1ef9f698c54c6411ac7cd05a03a75fe2d790995820475141dad2b0d586f7f547

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 1.5MB
Sample261024-27ls5axwes
SHA256 1ef9f698c54c6411ac7cd05a03a75fe2d790995820475141dad2b0d586f7f547
MD5 020f1c06d0ce7224eb2186aea89cfa1e
SHA1 631e5d945581e64dff6586f2f9e501241e3577a8
SHA512 d22203890fc2908ca848bd1e1fe20a0026389b8b9d93d107746c05b01239d60b927e38e9b0b236827a480cba7c5dad8368a3c3ddc218ab8170a5270fe885cb0d
SSDEEP 12288:NmsihqDqtneH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:YHte+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1FD751250B1C0C0B3C466163489A9CB70AB2EFEB21B79D587F788A7699DB06D0C7713D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4144	elevation_service.exe
4520	elevation_service.exe
2796	maintenanceservice.exe
4280	OSE.EXE
5808	PerceptionSimulationService.exe
372	perfhost.exe
800	ReFsDedupSvc.exe
4140	SensorDataService.exe
2448	ssh-agent.exe
4128	AgentService.exe
4472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\75715423c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b4275530d64dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd799a940d64dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000232ef5520d64dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006927a530d64dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c268eb530d64dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4c80f540d64dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a27618560d64dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4144	elevation_service.exe
4520	elevation_service.exe
4520	elevation_service.exe
4520	elevation_service.exe
4520	elevation_service.exe
4520	elevation_service.exe
4520	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4676	2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4144	elevation_service.exe
Token: SeBackupPrivilege	800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	800	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4128	AgentService.exe
Token: 33	4472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4472	SearchIndexer.exe
Token: SeDebugPrivilege	4144	elevation_service.exe
Token: SeDebugPrivilege	4520	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 5448	4472	SearchIndexer.exe	100
PID 4472 wrote to memory of 3268	4472	SearchIndexer.exe	101
PID 4472 wrote to memory of 936	4472	SearchIndexer.exe	102
PID 4472 wrote to memory of 2932	4472	SearchIndexer.exe	103
PID 4472 wrote to memory of 3024	4472	SearchIndexer.exe	105
PID 4472 wrote to memory of 908	4472	SearchIndexer.exe	106
PID 4472 wrote to memory of 248	4472	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2796

