91b61c1f470eef65d1f80642c0e7a91531c9a9fa192b
SSDEEP 24576:ETkNvNnaFeYhJNtmZBmEaKngL2jdshRTdG1YxITqvfPkbIcbjLm:ETMwBtOmEarSj8RoTCCW
TLSH
T1F975BF6EBBE846E4D1FEC6B49D238516EA727461073293CF4290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 5526e55db0f18e61a986958a7ac794e802508eb0c40c4e8ee05b7300753853d0
MD5 2da8eab9f2953b401996f083e9815917
SHA1 a14d743aef3551df1028bf09ed33d0a4f683de1e
SHA512 3698637aa57e4a2b53ed38d884b85d16ef5b858a7e222de74d638fa1681be79e580358b5e89d1d687f15a54c096bad64053b65004b7910b314445550eef750e0
SSDEEP 24576:WD3FHshBIYQgArfJ4yL/tNCJPXUQrP08aKngL2jdshRTdG1YxITqvfPkbIcbjLm:WDVHeBIAArfJ4klKXnc8arSj8RoTCCW
TLSH
T10685027EE69C04E4D57BD2BC9A939506E77138ED032656CB06D081B92F6BEE42D3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 d6a7890aa583c3ce3b181d655715d3b7ea90ed4626a6b9f600a7ee3b7bd0ee50
MD5 51adfeb282ec1d7d2338c879729b62eb
SHA1 37dd0242b72e06d06e031903952b540edc295229
SHA512 903d883c07a6d18c92686a12db843ff742227f4a417f197e0eba91c91b089cdb64a9145f46b46dd2eb821a6ed1e1615a3fab9c5c2aaa4e12b6728270c5387893
SSDEEP 24576:bJnJPbzB4SLj31145FT99c+vVUWZ7S2RGRMmfJ/ay:bJnJv6Sl145FBRSOWMmfNN
TLSH
T14835E03DD2A810E8E4B7C2B4815A1765FF71346D2F2269CB19B4D4353F12EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 9f7f5b5114cd5e1e16c6d0c05b7629aed2520766fd230f887c7d397e595d45de
MD5 2c56f34b9d37ce1f097e6765ffadcc3a
SHA1 aea1702ce7a72e42e806f8fddf2c74a33e6237a0
SHA512 1b98f1d1b83785779b94f56d217607362ffabb4f0fe035b09f22a10a07ff39538c5300b8fcd8e061caa2cdd155bca5913f6f8e0bfa3be55ae0f22acb7b9db075
SSDEEP 24576:S2aKngL2jdshRTdG1YxITqvfPkbIcbjLm:S2arSj8RoTCCW
TLSH
T18A0523AFDBC48B94D51B3B743AA7A84D3CA33B5D974B46CFC8E0559C19AA7E1253C400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 d5082fd3cb434470d3e276e9c2b58c505c91dbe7f9ee44c7529bc172083671ac
MD5 c8d50b56a0c03bf32b258203aa9e63b0
SHA1 2fdabfc0e64754f4f2916b7913d89408c4ab5091
SHA512 c0cba4bf438801e3368f62ff8ae9207bdf8fb5564db650cb3e410f50280223f7c1a8553974f526598e1686093074238c64dfb265e51552724ae3df53f96ae407
SSDEEP 24576:k6UqjpyaKngL2jdshRTdG1YxITqvfPkbIcbjLm:k6UrarSj8RoTCCW
TLSH
T17915236F97C419E4E03A1334A9B6C10918B27E7A036B86DFA5D4967E4F36BC0953EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 1f88b33e2e12f6b528bdd22fc61928e4976a96f98f89a4b043da60f387c44c68
MD5 db89a64ed0e50d173b4e134d58ed8e8f
SHA1 e3b0e094adc089300409453a98f30c29ab8fcf4b
SHA512 d7bc67eb758e33237d2ed7739e51784761c6259ec2ff454dbbd069318dbad5f4e26c75f24ff6e0d8fb2ff04cf7c41ff6e46a71df957d0714f1a06bca26746b91
SSDEEP 49152:ZCLHGeeV5ijCmlDWDkC145FBRSOWMmfNN:AWuFBRS7M
TLSH
T17DA57C15E7EB4188E8F3CAF5C92694169A327C509B34F7EF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 964KB
SHA256 19292826a2f533cf14b5e3670f7bed0356a684cb66d2e86491a9308b0e345668
MD5 3b2ae7deb726688c7105c26a486bd449
SHA1 2b241c1022283de83f74435372ae8c07754e3f6b
SHA512 9fb25a5c43adb61ad7bc1404876503eaddb4f6af3e38b15a2a59571b7e17b90efe86a03219425bd78a12a00f956a6f8ddf1e012fe4b36edea9545382a6b82506
SSDEEP 24576:wrcmR3j31145FT99c+vVUWZ7S2RGRMmfJ/ay:ScmRJ145FBRSOWMmfNN
TLSH
T15B25015EB2AA00E6E17BC13CC8524651F7B37031975297DF0290C77E4A63AE9BE39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 305bac73a12a4a6d82f1415b449320055e6de37ceccb8c7561e719d3d62d25d6
MD5 3209ad9559a0a5c027ffb635f3ca4f17
SHA1 69164afd85c6176d26aabdccd623f784cd9db02d
SHA512 92818e2a203b72f667915054b773538cc756058bb7ff315d9ce8778b770904fc19504fdccb49d22ebccd41dc3ffb0893f87c53dc8b5a4923a9e0d2f81d0e5674
SSDEEP 49152:VDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3FX145FBRSOWMmfNN:23Upow8sB0uFBRS7M
TLSH
T1E3B58D3DA2E800A8C9AAC379C54213A5EA71742E3F3055DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-110-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/248-104-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/248-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/248-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/248-322-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/248-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1684-67-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1684-59-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1684-66-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1684-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1684-201-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3396-13-0x0000000002FA0000-0x0000000003007000-memory.dmp

Download

memory/3396-6-0x0000000002390000-0x0000000002415000-memory.dmp

Download

memory/3396-19-0x0000000002FA0000-0x0000000003007000-memory.dmp

Download

memory/3396-7-0x0000000002390000-0x0000000002415000-memory.dmp

Download

memory/3396-1-0x0000000002390000-0x0000000002415000-memory.dmp

Download

memory/3396-58-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/3396-0-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/3396-18-0x0000000002FA0000-0x0000000003007000-memory.dmp

Download

memory/3536-293-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3536-89-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3536-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3536-96-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3536-339-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3536-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3864-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3864-171-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3864-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3864-55-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4228-144-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4228-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4228-130-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4228-139-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4228-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4252-71-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4252-76-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4252-287-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4252-82-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4624-28-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4624-34-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4624-35-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4624-128-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4624-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4804-117-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4804-314-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4804-123-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4804-116-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4928-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4928-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4928-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4928-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download