68dd39976a7d8193c9c2bab20d1c18f329f80446e552ce10ebce7b6feab2b081

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
Size 1.4MB
Sample261104-1tebfsdx2s
SHA256 68dd39976a7d8193c9c2bab20d1c18f329f80446e552ce10ebce7b6feab2b081
MD5 47dc0aad0f0dfc0d12eea4123fcfddbc
SHA1 c267e3faf6733eebf88157786e44323e8de26a92
SHA512 491e83778a5f527ce8e63e259c1d0dba30657cc8536e76b3db0f72499d06f55ca03937a5a96040b9c2422828d8d4a058e669ca7fcddcae1c4b09f7551d3ccae7
SSDEEP 24576:gXumBs1WhjKcohDdd00pC0IKfulkBWeQGX6sGkhtpPvUSnvF5OVvJIWq9:Ml4seWoAKfulkBWeQTfk3pU8vCaWq
TLSH
T1C065231272F64038E2F626358CFA5E521679FC359E75C64F2BD8691C0974AC1E63A333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4996	elevation_service.exe
4172	elevation_service.exe
4568	maintenanceservice.exe
1852	OSE.EXE
2164	PerceptionSimulationService.exe
5604	perfhost.exe
4484	ReFsDedupSvc.exe
1688	SensorDataService.exe
1916	ssh-agent.exe
4240	AgentService.exe
2040	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7bd488a227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File created	C:\Program Files (x86)\GUM1236.tmp\goopdateres_ru.dll	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File created	C:\Program Files (x86)\GUM1236.tmp\goopdateres_ca.dll	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File created	C:\Program Files (x86)\GUM1236.tmp\goopdateres_fil.dll	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File created	C:\Program Files (x86)\GUM1236.tmp\GoogleUpdateComRegisterShell64.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File created	C:\Program Files (x86)\GUM1236.tmp\goopdateres_ta.dll	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\GUM1236.tmp\GoogleCrashHandler64.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\GUM1236.tmp\GoogleUpdate.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdd50f5fa76cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007715b99da76cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005586f65ba76cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004543cd9da76cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4996	elevation_service.exe
4996	elevation_service.exe
4996	elevation_service.exe
4996	elevation_service.exe
4996	elevation_service.exe
4996	elevation_service.exe
4996	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2936	2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	4240	AgentService.exe
Token: SeBackupPrivilege	4484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4484	ReFsDedupSvc.exe
Token: 33	2040	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2040	SearchIndexer.exe
Token: SeDebugPrivilege	4996	elevation_service.exe
Token: SeDebugPrivilege	4172	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 5132	2040	SearchIndexer.exe	100
PID 2040 wrote to memory of 3136	2040	SearchIndexer.exe	101
PID 2040 wrote to memory of 5860	2040	SearchIndexer.exe	102
PID 2040 wrote to memory of 2344	2040	SearchIndexer.exe	103
PID 2040 wrote to memory of 5676	2040	SearchIndexer.exe	105
PID 2040 wrote to memory of 1756	2040	SearchIndexer.exe	106
PID 2040 wrote to memory of 3636	2040	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_47dc0aad0f0dfc0d12eea4123fcfddbc_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4568