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5808

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:372

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:800

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2448

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3024
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6d28aa1772b8495f766808049ca8425e941f050ba07623ef8d72c6dd96d95180
MD5 bd5f00c19022a61be83aced4fbfe9b74
SHA1 8c0493be23438c37ecc5af4081012cf4902aebcd
SHA512 14d09d4f3ee33105224db38b4ebae5d4e1656bbd5138d90a66c5bfd6ffca4f83c6e8269490349590f755a05a4873167f4a14e00f81698a95e060f8a80983ea27
SSDEEP 49152:Gb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnK+tgauhwbR3P8wT8:43q6mjB8gaPJ
TLSH
T1F9D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 a00387824c520be9f68770a0506d02e83f6c04ef35d1a13420cdd5af5bb978c5
MD5 a389fd43dfcbe35b58dd3f6bf14b8d84
SHA1 1be2b2c54179f8d6e5091f907d38ade3eae4c2d6
SHA512 3b66008c0c7885957a812032b33bd5a718832096138dcc1686137d3e32b1b685b03ad73bc1e5b5fe44ddd369f140a2f185642cda70901073a87740e92544c7ef
SSDEEP 24576:WXYfDtczAV+4ZAgayjhwbmY3MaReFeDvSP3b:VtcU+tgauhwbR3P8wT8
TLSH
T1D185F128B3D408F9DD67823CC9A28511E673BC9547A0E78B03E4AA654F736D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 60faa50ddd8238ef133b06d3c036c670b5344f9287c8b161af2c8eeb10954bbe
MD5 330ce1a69504e572753c3faebba32aca
SHA1 7b9832c14eb8ad8f121cb33abca1fa7d2c0a3156
SHA512 c69e1d464d4e97f41cce57c30aaa00bf3aa7f5df4e784035db51729d7dfacf6d9ce054274d2d429c41f75d24defd5c6a418cffd3f0d488fba9dcb5902f00a817
SSDEEP 24576:w0Le5ji0hmxhrMy+4ZAgayjhwbmY3MaReFeDvSP3b:wPji0Azj+tgauhwbR3P8wT8
TLSH
T17395AE16F6788335D073C0B9C5D2A69AED7134821B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 544b591f4767a5c84459a8fcc79220a7033316c2788a6b662c0d6921d7e43036
MD5 0e55477811e5afb208c410987fc0d8d9
SHA1 e86b5adedd15d1f2cdb5efd9e8f50801ff7e25c4
SHA512 0fa4ec10c1ed6f0ce133c2e69dc43849fcba54f88928522dcba89f7b5c78459fcf77fe93188203ea950f88d71da02ef8d4a24dbed76f885a4d643c714238f2c7
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWj6q8wyuE+4ZAgayjhwbmY3MaReFeDvSP3b:I/ezSC6vUzPv+Hjyv+tgauhwbR3P8wT8
TLSH
T127756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8276244eaebf159866a9fa8d25dbe324ccabede1578fff4ca319a381c5197b0d
MD5 6535129c3553386ca55a10b2277c537f
SHA1 47c9cf3ffc31deaf445f8318f36de3d1f831a15b
SHA512 ed2ad7729a265d1cc3e2ef46b928dabe9d87097bd874d5eddf02c2c865734bd78f1a3ca6cbaaf0a781b550e3777604785189425b87e5d9f37634355619a72b04
SSDEEP 24576:tVbqPb88hv/l+B5+4ZAgayjhwbmY3MaReFeDvSP3b:tVO88hXl+D+tgauhwbR3P8wT8
TLSH
T14B559E66F5748331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E77BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c0e8be9ba9924baf1c41c16e6b79d989465b4658000282e410fff050eae60c3c
MD5 3181e418fabf1bddd6603ff6b7a68fd8
SHA1 df414b08e4e3e8f46f014f8b60aeb3cd60298656
SHA512 e85ca060e055213d1dfb1fe55ad2acce16fd09e8f2210fae065b58cb4cada9c067cd33a383cf94446ee11d2f5d14ef58bb4dd866518384c19737914244436145
SSDEEP 12288:wGPeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:wGm+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T11F652381D30C94CACB7B0B348B7A0D706699AFD51E85A504E9C97BC9CCF0DADC6B1399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 bcf168bce5337150e34e3fe2eaaa0f88ec4ef95c5987f145f37cbb749fa1a107
MD5 bdcc555a31afb4a2b8df89fc2ba4ad1d
SHA1 9d2d12eb1a8e70e2c8c52adb373be6ee0c023819
SHA512 d759490b1f90cd175c6b1815c526a08102ad33e22e18b5ea47d4c2a17b5e07c79e3363c8c98de6329fc9f4e7323bb5685d568f0846f5c4b2f178de62a1b701cd
SSDEEP 12288:MeBNUbTVO86UweH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bw:MJIUB+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T19E85CF7BEE28FCD2C27E4DB85B918600A76278704F52A3CBD165830EDE235E54E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6a2b78fcb414d530202485ff17d38ca9e3303bc737611b1e8143d9b0b32a3bb9
MD5 9b2a6caf6e74566b676e459d5b5bab4a
SHA1 b7c97231dd7a70b04923190b1c3e27b15b28a67a
SHA512 527cb3363e3500f1ba0c9d6b6ac2b00efdc6e962edf00e1ef3b87080756ca7e94af780046b5bc721dc7cdb2efc90468bb25a99f9d2f4619e3b27991a3c553fdf
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THz:BQvGAdlCEL8c/WRNw5CXgaPJ
TLSH
T1A9266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 7b6ca4d2a89c5e50ab4394ea494c2e365870742b10480b199537421dd8ea812c
MD5 6c113f63925aae714a8db97b741a2a13
SHA1 79944871480ec411f44837ebb7707ccd44776c13
SHA512 37c08ad9379b73bba8f3a768c04b97f443205d11530f3f8a79ef4f661fd87bf6c27c7bc335687f786f2bcaa18647d38b569ce68d90eb8584b51f8a7d4c4e2625
SSDEEP 24576:PfewsAjT+4ZAgayjhwbmY3MaReFeDvSP3b:XljT+tgauhwbR3P8wT8
TLSH
T1A285E031FA74E436C67B0DB21B36C712146DBE604F511AC3E3E89E9E89706D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a992cc71511c3b5fa1568b7588be9b60d915f36391b96f156cf718b6712ee95c
