6246012937eefd58f588311a8e5048e9454787fe9ec7ab7f56057a87664c0f7f

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
Size 1.2MB
Sample260706-ngc7eaas9m
SHA256 6246012937eefd58f588311a8e5048e9454787fe9ec7ab7f56057a87664c0f7f
MD5 af2b9572ad82348c4f48b7a140a76827
SHA1 ce5acd7581ed0d461f2884c23c70132015d9aa54
SHA512 12fb064211b06fed7c09b24fbf8006cc222b4ef8d30cbfd0035383184e4b556299ca2b0407e1e019f29a4489ba69ff0c89051c287210a8e0f2f0bca2fc9ca982
SSDEEP 12288:9QXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:9L743TvRk6NwG
TLSH
T17255120533E504C8F573AE3AC8A14691882AFE615F51EECF87A4620E1D786D4DE39F39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1408	elevation_service.exe
3384	elevation_service.exe
2984	maintenanceservice.exe
2496	OSE.EXE
6096	PerceptionSimulationService.exe
5384	perfhost.exe
4140	ReFsDedupSvc.exe
2380	SensorDataService.exe
1984	ssh-agent.exe
4904	AgentService.exe
1168	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\659c2c1443a2495a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104109\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000908d2bad390ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052e19cec390ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d040ecae390ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093a01cae390ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8ba04ae390ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cec30eaf390ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4240	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
Token: SeAssignPrimaryTokenPrivilege	4904	AgentService.exe
Token: SeBackupPrivilege	4140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4140	ReFsDedupSvc.exe
Token: 33	1168	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeDebugPrivilege	1408	elevation_service.exe
Token: SeDebugPrivilege	3384	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4240	2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 5812	1168	SearchIndexer.exe	99
PID 1168 wrote to memory of 4092	1168	SearchIndexer.exe	100
PID 1168 wrote to memory of 924	1168	SearchIndexer.exe	101
PID 1168 wrote to memory of 2756	1168	SearchIndexer.exe	102
PID 1168 wrote to memory of 4896	1168	SearchIndexer.exe	104
PID 1168 wrote to memory of 5728	1168	SearchIndexer.exe	105
PID 1168 wrote to memory of 3728	1168	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2984