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2164

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5604

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1916

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2988 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2988 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e697350a26010b3f314fd6ad7a6d22b9399fdc7288e99bbbea92403ccc488338
MD5 d99fe67db4ea66ec95d957f5bfdce2ed
SHA1 cd68b5ce4e5e8dd1823d2f7d6c818df4c307fe6b
SHA512 de1169303587baf40c75ce8cfab17f9c1a202c73ae0ded7ee91080db1c9596d5d906fc707ef9c70aeeb0e1f9c3684fc416ed8ec024023d48dd1fb231703acab7
SSDEEP 49152:Zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn1k3pU8vCaWq:v3q6sjBR6ap
TLSH
T1A5D59D03F2D900E9E069D178D7469133E9A2BC890B34B6DF0790B6562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 01fceeb9b9bd849431826127be8ebcd08e2954913d1251b6d488edb721ef20ac
MD5 b3ddf5546c9bc081f90e3bad046ed14d
SHA1 f400ba52f046294d29eaa0d77a2a59b1ae7f5286
SHA512 79a36f440edb5ec3877e6096f89acb1790bd0e6420912ef0ee5725a57de04dee08dded21ea2bb43166e519269f962accab021300ba00c880e47a4ddd5d0cf214
SSDEEP 12288:I1XLsswWkxy2lRq2czAQ7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:uXYfDtczAQkhtpPvUSnvF5OVvJIWq9
TLSH
T1A505F12973E105F9DC67813DC8A28512EA337C6187A4E78B03A4953A1F737D89E3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 654738d0adf9ef9e29760ee231fbd1f2699b81503a590905ffc4bc8628eda12e
MD5 143f2ee76404946e601c3f25d4cb3477
SHA1 fd130ec2ab8f39b37c9675bc7f85fc5e638db8f1
SHA512 b6a80cd94ca4f6aefd70d7bf6f4195eb6f7e750d20d7890b1efbc4656cce9383368cf5874e7e569435ee9438c9cb6f58122babbf5447e014365fd8b2d2c7c089
SSDEEP 24576:80Le5ji0hmxxrM9khtpPvUSnvF5OVvJIWq9:8Pji0AjGk3pU8vCaWq
TLSH
T15A359E16F6748335D073C0B9C5D2A69AE97130825B308ACB4286D77C7E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 32ec59ff0dc7e71e55aac129689861c83a03f2dbd6fb813dfedad1bf6b4a51c0
MD5 cf58c39aca21a7e2b2f8c0453c112467
SHA1 86e360795dd8470149c5319cc849a5bc253005f4
SHA512 e3873e7047801602276169f5616dd34d4f2760359137cb94c6877c0943dadd31f6acca41ceb11a657e40bb3ef39542eb38285f96797b76e6ce351a589d874796
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWn6q8wyuXkhtpPvUSnvF5OVvJIWq9:3/ezSC6vUzPveHjySk3pU8vCaWq
TLSH
T11A755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 afefda13cf8b6f676edeb1d8d2ecdf64c1f9ca8ad0b976309056ac911a67a0f0
MD5 ca68428fdc1fab886350ccdd2f1f3003
SHA1 0eacfbb55161c651a0fb5ed388ca648256f3ca32
SHA512 84a43e76278b11fa79a14c371e3746c6759bd5ec4412c438ca00d6d8256c9e29167b66583d3fe2558cf0ff7d91d1089b838fea7e3cfe15b4ae099b23ef86d128
SSDEEP 24576:1VbqPb88hv/l+YkkhtpPvUSnvF5OVvJIWq9:1VO88hXl+Pk3pU8vCaWq
TLSH
T1D7559E66F6748331D073C0BAC5D2AA9AEE3234415B31CACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a33924da50cf570d390608b7d70dbc07e811a7ebfeb1ecdc22a9e0a5e703e6c6
MD5 e4bf5179b722c33954323618bfe18927
SHA1 b9322a66971f8ce25a365647680294eeff9c83ea
SHA512 02537a7a7c818f84fcee157d9fea3f60a4f05af8fe8bf91c4035dee28fc15740f5eb06e1472423e5b026aaf1432b21804e63538bf826525281d04d14a8c43c16
SSDEEP 12288:TLR7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:TLRkhtpPvUSnvF5OVvJIWq9
TLSH
T111C4236FA3933296C699613A80DE1DF359111C70D9DDC60E0868B53E0CF9FAAD6E121F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 e5b2c52966c18edc637529d2475f69bf814aa2173b89b69d4c566844da3b7f5e
MD5 7d18a5b10f2fd9b83f5e2c81fa5d9e7d
SHA1 8f68c74e5f61632b9b892ce09c2847abc6444058
SHA512 574d83a2e3b273e5ae1b05a2da8e76cb2bc207c69d3b536c060213ff93419c26dcddb12d21cca05a951c74c2e293c905b21b1db2e4cf0fd8efdea37334dc28f9
SSDEEP 12288:teBNUbTVO86Us7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:tJIUskhtpPvUSnvF5OVvJIWq9
TLSH
T1D305CF3BEE28FCD2C27E9D7956918640D77278308F6293CBD174820EDE239E15E79825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 27ebd506c233f5642a8a4d192c97cacf8ffd65469d864c925f848c49bed5a159
MD5 0c87f2d743c8322d47db4c92b5db4ea1
SHA1 916ddc476c8fa1bb7a5f76860ea2808846f1376f
SHA512 9a427c6a694bfcc9d66ebd43fa4a5a2a73be9f65ba9be9f8069837b75268f4610b8e7cb74cde7c9fe4c73d51188c2e59e7d5eae208b2f0a7ee5242d0cf67e75f
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THF:0QvGAdlCEL8c/DRNw5Cq6ap
TLSH
T18D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 d1d242d9aa7743c17f1c72e0373198e1c16fa654e7763d2b856b7af140229fd2
MD5 7d427fbd47b53ac8c63b6b258cfb0f52
SHA1 ab4a981eb602e8ee245ffd213a65cbe12c75fb06
SHA512 41569e23757d7cb6a50ca11425a06d0253c9ab5dc2ef938f21e442b7120ab47095c919c1875b4bb4215b432efab5020ea0a95fef5b5a25b59ce2afe164d6e146
SSDEEP 12288:HAwSfxL/2Dc3RDLLmt0LDQewsAj27I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIsM:g0ewsAj2khtpPvUSnvF5OVvJIWq9
TLSH
T15515E031FB71E036C2BF0DB61B26C712183D79204FA11AC3E3A89D9E59746D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1f04eaef8b2d99a28ecfcb9c0219fedfcb8533eedd8adc3a3c41fc0b752b22bb
MD5 1fac1e3de94af2c91d5ee72adc19c03f
SHA1 e22e7d8a9e4b6c32ce64f02e2acba488fea4be9e