MD5 8c3fa814b75b40bf093c5a4de8970414
SHA1 fa2360e67c166334085ee07cfa1c0b9c220f6ed6
SHA512 a6b955c50f098c62f30de1123e20dc217a41591d1b8bfec76f9436a82ab2e7a56f7e0a2329ae09605edf41bea9676c6985073913c373ac6dc7994b27964a4d82
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHVax:bUEtQevvqc2W1cpV20I32W
TLSH
T1FF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5d48399b06894390e9d26064a8565d74ef525cc40d2bb7e69d540cda9f3a8d55
MD5 8a7280130598241b7ddf0d565eadf026
SHA1 d554253fb79aa48a2052ce3425a26d04799ea4ad
SHA512 4a096973d7533b4fd7cf9f3ac09520d5e356c0dcc307c4e5168900259091e414ac77a615a612521f3c0a82723a21cac0dac9a66c2ed0cbe711e335fd407b12c2
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zz+tgauhwbR3P8wT8:+oqtVjnmjgaPJ
TLSH
T1CDD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d4b539fbc9bdcadf3b091b79f676c06921ffeb9cfb0df210e2ce419ec37de889
MD5 f88e0cc10fce5a4284927757cc14152a
SHA1 06e98b52b2fada12817e515539f531aa7daa94dc
SHA512 68a368c283492be3423a4408514988bfe5f1ab6231c3ae9099585913edc2c0fe1998d379434669c882162d325eff379e65cfb0c5151b8a1328c38c82c78503c5
SSDEEP 24576:NAhGL6IFoiwtA5l7S53Q+4ZAgayjhwbmY3MaReFeDvSP3b:NAM5Foiq5g+tgauhwbR3P8wT8
TLSH
T1DF359D80E7F955D4F5B3AA789AB68570EA76BCA65E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 364ded5482d237602d5865930f784ac8caf1ade295c03e79ced30ed83cb4278c
MD5 043b65552cf804cdcb6c20dd219dd83b
SHA1 3373f076782c6806bf86ca0d537a2265a192db44
SHA512 d8a109bbf25605b46f03230a14c56f22c36fb3e1236899e500466859148e5b7e36beb8bf525aca9f74c0b21a9215322c033446d3c2c7f95b19d070e5a424480a
SSDEEP 24576:wwuROWP+4ZAgayjhwbmY3MaReFeDvSP3b:wwSOs+tgauhwbR3P8wT8
TLSH
T15985F14673A80CF9E9674238C6978532F7F2BC422A21DB1F57A0C75B5F73261AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 15d7f828c210980f00db4d28814b1c595965f9b932e241a2d874aef652b2642c
MD5 61669d4d2eea6ea97e31e2ec29df2fb9
SHA1 2fe4cfd64e7c7b4ecae610966284c6281e7b2ec7
SHA512 278f565a503de8f03517ef3d016e40946cbc79e2be7acb35e556ce889280f604cee5239be9490cc0fc3a80402104806bb4f686727b2bd1def1a85817e236f2ee
SSDEEP 12288:5yZ1Iy+eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:wZu6+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1E9751285239860F9D2A7033CCEF60A10E7B27C922B7243CF9595679A5FB2ED54E35321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3a2f0c946c2d8e0db75a1609a72793063226fa1c988fafdab4780209302e937e
MD5 02d435f1afeb27c368208aab15ab3468
SHA1 ae8d27db8df65031012ae09cda65217daf6e7fb2
SHA512 a40420bc5696eb1a9f46bb2e9bdf32a986941dd4a7904876397ee53bb1dfcc54d0463d2eb47448b9f465ffef9f77c07ec73f8e1ab1e44e22829e4c2ba246512a
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Un:tQRQyi36YOcPDLvw2gAf+PN3wgaPJ
TLSH
T162667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9707d896616d08a8b7521da3ea33491c1ae665194888ebdddbc66299eeadf8ac
MD5 f44aa5eaf149e03a854745cf2e4a7d3b
SHA1 b6b9c1423988579bcfedd5e19273c12ef3466c96
SHA512 a094fdade087a56fb2c8b73a3d47f4aaa3920c8806c76c2a73350ba00788080c2941273bec609e9af09a7b1bbdef6fd1619a218203f2f85dc71b91bbdd843f89
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Un:cQRQyi36YOcPDLvw2gAf+PN3wgaPJ
TLSH
T1DC667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5cadf64a47f3b171e0f9e02957389446a65e6453184f1fec730292b93fea7ef4
MD5 47eb8b6034e36ba3280797148ce5fe04
SHA1 4026d2a2fddb73a06d5e36751077322c383a8251
SHA512 e98a5e7541847e6da204b05fc117cb46d9d9510f03c5185626001b69ee9e57e780fe0594c7034620b646b3aebf715bc43bab990849b8a091fb062bd75e5856e9
SSDEEP 49152:d68Qg55nhkeWu7PNU3/j+tgauhwbR3P8wT8:bthTRc/2gaPJ
TLSH
T168B54933B2F60099C44DE1769F4A873196D27C758FE0E3DB8545720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5d034f4711277613d836b7390cd32eb5ba867be11df0f9503a26b35e5c168b28
MD5 107aada31ec846502d15cd61999e8811
SHA1 71ae4630c9f50da25248a25afc8e5d12cb3f34b6
SHA512 4365bed9574bbe21af7a1a4cede913bf115cfddc90c20c93d8632cfc8cf8e11c65796ef746fadf22ba7c0faafa0206038b52d4f714fe51aabe37e8ca44d359f2
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk999:4y5112gYy5azzVvU69nLKnhZpgaPJ
TLSH
T186167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b255b35baa06bfb11f7f4618b5bea8f9ca72f8b17b4ebe26e85537d818b820ff
MD5 3887c99bd83d49aec550a7685133da31
SHA1 b10a90779adb880e0b826a86a8a0cebf46f78bca
SHA512 eb4e18e6a4b4f94b57b2d24b9ae6ffe3c3b55ed45720679bc806d9004ed40191e9b0c3f6e0c6c2718a273d8e6d2fa6ae5f527c9460336019bacd86324fbcdf7f
SSDEEP 49152:SB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glr+tgauhwbR3P8wT8:gu6JmIxd2dugaPJ
TLSH
T18DD59D13F1DA01E8D06ED578874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cfcb915d95b78892d8dcf34f3edd977c15c63d6faaebccf7cdf5461507c52e26
MD5 b615262a0bffaf528450c4d106816e1e
SHA1 af65fcb0977aab96a7a919f8636476edde816b7d