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2496

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6096

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5384

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4140

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1984

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5812
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2876 2872 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2864 2916 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2864 2916 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2876 2872 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4fac0b5bbdc86c3f70ea2259b53bcd1c1a601b8afc913930f33a16152a773948
MD5 41453d072c3bc1531d98ca53e1c04037
SHA1 8e18b66c5c6d509f29b0c1e22ecc69e89b6b6686
SHA512 f0fa5f2fd2ca816361c964e75f402290dc5d0ca1184f489b3b12a91c15cb9620b4819f47b56dffd4d651727ec3b3f457911978e7615ca93280cdacd463c484d6
SSDEEP 49152:4b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnaDv66mG:S3q6sjBhDv6V
TLSH
T1F3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 aa63a26bdf4827fc7116d039a1b4c20629092349d0c4aef2ddbf74dbe407016c
MD5 645093e404c1b622255b212a040341d7
SHA1 a4b2bee50c788a2bac1b4501f5af1742fc62562d
SHA512 df3c79b3e8bc099bcbabc522ba13369d8ee06d735eb6a496b4c9257fde368b305442db8afd3ee01dd984ad74f7814d1f9d1d71eaf0cfaded9e0812be1aa3f236
SSDEEP 12288:g1XLsswWkxy2lRq2czAXXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:2XYfDtczAo743TvRk6NwG
TLSH
T13765F12873E408FDED77827DC8A28512E673B85547A0EBCF03A499651F232D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ad666186b8bff87d6731e846bde27ef7cb26b22e7928de125aa44287eb689ed9
MD5 7b80a46c8a4069f5a33990b49e83f00f
SHA1 8bb56f32477a318b730d6915f3d07fa7b60934d4
SHA512 8848fa5212cb36550f5961bf808357b631e0d1bec21714ba3880b9bcaa7f962cd432a41f97003b670c36c680b298a72cdb335ff55007c9171831e4ec812b6e45
SSDEEP 12288:aXZNYVLeyUji0h90ZD0wxpGZIVuCrHsuXI7vgbrWVQhTCYHvRktx/aICF9flefu2:O0Le5ji0hmxxrM5743TvRk6NwG
TLSH
T11F85AE16F6748335D073C0B9C5D2A68EE97230865B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c8e7b9cbf99bc719fd3c6a2e1b7a2e65f7fd9ce5b6fa338c11fbeada30699a1e
MD5 d5c47b6ca17d8e1d8d14dceaa29c04a5
SHA1 e9b122f3f4b1bc6a9c85631266cb2cf0b4172b82
SHA512 29ed4387e896d5593fca9d92babbb4b86e17445ff8d599da5b039328dc66395389407b889df7551487af199a560bbdeaeeb5d64e457498346408283bc3ae744d
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWn6q8wyuD743TvRk6NwG:R/ezSC6vUzPveHjybDv66mG
TLSH
T1FE755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c918efe02eb1c33ccb7d10a80389bf7a0685b278ab4872a7b4eb4f96562564df
MD5 04cd5a3d6424a2c804543a4d9261d8bc
SHA1 44db34840a6937e4280adad2ce6e48178938918f
SHA512 36b3b9f94eb584ca96ed338b039ef4a61d8c0d300d811d7d410da85ce27ce9437614aa9c84470dcc347e8602db289fae861df116a2a26936436de32f8accbdde
SSDEEP 12288:MVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98rXI7vgbrWVQhTCYHvRktx/aICFu:MVbqPb88hv/l+Yc743TvRk6NwG
TLSH
T173559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 877fc18ebd2898a59d4932be2b774f1c64f8a1534a38d9031ecea0232ccb189b
MD5 0124d75ab84c7404bf2a42ff1810d784
SHA1 eee6d4a0df08570803351c6804251260cfa1024f
SHA512 df8ba515585f838525d991ce3a46666e0af8eea8cd698d9ef75eb393b54324008d815e060b97dbcce2ecf2df2f77753032a93b306f10373f4ed4280af720b2d5
SSDEEP 12288:GLSXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:GLd743TvRk6NwG
TLSH
T1884523087394010DE7B3BDBAE889E0C390A3BF6499C59CCEC669FDA558BC1D0E75570A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a889544611716c478eeb3b1511d88259bacdd25efe7ab42d7e228e9568348132
MD5 074277320b71cce2e1ac7f2e1596582d
SHA1 63b1ef6876ffc93b02d5c1616a528683bf5e11bc
SHA512 6200c4c352376a60f465f94623cda125df26628d5590e078a38830a54be226d117554ddf2ba0ee38f5f9c4c0d3c599e7331f3a331f2aed70cd08a3bcaf82f52c