SHA512 3e51e09f93c4bac8cfd480473e70f213f13c07587b27e981cbfb71680659cc3710f4b1cd5e3ae7bbe394c8b719d910e997b8d1694503874af8b3b851d6717fc8
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHb6:UUEtQevvqc2W1cpV2tI32b
TLSH
T1DB474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f6dc12a9d59f84b1e616c1265e23e3e760527ce7285a5491d99dea2a1a604157
MD5 1dbcce238d657336f279e2cc23046f1f
SHA1 4cdf4255c508256e643f284e966ae8606867c276
SHA512 e62a2b3f6cd49d12724712145a744ec7fd4a472a2a0ebb4430932bb793d1fa7ed0f3c20699766d007775b89dcc8d4e038c04169174448d07fc4382070012e4fb
SSDEEP 49152:bCbRquA/m2yL5zQfFiV+XenmE3/zWk3pU8vCaWq:EoqtVjnmW6ap
TLSH
T14ED58D0976B882E4D1F6C37886A2C647F37178154B35A7EF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3640cd7015d52151187c9643265ee49d7451abaed967899a061c405090cd9949
MD5 48239f31c189673061242a52c61e3416
SHA1 d46ac277cd59d2c56c939f0b2713e9e2a0beaa2b
SHA512 b9b2fc98283eaeaac081a95a76edad97b37414c7eeb75110e03aeb88f457e92dc9bcdf95b7a4cc6c74a53b143fe8c628a2bc13a71b9430562c452a59790a3937
SSDEEP 24576:fAhGL3IFoiwtA5l7S53jkhtpPvUSnvF5OVvJIWq9:fAMUFoiq5zk3pU8vCaWq
TLSH
T146359D81E7F911D4F5B3AAB899B68571EA76BCA65E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 614f263d4acedc2d03194c44cf763f787ba137abd8d8ee1f375a12fc864137d2
MD5 7e3e21abfca5198f50071bc8e61ee462
SHA1 2c29f188c2a8d307b79f376b19795f0fd66f41f4
SHA512 46b3a389903487fca52c1b0a17097211b92415016e4c08e33ac44b766f3e9a7f58943a086b10f4f2a81828c33b1dfe5092434db1318c76bc5646af063346faad
SSDEEP 12288:nmw5HEjsChNVBFgl0WDm+C37I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny39:mwu4OWykhtpPvUSnvF5OVvJIWq9
TLSH
T1C805014A33A51CF9E9A79239C1878532F7B2BC112A25C71F0760C62B5F77761AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 41435fa73f2793907e5184f741709ec122e0a2bdf7cd4acf536aea62cdecad9f
MD5 4dc50757360d412abd1ab14b0fe19327
SHA1 8240d62a8c52e2948ee671899cf3852f2fa92bb7
SHA512 5e9e20e716cbade0165be36ab60eb284e585e1607b48224460b4c286a64470466a5a7a514aef1127fb4ddd54ab286bd338fe08bbcc55cb978c1483998a655f5a
SSDEEP 12288:qeZ1Iym7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:nZulkhtpPvUSnvF5OVvJIWq9
TLSH
T107E4125B33E131F9D1A6523DC4E50A42D7323862A77A83CF0564526E1FB3ED69E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2793e7997194cc3fa87ffcbc62f2bf5609d51cc3421712d9a049ddcbfba4e52e
MD5 6e082588852f1539020ce6c07b753857
SHA1 30a50d0aa048eb6f6bbdad727c6c409ee657719c
SHA512 9c01358a7062496055b79780b6f32bb2aa38755538778d4f6da0dc024a4f36b50d95e6ffbc7f9fdbf1773ae8c53832b4d6ba8db2fc0dd0ba8dc327118fa06e51
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Up:9QRQyi36YOcPbLvw2gAf+PN316ap
TLSH
T177666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 eb7cea4c930ef124398356a2e1f3a71f4b004b71f4089027295881b0216d9150
MD5 f7535063fb06c80ff76ffb9e15524b8a
SHA1 1e769661f4c36822e5f0c91bcad86943c5bca49c
SHA512 a1fc53bec7f7a8ea3c3c112b50e2da5e0db452e870db6b0de13752fd7e4679164460a267a20666780ffb1bc157db8fb605a88461d4849562d91f3faf4b140980
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Up:0QRQyi36YOcPbLvw2gAf+PN316ap
TLSH
T17C666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 683ee335d6bbd5b9b6a41ce6b8ce94dd97cfbaadb416abb5ddba6bf9d283cf9d
MD5 afc8ac454ecf10a3dad122fef73f283e
SHA1 2c3ebd71eb4390b1e1b65231e63b6e62068b7c84
SHA512 f1b4514a5a79911675d1c71f22e893cbf39e2c6d921adf091de3fdd2341d67dba461f5e5bd5675dbe9764a94ad110ee86e77eb1b10f930fb3d1e728b27cd8b49
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL01khtpPvUSnvF5O6:P68Qg55nhceWu7PNU3/Gk3pU8vCaWq
TLSH
T13CB54933B2F200A9C44DE1769F4A873196D17C758FE0E3DB8515721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 524dc64e8b939122e963403b1e8a242abb72d138223ece25c8ffec1b38f93ab9
MD5 a6309f93b1bb8e85d31fb4934e50e371
SHA1 86a674465a1ed76a2dc16407637d200fe5db0b86
SHA512 52f3c05716f2f15e4de751a574987ae6e7035b1d70c152e2a79338a0d925231e54f45dc9f7d232032b9874c27888ccec2912fa654402a980c642301ef9af7169
SSDEEP 49152:j3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99P:2y5112gYy5azzVvt69nLKnhZM6ap
TLSH
T1EB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1ce08e5af7b788a3c4983fe1490e480f567b88e721411bb9e6c11b82f2338ff3
MD5 00447aab21dc7783473e431ce979b578
SHA1 65d768dbc7e6fddc5d7ae89b5ae57394595e6579
SHA512 1930daacdd499162dc8aef0c1ddc239aab87f320e465f19b67895652ed385f27302b179c5a8021588e36af9086cc564bb3dc848ee154d6aab4a04419bcce92de
SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glgk3pU8vCaWq:/u6Jmdxd2dN6ap
TLSH
T14ED59D13F2DA01E8D05ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2c8eadb15c10f112c831acd2564cebcbe3eb3f10b87f00a084ef28b5ae9708ac
MD5 8789d3f8e72c8632897b9d46ee591c0b
SHA1 5a4ded53bcb57587a7826d7d5c49c67636bab924
SHA512 2f7f15064a8377ba7782b300c78f62d9fc48f1f9c40d397a753342d718977f366b978fd0056ef249b4d1209bf24fa953767a614f54be2a056e5fc5bb35b46132
SSDEEP 49152:J1hpsNoJpF1A63U44CwH7R4xMk3pU8vCaWq:JmifPWRW6ap
TLSH
T186B5BD13F29901E8D06DD178875A9232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 43571af74b35d19c191707d61b598eb9084af98d4eae366aef8474b47b01fb85