SHA512 dbe97f26d95f8cf7d2d10b693c26991fc486e531a435568924f47dac8b8cba9709c75363226f0cc9bcceb223b54d249cde75217ef221878e8a625db683fc78d9
SSDEEP 49152:41hpsNoJpF1A67U44CwH7R4xh+tgauhwbR3P8wT8:4mifPqRjgaPJ
TLSH
T1FCB5BE13F2D800E8D06ED17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 00622841e4194638068b2e7655e27e55e041a7a1086efc992ddb553d87634788
MD5 d1c87740521075e17b37223c7650e662
SHA1 64e512d3c54a38a55ad79d7e08fd4c837e29ce00
SHA512 91516db3172351a68091ba1ff9c42970822c2d99b7a776679986cce295babde966a3f8b555294a8b885ec68f69ceb1be1ed860ad822224be239764403403e595
SSDEEP 49152:uSuZQIY0Be2KkRVtOnks6NMHq6+tgauhwbR3P8wT8:g5dKqi61tgaPJ
TLSH
T10BC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b047466ac2976ef26201eb2f9e5211108a1bc16ab13fb039754c537f12be8c77
MD5 31fb45cb9d8042d337ed5f8be58ff801
SHA1 e7a9701c0b6db8f623c24c22359848ca71978d19
SHA512 b804c42ad146e0d6a7aa6b3ee0698e88904a2cfcafd16bc3b15a7cebe80f0f1fb87f24106bc172e4a288327c14fbac1593d8e3d995ece06882cb6fcd08c99871
SSDEEP 49152:ghtSn8EApI0figjgiDn0AP5wV+tgauhwbR3P8wT8:xX2iWphfgaPJ
TLSH
T16495BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 08608724db837f203d002c7b2a81413ed3d88e846292931caf2aeff2d6914630
MD5 5bd4ab9ff9fce9af74cb28083f5b41a6
SHA1 299a57e7beafddce9eed2a64a26e1109336e17e0
SHA512 f0ac160b4393fbde434981b15449b0acbfcc2a7e77fbf5f9304462357b4307f60dde22bfa2c254eaf19dbd7963438bc705353c3c043679ac37de6dc45ff2760e
SSDEEP 12288:aXeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:au+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T143652381D24C88CEC62B07758B6A0A60A699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 3bcec4b709c4f1b1e3b2858afb4857b4ea2dbfbf90c4da2056a725861923e8a2
MD5 872938253e679d0c911f7288fa941397
SHA1 8a95b5342189d9161b09a757efb49a8f96497668
SHA512 2e79e95ccb016b0a8eb884fa3cd295ce973ba9793ee4ebd9d3673efc367dc963223b9f795ff49a2b06307b3bb5463b534e396a0a6a133f3b5a1297d0c575416d
SSDEEP 12288:sSeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:sn+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T13E652381D24C88CEC62B07758B6A0960A699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 77514fe2285f1d12c717f06805e6b119910bf9a79271b9347955a4270b53a5d3
MD5 e6d0b805a6f3177e8807f9daa679be10
SHA1 17f0e4cd109a3ab890efc803659f68aaffc914b3
SHA512 9e9d7513808eec6be90938623fdd08bb4c723f1637a2b388d3d0ca9d0e91478c3ded9dc40aa1e83a9976e99c3160f9d5ca05d65b3e8e8887ffc713d333591565
SSDEEP 12288:L4eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:LJ+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1F8652381D24C88CEC52B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 ffe6cdc8c9ea26c72927d210694904fec7926eac20d6d447b5ba2571b0191c3a
MD5 44ac5029a6a6db942155d9e87ec4acbb
SHA1 4ec9e287d741f823e7f95d6555ddf96dd1b0ce06
SHA512 b996b9e2cbeaf7d5f797330785270c7289a049e1a5bb6a3277dd7bd37fbeb5c4ee676a5fc5fd9c070855cb07beee82dd29f56b558d10bd13bebf4a18a317a767
SSDEEP 12288:BVVeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:0+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T17B652341A35C44CAC9774734CB760520E3E9BED66F62628FEA853B854DF0FE88970794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 12f204d2152d0e3b41aa2df3842d6fca00c2729f93115f8af78bfd82d65a7b33
MD5 7494381372e26b495c2ae9a00be4111d
SHA1 53e494daf6d1d5e1e9e94da974a501b5f9b2e449
SHA512 0e36ba4d5897ebf1a9dc201ba32c269235c33352b99581e14d93f2b9903c5de8a035aae2ee33dc6e91639546f46a3cfd45173338549279033b8e063636b200c9
SSDEEP 12288:vNeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:vI+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1BA652381D24C88CEC52B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 0cc45d802d39f088e4b0857b7467324dd499b202f82d0daa15babc9dc905c1bc
MD5 4c464d3816ffa7dbac2c0d1e4ae44bbe
SHA1 8e0c25f4a5b96a9ac93d7747ff0bd1387ab97ebb
SHA512 f05f103b54e7bdf5e5465faddac440dcf873a018303cf725d706fda75caf9e2042e67e58bee16c8b4a12f66d1a0c09f786fd7af77758c26fcd357defaf1cdc20
SSDEEP 12288:Q2eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Q7+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1DE652381D24C88CEC62B07758B6A0960A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 b79b43395e5e5a798db6bfe66ce612b45634fce523c8da8c1a9789e73e35b060
MD5 d75e8db429ce10ef61add8c3c8bdcb5b
SHA1 f043e3317c688ac7bf3b8caf56f1cd7e228b4d04
SHA512 5c4446f5d618a53a573851a6e6f4f12b4bda3d0243092b6cdc036d187898e5888fca5c8760fd274fd33ba3de7e4d9e3b59c51718c6adbb466edc3efef02899d9
SSDEEP 12288:GKeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Gf+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T19D652381D24C88CEC62B07748B6A0A606699BFD73E866144F9CE7785CDF0DBD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 6435f6a9e07cfa9575fa87905ce2ed16c9f8c3df07a13ae543382bfc279f363c
MD5 d67fc6643a357057304aea4dc6754d9d
SHA1 eff7d3e8849569bdefe41e8ef3807bf93b7e7801
SHA512 a3f3625955d701143122e9a3f78b822a691a99285e0e4b5c6737eec643130d32a3c28efd7fd495e920437a65884580437c67e1caea16a4322303fbf7430c306c
SSDEEP 24576:pZM3zFVSOH+4ZAgayjhwbmY3MaReFeDvSP3b:pZM3zfr+tgauhwbR3P8wT8
TLSH
T173850194B39418F8DC67423ECE264911D6B2BC5A0B60C60F53E837665F737A10D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 4b2144ec6eb014fc2d28523e4632e1d6d739a856c47911b9563e6d51ed8f7b43
MD5 d93ccb71bbbdb1b2309810911d1f388a
SHA1 e12a40fa73ea53fe435e9f04cf53e5f9a5c4acc3
SHA512 866d73030f3d95f873d588ee5c2722c9e8bc2719c95bd3d864fe577c9d717d13543f7095fa551e28241ff6cf30f1e7fb437b157cca6dc9bcd05deef83cdae172
SSDEEP 12288:zTeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:zq+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T162652381D24C88CEC62B07758B6A0A606699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 2202d26d094a2030126d61c9e0d5b3682706e4d2670e520ba75ac856ede347d4
MD5 3ccf7c3c336f446b4eff1b4c3004c884
SHA1 afc26762ad90dd4ab3bb2379693924376e677c49
SHA512 e01fc43ec878c8e1aec3d58a0607da3b7ce79f7f30d553f200dd6df385a7d5e290c91dfb94f83a14a7f1428863d23f6b0e2fa2fcc67329f4021bef7bd51bc308
SSDEEP 12288:6feH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:6W+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1B4652381D24C88CEC62B07758B6A0960669DAFC73E866144F9CE7785CDF0DFD46A13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 7eb2c75f3aa7a3012dec02aaee61650bd209272cfbb8e65cfad01c1a6fa4ee7c
MD5 545d7d7df0a852180717b49347d32308
SHA1 a88d88d7b6dd4a14d8bb66da47880112a778adb9
SHA512 77efef209f07a0ede4282369553708b8327642dde7e2f76f6bcb9d260ad3114b8d384b5843c16e4abc9448ddcf7996d373841ef9b99a3ab5e7fb87e7685df44e
SSDEEP 12288:ayPz5L8+eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:HzyD+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T12F75124773A430FDC1374238CA620A11F7B6BC721B609A9F579417765E73AE48E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 60b8bd7016f8d04870276a7b201016008e16e086b46f3a813bf037bf5c155f66
MD5 90172464ec20e6db6a00588852302035
SHA1 4ec1d3ad2117d02db055ca4df7df9cf84943730f
SHA512 5013eecc9c7db3304aa9e85bdf7a7b0259adf9324a45473e66ad257a2e4dc5635448668da7203e45aefd887fccdd7be56bba1888228070bae6bccb5ea193db98
SSDEEP 12288:8TeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:8q+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1A3652381D24C88CEC52B07758B6A0A606699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 78bdc813015d6f3cd555ba648484fb796b302dcf00a1d248552a18d33e9a2df0
MD5 15929bf355e3bc884bc57bb0b8c1f66e
SHA1 73a7f60e937848954173ef71f3cfb2da0794f645
SHA512 a6719ae6016baaac17ebbc3627b120787a4b9d8587217b856d75d8da7b15c309f537a82c6ade774b03edf9379969f5c69937d51c90c60ac04050a5af362fc803
SSDEEP 12288:LTeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Lq+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T190652381D24C88CEC62B07758B6A0A606699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 b00098dbea755df8fbe46dc37259493b3a9a415eefe3e3089ab280173a613929
MD5 2aed2551cb53a6949c8b4634005f93d6
SHA1 3b11c3606e138677b136ab49d088f62d3026a7db
SHA512 3e1cecdfa63daa7205ba91becc86b26db1bd90ba40ea44a069f87a6cfbf0a92dc828521e3d8d775d738167f835eabf8879cc15c599ae07b03be2dd6bdefc56b8
SSDEEP 12288:kyPz5L8+eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:9zyD+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T15C75124773A430FDC1374238CA620A11F7B6BC721B609A9F579417765E73AE48E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 b6a42b27a78901307e8e07def274881e684d8fc4998acff7757bd19755a7894e
MD5 3735b4a97a870eb9e5b7ec3f8240a1dd
SHA1 ebdc3a1f4084f8edcf3b7d8898497aa29286499a
SHA512 b84ddc5db26331754f0ee71a4bf050ecf6474fe346f45d05313b0d566e4058482eb13b7e461e587cdecfd32aef9177c923929308f9f3d611615a918b25343a82
SSDEEP 24576:3T8aLl3z0zDZ+4ZAgayjhwbmY3MaReFeDvSP3b:3T7LljE+tgauhwbR3P8wT8
TLSH
T198850194B35018F8DC67423ECE664912D2B2BC5A0B60C61F53E8376A5F737A10D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 20cf165b25ec75ebe657a47f9ee87868c7fe6016aab00a486151739a5b9b246d
MD5 f919cee260437d70455d26938a98d73a
SHA1 f1abf36218d70b53b7b9c1fb6965d2f33d7f970c
SHA512 b88b57df19f5d214614a4029d4c58d6dd6278c89f4735aba9cfba4f669fb3c9d98e5a5cd62b6df622c91510db182ecc6bc2b7f4ea712bbaad1d032693c4811a1
SSDEEP 24576:m3rd9CHKy7GZd+4ZAgayjhwbmY3MaReFeDvSP3b:Ird9CHKyar+tgauhwbR3P8wT8
TLSH
T1F695CF90F3E414E8F0B78A35CD764511DAB67C9A1B61DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 15c14641ac4b2a8c288b48554dd5c9251bd3d1964bde07c4276a559730688719
MD5 f855613dae71c97c8fbb1e6f6a688295
SHA1 95205692872fe82d5e42f764745edc0f5eb3b054
SHA512 5ef86222eff07da541964a7bc66b7663d9c778ee38ab2d87dec3578d63dd865819e8bcae801465e9b5018d709fe5ff21608ce5a79e91d2ba0c0cb068d8a0e60f