MD5 48b6376e0e76ca7e835a08deb65ec651
SHA1 f3be8e8133b377fb214ed8de058eebf1a456941b
SHA512 6edd00ddebeca9f310a142a23b59256f1988e598df1365bf4d6e295e191e928865188d6aa9b607ab3a221fa89bc6a2c5e4da21d814e7bfea08d65402c8f8ef99
SSDEEP 49152:ASuZQIY0Be2KcRVtOnks6NMHqlk3pU8vCaWq:a5dKii61w6ap
TLSH
T1D0C5BF13F2E901E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 668f10638d32d9f69eedaed6778a8d38875001afdbef062612ab2a77abe3f698
MD5 bcffba749f8aa61ea3b544dc4b0109cc
SHA1 43c5be6269cd1a7f6c360a29883b3b6bb823b36a
SHA512 8aa503361de892bfe1ae830c2e9bb1922cca2a7049af9e07b7e6e553f6289b1d676115435fe17a0edf35715d1e232ed682183c8d7f68480f77d7a48c1015da16
SSDEEP 49152:BhtSn8EApI0fig3giDn0AP5wQk3pU8vCaWq:QX2imphS6ap
TLSH
T1CB95BE13F2D901E8D05ED178C7468632E962BC150B39AAEF0A90B7561E7BFE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b5de84ea102bb7cb6cdf33914558d402134503493f9dc0536096e568042b0e1d
MD5 26d4f89c021515ba24ef5329abd13f40
SHA1 7b851e035cdd68e989496d4eeacfcb42e67d9095
SHA512 0ced7170aa41d1510274d400c22b61289e3ab349a2b1cbdf46ef5b341aed6b9c2e386c72af77604d48acd2099302613fa734d4c36a359d6feb86534e750ff94e
SSDEEP 12288:GZ7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:GZkhtpPvUSnvF5OVvJIWq9
TLSH
T103C4235FB7932397C144617E809E19E398111C71FADEC20E096C703E1DFAFAAD6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 6ea4a64b10e0b77c5220f9b38955f760c51aefb2e99348502330f33654781145
MD5 9b85966a17ce0177a5daf073051db055
SHA1 d96d0619c780d63aeed50d3ffac1e7ecb1349f81
SHA512 084df55fe23292d20d72abbaaa6bf8b774c2ca19b8d7952db9ab810142fb5cb636869078274bb03b01c3ce4309e2727bed1bd855b93bbc7fc831b5b532970527
SSDEEP 12288:bK7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:bKkhtpPvUSnvF5OVvJIWq9
TLSH
T101C4235FB7932297C144617A808E19E398111C71FADEC20F096CB03E5DFAFA9D6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f9bf412e587cf37e2637fd738668a15be8b65be389f22df7fbc9501912833120
MD5 5486c44cfb19537c784b2bbaff4f1423
SHA1 e2a7cca61b2842515dc56f497beda08dfdbb36aa
SHA512 9f2309c898fdd71ad7c5ac4240628db9e5dd8766436ebe358d5ea5b5e08f49092c6ebb382a22a1a2c2db9636b8117d995307a73138cd84f75acda99a3c348418
SSDEEP 12288:N07I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:N0khtpPvUSnvF5OVvJIWq9
TLSH
T13DC4235FA7932297C144617E808E19E39C111C71FADEC20F496CB03E1DFAFA9D6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 e5b16385c9203d88defe9c215dba794cba65388dd854396be429048e578cd34f
MD5 e6418010d0f050d8c502bb49b38f3918
SHA1 38cff9ed5926b0e8a2ceb7e7e7abdc4839123d74
SHA512 4d5def6a7ca86c7b44ca87ea4bc835d6c6ebc9d81c80f8315700515d332d64748a493e01aa7b570123429faa0b377f1b92cbe4c70bd2b9b51bc1fe0f369c79df
SSDEEP 12288:aVD7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:qkhtpPvUSnvF5OVvJIWq9
TLSH
T166D4231B73A322D6C455E23DC09A09A2E6713CB0EB7AD34F4914643E0DF2FA9D97531A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 44c15845cbf956e3f639666258198068af8221ebec3ae7a63fcd4839af62e0f8
MD5 eb8e3f6ef4e24fffd4ceee1d53bb488a
SHA1 dd258350bd5b664e02374d966b102f7f7643cc73
SHA512 ab459efd1274f54f7d120445ea6c20b5070482a1014cad9fa023863697aaca7acba202e984956d10ef37cdfb197d0a276ddc4c812a756cb973062bba9e98d716
SSDEEP 12288:877I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:87khtpPvUSnvF5OVvJIWq9
TLSH
T13CC4235FB7932296C144617E808E1AE39C111C75FADEC20F085CB03E1DFAFA9D6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f876d8f1a761a4bb7810401a05dd55b1840dfb40699ccbcbe01605c585e18e84
MD5 d3fa90122692f62bba64aa3b32e4fb83
SHA1 213e4e89373560a132ba4ed101104bf60f819f7d
SHA512 642bed1a74b9b4dd9be4121a58c65171ab19e00848ea937f989cdc962b2db053a98a30f42610a6748276a3603a6750df9d2be5fdd11e72dad119d5eaccee4e3e
SSDEEP 12288:2e7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:2ekhtpPvUSnvF5OVvJIWq9
TLSH
T102C4235FB7932297C144713A808E19E398111C75FADEC20F095CB03E5DFAFAAD6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 dd15e40f78a8dc876b67e1cb1e408535a2da030262fa263336f956c67abdbad0
MD5 4d2c691c2d05f6390439eefb17366dcf
SHA1 aff1797ecb9b0eade77a6b76d5b9cb512cd5b80c
SHA512 fadd5a3e8c15d2671a79c6dbadce195cbad9b88d4df87a75834efad8d4d3c685ece22d089642c4c0478dfe217526cf52318c86247e73554c9cb123a56b53e5f5
SSDEEP 12288:XC7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:XCkhtpPvUSnvF5OVvJIWq9
TLSH
T12CC4235FA7932297C144617A808E1DF298111C75FADEC20F096CB03E1DFAFA9D6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6002fe7b6f33f7167b6b44ad16b60748a7d202022151c2d628d79805cb3b9cef
MD5 422946f73540990d0a2b7dad55329285
SHA1 fc4634eb9c17d8b219cb7e505d852c2aaf895ec9
SHA512 6a00895e2a811d6cfa0053a4fa1cab7a541dbda2c70116d8f2871f34f6c9197738b6d89e6e713b8311b836d8aef0d2bbf25c2d17023c0c57e6fc8b30b2c7c8e8
SSDEEP 12288:GiZwbVzzFEoS2cPvyq7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:JZMRzFVSOqkhtpPvUSnvF5OVvJIWq9
TLSH
T13E050299B39118F8DC67813EC8554912D6B27C694BB0C60F03B8362B1F737A15D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 6d30c2a134b8b276e2a29c0287a2b16929a854edd5714321e6887ec6980c52d2