SSDEEP 12288:4YeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:4p+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T18B652381D24C88CEC52B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 b0b882c7aaab1406829ed8347776200085f6a36f15d1eb82cc9aba3cda7e7f00
MD5 4c2f4a171dab0fa2bdb86646d36c6187
SHA1 fae039ae04296f8fc72e5c0240ac129f9d6ac861
SHA512 cee265228d3ef1488e236c0aee9d1e8f4d113c04b1eea5606e74f57f627af00aae60c4dbb4d23eafbc9d755c281ab1015c28b4768ba555cf17da7efffb4c9612
SSDEEP 12288:xeeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:xj+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T162652380D25C88CEC52B07758B6A0A606699BFC73E866144F9CE7785CDF0DFD86B1398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 69a9b9ecfd24eff6739e46a15d2557ddfdbd13be004cd8b585c097b13676fe62
MD5 2342f55afd246b37244adb5874ccf47b
SHA1 ce88d84e5bd3051fdbf443950b4eb7e73d78c510
SHA512 e5b9b4da7b07191d43655ef6426e74ffb3bfe40c1f9138a27d28ab59b90c80fdf3a1402299413538cdaaf6611015f199791d489eeab9201259e65ce907538052
SSDEEP 12288:8ReH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:88+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T12B652381D24C88CEC52B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 c7e85c43dd11f66fd3863c6ddd19c4a1047fc420f7ef49665579943aeb295eb0
MD5 1604d13f731d20049b317981861bf05f
SHA1 6339d8f209645ac92ec2763c71cb07443eaa6f1a
SHA512 84bab8717582b209a60d430efe22dc41e68a05492b9df1a1d7438696579dc7daf7f4b00028755d5b88c00aed7195d15fd44e7e504a69f92d99058fc1212fc591
SSDEEP 12288:7TeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:7q+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1BF652381D24C88CEC62B07758B6A0A606699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 c48cf7ca195516648796c6927e5138f058986c6d6700b28bb65f518bb01be3ff
MD5 6452edc718d0a59988921854dac10471
SHA1 fe66fb0a32b20ed40b1924cb37ef83f3b563fed6
SHA512 3b5063e1492f027e2b9fbfffcccb04812a721c814809ebe9da96a834e8179350188e0183c0912cece79a323be468fabb6c6380123fe605124efea4d7741bf465
SSDEEP 12288:uYeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:up+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1BC652381D24C88CEC52B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 318816d722b1f7889487ffce9229c9ce50a78a85154f34397931dac732340f49
MD5 c485e55918313a469f2624c1198ab265
SHA1 89639f11a2f03e01e9434885e33fdbe29c4d76f2
SHA512 38f7f6b71281551344ac80ca5be25bd42b28e9dd4483be743605298bf88029da79998774f3fc09562d2333a321351af0e360ce17fcc35cd81b0678c013938544
SSDEEP 12288:/LeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:/C+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1AE652381D24C88CEC62B07758B6A0A60669DAFC73E876144F9CE7785CDF0DFD46A1398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 336a23ac94718983681dbdb7ff65b0057b08eab2e334b0b935caefc18f530cf6
MD5 885ba5ecefe7cfa519f65a0e613497b1
SHA1 7beb31f08aeee7e6bf90aac87d4936f4e4275ad0
SHA512 cb272ec8fe8354db7643ac3e273d1b27c819966161fdd8595c536e675ca04b0e4a728df06f7014e1f3608f0c66644199fe745e5ae7972adee367a02743d75dff
SSDEEP 12288:8NeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:8I+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1A0652381D24C88CEC52B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 8597b8d3995f7ff103285d84761a198211ad3ae6815e60b97db9c323209cebce
MD5 9273c1ba30cff0165712371587659f2d
SHA1 2525c312d24afc442db6118436cc40af2d2b7c4b
SHA512 ab7b33e959add1618668ad6a9c5f802bcf2178aa4a4b355e4691134aeb79bfba391a0ffecbfbff178f0f84a8e95d71d43346e0f699ac28aa607026ea0e68d174
SSDEEP 24576:yfwvzk9RX6wkyAIG+4ZAgayjhwbmY3MaReFeDvSP3b:5MnYIG+tgauhwbR3P8wT8
TLSH
T16495DF29EBDC44E5E1B7923C89B74606F6B178591B31C2CF129A53AD0E33ED45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f2e188a0a81f7f4984b8cdf269ae4040f1194fe24532d21fdcad682f962cbd7c
MD5 581c27ff0afd10a252ef620307cab447
SHA1 f32c69d0672be67e788e9b38b5ac8b54cd1ae5be
SHA512 5c747d3dd449c56a94047e03fc4071247f95aaee39713b7992a1a70abeb58cee50791718297c4847a3fcbbc21091472e043a3e601268edef7b7cc6d6a6956ec6
SSDEEP 49152:lYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01+tgauhwbR3P+:UySzPQgaPJ
TLSH
T15F066C96A16801D9C1B9C1B98F1BCC17FBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3cbc5e8550ff035a4da6e3b423eaee42b5bc45391799fe9f5b50383cbd2b1c5d
MD5 6f26b92bd8c7b2c2a6d9bb7e996c6ec7
SHA1 2b5ef8f8178cf73d0d27e968612bb9c2042805a5
SHA512 dabc228e340ff420d47a51f925db985f4cb1a771bfcb5c1192a2d68cca7ab73d040c68bef36035bb40f60e0ee2b91d5f9b319d7b551d1f99bc6a7b391ffc3919
SSDEEP 24576:b47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY3+4ZAgayjhwbmY3MaReFeDvSP3b:b47JUQjqirIhCnDHUPfF/l+tgauhwbRG
TLSH