MD5 5816452ecc2dd9edf421e395228fdd6d
SHA1 f45a73267a210bbfaefdbc0a70faac03f5479e47
SHA512 2ad9d0e00aea5395134f109e8465c73852217796d32c1a243599dede41dbc51b61f4981e27e8c568c02d68b3c5efdfc40dac0035d8384a39c61f06ef07979966
SSDEEP 12288:PV7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:PVkhtpPvUSnvF5OVvJIWq9
TLSH
T11FC4235FB3932296C144613E808E1DE29C151C75FADED20F485CB03E1DFAFAAD6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 447a7113e4b606b5695de731635fb1cb6b68539c791e56f88ee3d3a4d811a9fd
MD5 09281ba982b0aa8748ecba9d364f5742
SHA1 7f2932447301550cb3bb6ba9fb9a180de94cc53e
SHA512 f7e43713d6f67eda998166d8b939948a92711f17e300c99f7065f15f04c1302ad6756755b2ffe5aa7c7675dadb633af1fc72ab34e3a462425be9800371998087
SSDEEP 12288:5B7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:5BkhtpPvUSnvF5OVvJIWq9
TLSH
T104C4235FB3932296C144613E808E1DE29C141C75F9DED20F096CB03E1DFAFAAD6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 d874f5d2dc5bacba641d6234ac9f7b4092d49c6fbf607018bbe5ee97fe6032c2
MD5 6d795a1f4fd119cf63377ceb0259dffe
SHA1 f98fda51beeca1d4dc10087e516bbf0af7a10c78
SHA512 4ff4ed588da114dee0b992d2c69c441b2c5ed54c77d943376edb556002a01287cfc9bbd3bb132e22836d622cd26b95ee30b3cf6fd90881fdf59a767bd491f9e5
SSDEEP 12288:cyPz5L8m7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:FzymkhtpPvUSnvF5OVvJIWq9
TLSH
T11FF4121B73A230F9C1669239C4960A52F7317C324B64CB9F0764523A1E77BE1DE3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 813308513db2ed79afdebb0198bcacab531d8f814151f93f73b7f706283eeeac
MD5 d8408828c1b592a7efd1ea6bb7e30b3c
SHA1 e7ae51ecc2d0743239f8babeda016ed183398511
SHA512 5e9e91310ea1f5cc704255570f6dd4de270e0d8ba1f3900a1e35aac52385ad2640fde9d87f7415becabf1f1d6f7af87d19627c961b8d20f3a150e516f2b4c49c
SSDEEP 12288:gV7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:gVkhtpPvUSnvF5OVvJIWq9
TLSH
T1D9C4235FB3932296C144613E808E1EE29C151C75FADEC20F485CB03D5DFAFAAD6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 bae0d9310e7ba87359c91587b4532567b7e10bbc4450e2ebba7da4bfa511d019
MD5 22612702a4e445ba7edb008f4dd55ba9
SHA1 490c8f3270619b352a826a51bd82eca883c3d78e
SHA512 b110711aeb4dc508a329f7e276433eb2705a1588baea73dcfe64235f1410d56ebed91eb84edda5f4f184709ab7cdbc615d2a32895a3354ff2e9b8088a58ac33a
SSDEEP 12288:SV7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:SVkhtpPvUSnvF5OVvJIWq9
TLSH
T1AAC4235FB3932296C144613E808E1EE29C151C75FADED20F485CB03D1DFAFAAD6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 d81500e815298f24c83050b17e12f1a80c8feb05eeaf2c7a766b8708b706706b
MD5 d4bed6e16515736d8016ef32bc00b7e7
SHA1 961c0f8ec0d98d062dd9fb795412a886e050b56d
SHA512 51c5dba99dcba11a33707edeebd2a9fed8283cfbdf6e5ebf465b389a6888c9d02e4960627285a4d81828ef0c352975261361cb3bae4de3f17eee70d44d4ff291
SSDEEP 12288:tyPz5L8m7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:EzymkhtpPvUSnvF5OVvJIWq9
TLSH
T17EF4121B73A230F9C1669239C4960A52F7717C318B64CB9F0764523A1E77BE1DE3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 ce465e6a99a10e8ed4629d37519c4d0ce9fdafb94db9bd8a6a3f8afbb1a74e84
MD5 a16acdec6d63da4c5254cc290a6ace2a
SHA1 3b48d7cb99214ae2001ce1ea64fc8d2696a6a902
SHA512 0279825b75ad5ba2816e823e76a0de8d3ad0cf8ffea27fa1a8f35d2f1630bc532698548169c93f99d40111a536cfa8df0f27051652715fa3a57a7fd3d79adb49
SSDEEP 24576:5TDaLl3z0zDEkhtpPvUSnvF5OVvJIWq9:5TuLljXk3pU8vCaWq
TLSH
T1630502A9B39018F8DC67813EC8554912D6B27C2A4B70C61F03B8362B5F737A15D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c70f12fac72fb2517f3763186a58333abc81d0a5b190d595e63eda2149568e14
MD5 44250c53750a340f0f86be96fd266789
SHA1 45a466bab49b8da08981c1fe41b9be7d4c26fec5
SHA512 5a99cbe50b86b522bd00e43c7b4d922b8f94c61b1d010f522c7490357f3af39d804b20dc3274d967885636631af87ba222d7f6ffcf510486f4d8abf6aa853c06
SSDEEP 24576:u3vd9CHKy7GZYkhtpPvUSnvF5OVvJIWq9:wvd9CHKyaOk3pU8vCaWq
TLSH
T11725CF91F3E410E8F0B79A35C9764512DA767C695B71CA8F03A8252A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 eb9bfe97261ac9a8120f3dcc7abf71cf972c9412cf0eee05f7b391583fc3df4f
MD5 7163dfc66ef90a02d86fb26ae464106a
SHA1 c7a459a0f2e6f9a2a07781522e3773313a6e44a8
SHA512 d36d843e705e3e454d991e07415bb52fc22e6653cc98015e1ae73fabcefe0f4feac10b80a82baabe4de538f343b4bf8378c6f91f6104c3f89fd63a01dd09552b
SSDEEP 12288:dU7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:dUkhtpPvUSnvF5OVvJIWq9
TLSH
T191C4235FB7932296C144617E808E1AE398111C75FADEC20F485CB03E1DFAFA9D6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 0212949946e2624d80b95cd06b7e997f08e2404c0e781aec31ed826dc234a2be
MD5 8ae9ded09b4741148cbeaf24d8ed309e
SHA1 77aa04ff0ede615f77322e5d211bacd30a6e091a
SHA512 7f5eaddb42e0dd4c4402ec70047b15c7b4072af9e18553dfe9d4467d541144f427ebdde84da0a16b37270051fa6a8c48d1989ab1bb03d16c667040de2aa43302
SSDEEP 12288:yG7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:yGkhtpPvUSnvF5OVvJIWq9
TLSH
T1C2C4235FB7932296C158617E80DE0EE398111C71F9DEC20E095C703E1DFAFAAD6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c5b64fe0b96d69f1b6fe28cfeff40376235ca354bc51c21a9fd659ea4a47a178
MD5 a2715a7a70c881e7a2cbea9ea6e19d2d
SHA1 fbdbb27fbc15f7e365f40d6c5865e7183b702017
SHA512 a36a134dd157b83103f486b60e48d37fecf8cbfafc1a7d51c8790c0d8d418b7755f215fd3002c9e27fd41d0ed14fe5d2d34340361f8aff64f5f1eec9c71d804b
SSDEEP 12288:rv7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:rvkhtpPvUSnvF5OVvJIWq9
TLSH
T130C4235FB3932296C144613E808E1EE29C151C75FADED20F485CB03E1DFAFA9D6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 3cbbf7beddeaf0443747cd3012c80fb987cbda48a72f92a40f598a681753369c
MD5 47ce4d7f1359afc87e56230d902567ec
SHA1 894b057e7c758bb073b3aef152ee5dcdeacde526
SHA512 141718a6ca1e40575d8a4355e78116b17bf3c65c5e1750c406ff240ee07c42774720798410e5200eaeaa3087f56ea9e412fd42defaa3f7131a5ba9f70fc2f964
SSDEEP 12288:7V7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:7VkhtpPvUSnvF5OVvJIWq9
TLSH
T1DFC4235FB3932296C144613E808E1EE29C151C75FADED20F486CB03D1DFAFA9D6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 5957570fbbc07d05ac9ae7b4472dff96e2f97d9455d394617a74cd6d587175c1
MD5 ca2ff7d9eff22432f6826cc8da5dfc77
SHA1 3ce668e8167ac4ba951f765d2836135f37f66399
SHA512 8b369c673fa3c529a20d9538428c53588bd8c02c82f8a74a1ce2aa1f63116382d4ae23d651515c4c081224c18bbf9dfc3d58ed45cf2e930d9889aa3577774512
SSDEEP 12288:TU7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:TUkhtpPvUSnvF5OVvJIWq9
TLSH
T121C4235FB7932297C144613E808E1AE398111C75FADEC20F495CB03E1DFAFA9D6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 db288b7c6c53e7aa090ef5570c83267c8a244360412e466afda26aa9085df99f
MD5 98e188194b62ad4dc0bdd494b19fe33d
SHA1 4b1160e2c4b6c97af61e3612cb774943efa3d120
SHA512 6b709623662519c478a17316dfc4ec7117c846cabc3b3f0578682ab5c264704d59d4cf5f2f235f3912d188755d75218f6bf9ab5dded0cf6df42d994e6e1ab09b
SSDEEP 12288:KN7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:KNkhtpPvUSnvF5OVvJIWq9
TLSH
T17BC4235FB7932296C144617A808E19E39C141C75F9DEC20F096CB03E1DFAFAAD5A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 75cd06763f77a9f273c6a144cb790c31e3d922fbb39918785c6980d3851c2e78
MD5 2efdd46f9e13706e9127e6db36274cf5
SHA1 dae35cb5cd2d8d515cf07d7ffd10c14fbe33bf97
SHA512 b22f35e6ab4392dfbf2d14c07364c539f322a4f4dd87a9f58ec4db0673bb0a4f9cf3d2fdc3b6c385d807f1911a7f4afcc9f12151ab142c8e9f3230229148053e
SSDEEP 12288:X77I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:X7khtpPvUSnvF5OVvJIWq9
TLSH
T1E8C4235FB7932296C144613A808E1AE39C151C75FADEC20F485CB03E1DFAFA9D6B521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 93ada802c61f2609e27818722edf89f70f6ae1045d673b30eabf3b0d6e49c670
MD5 8b1799ab44c67b803f3009845f6a0bc1
SHA1 f99906e84d690d4df8342921646aca816d40ae7c
SHA512 9519748c4a1fc64419882986e78da64f0af38a6e391f83ccd2724d66abdab0b11cff346812295f11790e100ba947b1561f6d1a3b6c303da4b07506050ad96136
SSDEEP 12288:Nc7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:NckhtpPvUSnvF5OVvJIWq9
TLSH
T147C4235FB7932296C144A17A808E0DE39C141C75F9DEC20F495CB03E1DFAFAAD6A521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 1d40c3f2ac0d2b3d9e08ed3ef6fa8d9eae2bd6b5182530fdf086af3d3c222874
MD5 14447b3144546b47854f00644d1a56e9
SHA1 0ee99b0a4d7093dcd2323f1ddeb765b6b8c1448b
SHA512 024440347f8c3be4e51fc6518ae63a0edb699624fbda3f07fda8a6ab6a57cfab2e57581fafff797aeda267bcc6be51f5968c04e30156bd18f5aec8dc04b8ba9c
SSDEEP 12288:B77I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:B7khtpPvUSnvF5OVvJIWq9
TLSH
T192C4235FB7932296C144613A808E1AE39C151C75FADEC20F485CB03E1DFAFA9D6B521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 0a4bd4f78557a798ea00287a2fbe8064c094a0298e3e5ebf7a6b33d139836c53
MD5 80d429d37cc22264bcbc692ec85e8f0f
SHA1 a4bd82821809263e02d4ea1cc823400fc1352448
SHA512 6dfad7ebd51f094c34912a972a8fbacd59ab7c227ed6695a9811b95c68950c81c0aea182d4be73a7bf837f9f0f72ab5530b55be0042deea269be231030c0beda
SSDEEP 24576:MfwvUk9RX6wkyAIxkhtpPvUSnvF5OVvJIWq9:oMnYIxk3pU8vCaWq
TLSH
T1A035D02EEBD804E5E1B7923C89B74606F6B178695B31C2CF025A536D0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7406b10eb631022480f13ce3d74203768bf680f75c75798347895980f924bd39
MD5 86c186a18b46a93b1d6aa621b133afdd
SHA1 800dafe757fa50cff4315fd883cfcd143c3610e0
SHA512 255faddf62db80ed896f204ac25af0ca06a6512784afefa831abb49af795c9b6b3066197fad9b58bd9b63643e0431eb2b8bb007eace387d6bf333d1b7ab4d883
SSDEEP 49152:mYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wk3pU8vCaWq:lySzPV6ap
TLSH
T148066C97A1A801D5C1B9C1B98B1BCC17FB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 499b3b0be9278f10fc99e01a3a4f1484731730e86e8709ab40a59ec0fbed4ecc
MD5 9962db6376122b70c40ab97f6bdbd06f
SHA1 b0e111438f516fd9f58753c721fc033015af2476
SHA512 05119c409d0989e0887bfb6025402e82bd748b619667c8a5c986f19310e70c6c26b80698b9af14876c8af4bd4fb09ff26b3a2aa8c278d838171441840d2407a6
SSDEEP 24576:k47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYakhtpPvUSnvF5OVvJIWq9:k47JUQjTirIhCnDHUPfF/gk3pU8vCaWq
TLSH