T1E965AE1DA3EC01D5E1BA827885154A5AEA71782E1F31CACF22B0937D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 5b0bd91527c0f12f080b800b5dc0a9cd071100072e115a25db19f923ea7809c0
MD5 035eb5be892c8919a1da70ab49a266d8
SHA1 18f7d028ee9f815b4aa0300513847a0a991dcaa3
SHA512 dfc43e58d52c3fd9825bf7a2556c2b742426afce77c31255e5c9bf1445cbca1fbdc26373dd80a7ac3039d462889cad134b664793f1f6a9c954073f3d7d73c509
SSDEEP 12288:apsfDeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:z6+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T14475F149D29801D8C06E1279CB564A40B3777C6657E1D3CBA6C0F67E0FB1AE48EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c315a11bc2eb392f1d69be3c19e775dc5f1f04e3d106d25f17c0ddb859ca8ce1
MD5 1afb9bfb7df225dead65d626827a5ef1
SHA1 f5d7c916304eddac775270d2597c0ff7c306b291
SHA512 990a2adeb0c8682c4c0adc9a53c6b46c7ee55dd0d821b02ea7a918109de54f73e1c29528e08ed12b7373d385dc75dd01cda7f1cadb3f8dd944a5e99243df6bae
SSDEEP 12288:UYCKU3fcdotiwKxGAHhunIomxmbK4RlSLxRMz+:UYpUPEwUuzJRlqxRi+
TLSH
T1DB3507507666CB4FC66940321E33D1CCAB707D51EE04AF0373C98B3F9576A59BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 e5376cb839a15c97597d13089029047fc562c53e8a84e9e2b7bb3cea59dd7d21
MD5 19700b368d38d0ba81bac0b4de60ffb3
SHA1 80b57dc4ceb7016aaac8ac0f0b87f252b1be7881
SHA512 f39964f4367fd610317fc47031fba840b33d2278e82af23a67f456d2eac6ad3e0c48a200d1866a372e410e435cec4c7a152ad2c542cd49976627d6021543a21d
SSDEEP 12288:GTQ+I7eB0Zu4NZ1MRiRdvkY/BiRdvkAGssMVAiCCq:GEy0Z71miRdvkY/BiRdvkghAwq
TLSH
T12865EA40A537E78FD1B66032072B5B8C6B64EC07B7056F22B7C9453AD86BB11A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 050a2789ef48a1c807ae49f95de66b2216128e5ef45ff882be881ffce49b7578
MD5 4cd01dfa7d288df61d73765d51f65f22
SHA1 47973d4595797cc180c8c87c0a09ff49c8b1696e
SHA512 3c7264956c9aef3faa1eb00686b171ef51334b91ddab763c7f47168f1915baf64f5be18f59aca50541e9d68d25ae042b31fee2119ab8b0eda7c3ca543100ef0e
SSDEEP 12288:uM77eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:LS+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T19B652351D34C888AC97B07708B6E4930765EBF962F41A1C7F98977C58CB0DE88EB1399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 bb56b5bfd46d08373e1db26296e245292bac7298aab3c40444aaf8774a7ce44d
MD5 ff8fac2141e3cc96abc57d41132448b1
SHA1 c419fe9b7448242b0cc926d7d50b371e8404a062
SHA512 b34cdc914882dd96dd793042d61da3dc8bf18ba09fa80260eb0a7950bf37ca7913320ebc1817397c7041d1ae53d7ec86c4316f6579678cfac397483c3d7c160b
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYE+4ZAgayjhwbmY3MaReFeDvSP3b:Jgb4mBIBhGF3+tgauhwbR3P8wT8
TLSH
T16065AE1E22EC02F5E0FAD2B8CDAA4417D6B278161732D2DF1151426D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 7fffa37899387e785f2813377f7567bbb6554d73d96b2bdbad371bde188c42b1
MD5 0558b79ce3993e26e9b8a208d30156ce
SHA1 95b50a58ad3bf73064954ed1ac623aee22a35faf
SHA512 b29854e995ba6a500fb9f65452039729ce7ecb2e4d4c3b4cfea78e244f623a44a319f22dcbefa25129c80001d39898d2cd453de361da5d3a9f6e40e3af180978
SSDEEP 24576:iG88u8FpJqH1vzria7/mH+4ZAgayjhwbmY3MaReFeDvSP3b:57ZFPqVya7/c+tgauhwbR3P8wT8
TLSH
T15A95F16573E401F1D47BD1388A864663F6B2B8250364EBDF06AC8B511F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 55d7c483036fe598cf2b06cd0b317e26a9ed108f2a6833b63c42781c5d9b7686
MD5 3db3264f02e48dedea2d2cea1526bb96
SHA1 7aa8d7d1dad38a00eaf9f0a6f131a43ce9bc6887
SHA512 b7b5f0e0ab662d6a7fb12f3689181b38cbac3fb95211a2aa20c7c75346538a8c30c12b38bbc730564688a904d9f24aefd560a4ac54c8376612918259e90b8d42
SSDEEP 24576:APUr+NQr+4ZAgayjhwbmY3MaReFeDvSP3b:AJQr+tgauhwbR3P8wT8
TLSH
T1FB85F11F62AC18E5E67BA17C8A864715F771BC621712D2CF02D0917E4E73EE8AD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3de79100ef18e2fbf63d7b672e44a08f5665a0e9d1ef4ae7d311574a864039f9
MD5 019d35f6e2074305bcf8b69524cf5629
SHA1 02b7f783ac7a1b947fcb515074192595f3e59d1d
SHA512 c44fda8d2e0549f1553246ef5692d061b4e46b685ed0d0d31417c1a2b940f9a079886ab3cd437ca839f401a9d226b88fe90693965cd6c967e1f2a4529249fa4e
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7+tgauhwbR3P8wT8:JG05lO43bxgaPJ
TLSH
T1A6D5C06A62EC11F9D1BBD17CCAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 534a5a2ac677456821e8fca0ba25ae27283c92aebd9a90fe63ad466c3b99a4fe
MD5 7ae0e8d8b1ff2d15cdafbdb92af8af46
SHA1 707fc7f9e3bd21c1c74cdfd9dd6c52c803defe29
SHA512 bb8a8977c09b1f00294295f33a84eee8a9c3a8b8cbe23c6f94a33711e41f171a01adef4a3dbd761b85c8fb12cb490dc91203c90f788db6f931546903b098f6af
SSDEEP 24576:9fa5POZ3dpyWVM50JicR2hG0lasx2+47eidn1+4ZAgayjhwbmY3MaReFeDvSP3b:Na5POZ3lJt2pasx2+mj+tgauhwbR3P8z
TLSH
T1C665AE5EA6FC00D5D579D17DC6834616F5B1382253329ACB122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9eb4ce8c424487617dfc20eafaa842d318d5e14e05e7fec5fea8a660b0a44f60
MD5 f7044c48128c818ce56a325341c3cb5b
SHA1 183e37297eaa02208d0d2e7817dedc110661ffba