T1DC65AE1EA3EC01E5E1BA923885154A5AEA71782D5F31CACF1270837D6F63ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 037bb81f8f445f16fce8126d89952385a951d96b8fcc0cedd69255d11d7db1f9
MD5 b618941e2bd1510ea567bfe8e03f5f82
SHA1 305b8af23236f7d9ade78da4d3c9ba378b10c1a7
SHA512 1015413bdf73c5cf8fa61a3b591c74454b830f69000441eb04432ed1cce69e1b3e42b54c4c65265dbe5be89449622d64063688618eb647dba04adc271e54cbfe
SSDEEP 12288:Gbsfl7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:tlkhtpPvUSnvF5OVvJIWq9
TLSH
T10BE4F01AD39512E8C06E6239C7560A81B7333C2597E1D3CB16D0F53E1FB6A949EEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 fb2d90db9ae5981e7a7ad236c1b7a0b1420c83fe0d3aaea7c0184cff7a2268eb
MD5 26fea6cd0006c292f3056d35d37e2006
SHA1 c9d9ad2d8b66079e9d33cf19446b9d81ba89ff18
SHA512 80510f5125799589ca5b7f569ae817a9162a5bd14b68d80df3a3cbb071f456d9282723d49929ce13f874a541e6705751b23e7aaa2653ab02e29ed3825e65949e
SSDEEP 24576:tuP9LUPl8/iJ3ZMgGTjxm7iks8jzi8vJ7:oLUNz38xOQ8j28v
TLSH
T1634506007626DB8FC6A940325E36D6CCA7707D02EE046F1773C9973F9476659BAE2382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 f20bc433f606c9b81356f9bc3fa710e9f246d8aec39953e16ae9ccc5c1482eb5
MD5 c416fb70627ad654f7f2afa591c9e5a5
SHA1 52adafbc4ced07477df8b02247ddf6770c66ee18
SHA512 24f588a1252676fc08488e93a8043e5fe12b8444b907183387975d6b87b9163e96441beded2a66801347005296b3a3528f8b5cab9f7dda384b31079fd3900ea1
SSDEEP 96:45mUZyKll/hgLX11S2cSGtIVEIVEIVuUZyKlleYxtIVEIVEIVL2cSGtIVEIVEIVZ:sVIKll/SLl1S2bGqIKlleIe2bGqIKllJ
TLSH
T18D72CA4AF770E613E4F7623688DAE39C7B35ECDE6E4403037244229DDD196411FAE690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 3fe6f6c24b916f91816524e5da38912dfced72d659224428ba331d046e8cca08
MD5 fae615e4d4e6f2bd0ea4005286a4d48c
SHA1 6700b501faa1a6cc3521d7d5e4af1362c6c106aa
SHA512 65cedb4ef63480d53c4cb199ab1ac21f9014371065024420854097539b31a21fa9b722c91358d103eb5af78a1f564e5bb5108dd621fdf1aff781b836d59bb501
SSDEEP 12288:tSUnhfuAOVG0Jl/POm3JKSQWDk7U991nTbyDhp3AfGIKXWZENUVQe:tSUnFkPOm3JKhm02nTbAGGJmZEmVQe
TLSH
T13F55180065B7EB4FC9BA9037463296CEAB746C02FB453F0573458838986B95FB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 03b6b13a26ac0130e61e1044b6ac6cac515fe6d55a6139c5b63c6128f1a29e39
MD5 5a9bef7c53edf8c5e8902ee2203ddfb3
SHA1 334d790a615d7650ae3e487609d533d600988a99
SHA512 4de211808c0907cb4b8b4638b1fbdc05e93fa4147f98412aee879bc339b85e64ebebe3767425bf2653e6bb7ca50a0ce75f688c95e0d6dc699f22ca6b178370a0
SSDEEP 12288:YM7d7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:5dkhtpPvUSnvF5OVvJIWq9
TLSH
T122D4232BA3932256D4A86139409E09B2691A3C70DF99C1CF5818B13E1CF6FD9DEB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 77a69f0c9a8a3e6fb812ff9c390f1fbe5c66257527c0d44db8f82b65ee7e55aa
MD5 cc4831f77ff5b5480fc1815a733f8c4d
SHA1 05decee0047aaf370964c31d0ef08a0e65d9f9c5
SHA512 f5ba81e00b3f1ebd01f82e06652bbf7ac761bbf2c34b9da81061a5d0cfecb0f91cd1d6487ff2d785b158cb0ed507fd719c19954b05eef2e2da8c9f84bf28418a
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYXkhtpPvUSnvF5OVvJIWq9:Rgb4mBIBhGFak3pU8vCaWq
TLSH
T19665AE1E22E802F5E0F9E2B8CDAA4417D6B278165731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 eb8cc61815ec2822490e116f2907a594ae2aed8d9dc309e6089b32aa35e38c5c
MD5 e7d1a1fc3475874e18a6d3fe42ba98e2
SHA1 f79ef7cf283dc82247966b887c67a194dd65a2c5
SHA512 63ba5ec2728d15ba6c6e3162a77151a5e1c244e31335f0fa148762e0f7d551d19e298922bc8fda042aa6205afc1f46b83d75912eeaa3d11b5f3b2e171d588fb7
SSDEEP 24576:dG88u8FpJqH1bzria7/mqkhtpPvUSnvF5OVvJIWq9:w7ZFPqVea7/Pk3pU8vCaWq
TLSH
T12535016677E101F0D47BD13889860663F6B2B8210364EBDF06AC8A551F33BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 2325734de1e8c10b318705534ad8905f5b167aebaecda8cdb29302c923d00824
MD5 01c07aa8236d5d340a7a1ed8037bcb49
SHA1 83ef34cc14e524b64bb6c1334e322cca5235297a
SHA512 854094d804a59b3916cd1d14d0f9867846b60227ee701fc59559d28e35b4b338401ffbe6a0f04b10562116f65d41d56e8438c93cf4515e129d6b5ca48c6b6830
SSDEEP 12288:aHvUrBFrEjwaQO7I506nCnOpPgMUEVzySVvF5GlT3F7jsXCIst1ny32O:aPUr+NQOkhtpPvUSnvF5OVvJIWq9
TLSH
T1E305F12F23A918E5E67AE17D85864719F77178621712D2CF02E0817E0E77EE8BD3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 95cb927fbbddfc3a3a981cec12b7d7b3c45f366fb290f24ba1db3c2da6396dbf
MD5 2fde3c1d16c86d26ce38d58f7982208c
SHA1 40c350672f8bf479137d9141c5d0e2d608cc4655
SHA512 b7fdda905ee04481894fcc113e71033d6aeabcafc7448bd4238bfb5e8e4486d351ecb25d49513cdd43fa24e340a2bc79acabeb43d7c2a1c9fbe2225f6aa8700e
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjek3pU8vCaWq:YG05lO43b06ap
TLSH
T17DD5BF6E62EC11F9D1BBD17CC9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1fcbd7e1782a07633bb368fed6bf596b9dc805464697e5a0612312039a5bea71
MD5 112b439d0215459afc7f8d81cb1d18af
SHA1 e829ca5669c134fdd166f9a79daeb3c0669fc05f
SHA512 4577f927c9b82b68685b1bb3c0c86f439c0da4499d565504c7611e4c031644bab25acca744e75de59e7bfa8cd7dd79afc28850638e325db90821a0a8c1d22e6b
SSDEEP 24576:efa5POZ3dpuWVM50JicR2hG0lasx2+47eidnwkhtpPvUSnvF5OVvJIWq9:Ga5POZ3BJt2pasx2+mGk3pU8vCaWq
TLSH