SHA512 854ed280071ca8bb56008ab8b33d2858125fbb4f2d3e55da23451d920001c1dd503bd1012948078316684c8750afaaeae2d5b9c532965fd21e2d81018510ede1
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7Fkv+4ZAgayjhwbmY3MaReFeDvSP3b:JNc/zEOVHF8+tgauhwbR3P8wT8
TLSH
T135858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 25feba7b5e1486fe17578c05b70f935fd3a03622ca879d4208fbfea311c0ed9b
MD5 202ee8c441da5a753e80a5802e40cb4e
SHA1 3ee7ceebf54a6ff88d8a42e2479ddf5d0a2b680a
SHA512 a32d70da92aa4c982ef8356efeedbf8a97895337ec4a81da7557f16a065c68e2bf6f7f51edc1b878041a3f9e7ea546c4e8ee9c7c4c3dda3f4a09b8340751aa1a
SSDEEP 24576:yzkNvNnaFeYhJNtmZBm3+4ZAgayjhwbmY3MaReFeDvSP3b:yzMwBtOm3+tgauhwbR3P8wT8
TLSH
T18655AF6EB6B845E4D1FEC6B4CE238512E6727861073293CB9290C13F4E679D88E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 bef62aaf8b60ccc2dd24fc23313df01e7f66b98bf160c100f8cdad3a16525d1b
MD5 47ed8ebf871b0902c49c903f7240755a
SHA1 d4c444d856fa73e83ae98c4a02c056971ba75123
SHA512 c075c8270f12e53784735242f256062dcc547ab99605c1607c0c8cb207e30528e22c204c5033820e273dbb76ea1cd5117a141a716fbcd3ee31f86814bcf370cd
SSDEEP 24576:VD3FHshBIYQgAO+4ZAgayjhwbmY3MaReFeDvSP3b:VDVHeBIAAO+tgauhwbR3P8wT8
TLSH
T1E595E17DE65C04E4D57BC2BCCA638A02E77138A9032266CB12D491BA5F77EE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/372-86-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/372-81-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/372-311-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/372-80-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/800-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/800-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/800-330-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/800-97-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/800-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/800-91-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2448-314-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/2448-124-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2448-118-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2448-115-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/2796-52-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/2796-49-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/2796-54-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2796-42-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2796-43-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/4128-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4128-129-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4128-135-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4128-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4128-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4140-110-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4140-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4140-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4140-104-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4140-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4140-315-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4144-24-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4144-16-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4144-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4144-23-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4144-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4280-57-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4280-64-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4280-58-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4280-283-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4472-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4472-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4472-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4472-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4520-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4520-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4520-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4520-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4520-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4676-0-0x0000000000400000-0x000000000066C000-memory.dmp

Download

memory/4676-14-0x0000000000400000-0x000000000066C000-memory.dmp

Download

memory/4676-8-0x00000000024C0000-0x0000000002526000-memory.dmp

Download

memory/4676-1-0x00000000024C0000-0x0000000002526000-memory.dmp

Download

memory/5808-76-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5808-68-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/5808-70-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5808-297-0x0000000140000000-0x000000014028A000-memory.dmp

Download