T1AF65AF5EA7F801D5D5B9D17DC5834A1AE5B1342153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ba3cfa8df3fd3442d1531541d77c2ba85c01b04b4117bf391ce7cffb221ccb49
MD5 c624fb2923e441c79db3d2dfa6a99756
SHA1 ecede9f37619de1e02ee31ea331f4934bbb0153b
SHA512 5d94ba03e51729bc7cc0eda5ce846e1aa6e2250b9edb1d2558478b1992535dd3d406a6ac06e623f7bdd9e40fab876efedf8ee58fdfee9187bebaa1c63db7891d
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkSkhtpPvUSnvF5OVvJIWq9:fNc/zEOVHFvk3pU8vCaWq
TLSH
T110858C2623E901E4E1BBE1BE89779946FA717865533486CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f079e3a4ce7ad4b56eb58034cc426944eee366a62983fe3ed5e378abdf9d51d3
MD5 dc8127ed5d99bd8a34beb29c76e519da
SHA1 aa7d78c8df406f787b93ab87a68f47798e430862
SHA512 cb3ca96ca70d805a358824b596b5f4dad0991a5e5de69898ff42b47aea746981204ed1653709c2636f81f25419d5f313dc74f41df55ef7b45376ec29bc9d86bf
SSDEEP 24576:iTkNvNnaFeYhJNtmZBmckhtpPvUSnvF5OVvJIWq9:iTMwBtOmck3pU8vCaWq
TLSH
T1C655AF2EB7B806E4D1FEC6B5CD238512EA727861173293CB5290C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 d0675212653693e910d1af40dcd12c06c658a67759a4e0bd81443a5f24c595a9
MD5 8e134f90b9f2225685ad898661764b36
SHA1 9d60a2e1d6587b6d7db85199eae2b9301e27f891
SHA512 a556a7851134bd9bf0ac8f6819758da5d2d2ad2bc6373d7f1b3d4e1231c0eadeaacced8f6d5bda94b5708c832f9f7a3784728cc8a0ca4b84753934a1f6d93afb
SSDEEP 24576:uD3FHshBIYQgA5khtpPvUSnvF5OVvJIWq9:uDVHeBIAA5k3pU8vCaWq
TLSH
T11625E17EE79900E4D57AD1BCC6634A02E77138B9032266CB06D4D1BA1F7BEE46D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1688-169-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1688-176-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1688-444-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1688-442-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1688-175-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1852-348-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1852-123-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1852-129-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1852-122-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1916-183-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1916-189-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1916-181-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1916-445-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2040-218-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2040-446-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2040-212-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2040-211-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2164-377-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2164-133-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2164-141-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2164-135-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2936-145-0x0000000000400000-0x0000000000573000-memory.dmp

Download

memory/2936-390-0x0000000000400000-0x0000000000573000-memory.dmp

Download

memory/2936-1-0x0000000002470000-0x00000000024D6000-memory.dmp

Download

memory/2936-0-0x0000000000400000-0x0000000000573000-memory.dmp

Download

memory/2936-6-0x0000000002470000-0x00000000024D6000-memory.dmp

Download

memory/2936-7-0x0000000002470000-0x00000000024D6000-memory.dmp

Download

memory/4172-95-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4172-193-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4172-96-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4172-104-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4240-201-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4240-207-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4240-195-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4240-194-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4240-205-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4484-457-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4484-156-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4484-459-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4484-157-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4484-163-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4484-395-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4568-120-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4568-118-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4568-114-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4568-107-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4996-46-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4996-47-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4996-40-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4996-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4996-168-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5604-146-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5604-152-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/5604-147-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/5604-387-0x0000000000400000-0x0000000000497000-memory.dmp

Download