SSDEEP 12288:KeBNUbTVO86UjXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:KJIUk743TvRk6NwG
TLSH
T10965CF3BEE28ECD2C27A9DB95A91C240D77278304F52A3CBD165C20EDE235E05E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0cb0600370f30b8e780471752fc6c08a905044c2b96c90cc1707103a69f05580
MD5 9363250de3f4ce3a6946a8df0f4c9ebc
SHA1 dc33ac01dcf06bc217ebeb0d1041877666a98302
SHA512 64278b6e83fa360bd0e02c62ac3219fc463327b9113b811f643b279e225cce06861e882d2d758d7ba71dc94b7bc3f383a9e1f5ba2beac02b3be065ea4b2a3ba1
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THp:0QvGAdlCEL8c/DRNw5CoDv6V
TLSH
T171266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6c9b41b67ca7a347205dc865770a9c3dcde95ae6e83aa76853dddaaa32540f54
MD5 43a43fe58d7b494f300134e024a939a1
SHA1 a17d208e152265248a140b1e24cd76b4d6f7eb2d
SHA512 4c0cbba4b0f99285a61a95a9674b4de68ce39f42e048fb45e847151e7fb1201f955c2fa5f2250c6eb425d512c3d4f28dcb638497bce480a796987ee5a7f6dc45
SSDEEP 12288:9AwSfxL/2Dc3RDLLmt0LDQewsAjNXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0Q:u0ewsAjW743TvRk6NwG
TLSH
T10375E030FB74D036C3BB0DB61B26C716546DBA204B9119C3E3A89E9E59742D22376F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 08e5bde54330e76aabb8752acddb99bb7342b103babea3c958859990be4523d0
MD5 2303cae794a1851705c0da2b9ba46c2c
SHA1 780234c0fc91f4888de814e3dea8ec0e8ad45d1e
SHA512 626b4f83390c4bbb24c5e8042c14e2019ae115e35abb6e6d4091c3a94b5456d9f059a21908c40f47a7d7a253e4810af38864b1af4d893cd8440a5674890b3784
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHvD6:qUEtQevvqc2W1cpV2tI32
TLSH
T169474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 48462b41bf355f67349a58f984fab9987965fa638d86a2094d72bc952e627956
MD5 9eeac3af90c213144c4cd61901f88802
SHA1 60bf4b98f0b2d6662864cf870d082d1de9458820
SHA512 02662d8b72cfbecd0f4325bbd1a385a025812d618bc699a865689e9c22a2ff9233a1f733985f5151752ea0bcad6f78ea1886f3e97c4c471fa532358e0d89c88b
SSDEEP 49152:ICbRquA/m2yL5zifFiV+XenmE3/z3Dv66mG:hoqHVjnmMDv6V
TLSH
T1D6D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 863956d9389a30448431fda4691f83f6317c24639df2fb09173d7cbaec01e6c3
MD5 4021972231c16313b07169ae6b5d8637
SHA1 9f94b540285e6d17d042332201bc7f88ee6ebe2a
SHA512 b51831552be07270f3305edfd239ab9c8594124b99245c3bfa2b445cd3be1e24249dbb64bb2f877feb6732df592344c6fea17946f6da0538fdd388487bb7a9ea
SSDEEP 12288:4AZ/GL3IFoiwtA5qy97S9uaYFLq3OfXI7vgbrWVQhTCYHvRktx/aICF9flefuKaM:4AhGL3IFoiwtA5l7S53f743TvRk6NwG
TLSH
T129359D80E7F945D4F5F3AAB899B69171EA76BCA65E31C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d3b2ca3921f0ba73719074b3b56f29e3fc2cc9d76bd7b3e090e888cc6f5faf9a
MD5 e45b494f2c2c9331c7c16c4c78f64f4a
SHA1 0fd5e52b604d19f595da43b415466c12ccef5b13
SHA512 0963b22915426ac5f17b4220fe48b22fd54d44e5017b2784a231f32a55d832a525df7cdd4074da9b1860eda57c349dda9e55525c82c3a05bf921bf85ec8a0878
SSDEEP 12288:lmw5HEjsChNVBFgl0WDm+CYXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Awu4OWi743TvRk6NwG
TLSH
T11065F14973A40CF9E9B39639C597C132E7F2B8112A61DB1F1760C65B5F37260AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 dcd7660730cb14534430f6fac82c3cb2c34d7d1ccf6a79381902d45b54d1d4f1
MD5 e5de8bcb29dce58cf7dc0e14186838a7
SHA1 1a0b94b5bfaf75dfcdc1428b6584a590b07d4d33
SHA512 be7c02f07f905dd1c60ad9660bd84e5182db41cd2d411b79b77447f3437de7b42827f403a10dbcf8e17cc65803d4daaa7e22dfeec315f49d9fe6769c400bb1ed
SSDEEP 12288:KeZ1IydXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:HZuh743TvRk6NwG
TLSH
T1D555234933E410FDE2B3A67DCCE59282D3B37862677287CF126886651F766C05E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 131328c995ba8d4c18fac23b83117f8ad19228c833e246551ed27ed194057e80
MD5 52d5b3d9e82198af01ed4685aba61934
SHA1 f6814a838e0ef17095521cf714917742322e15b8
SHA512 f76a317c565bba4f79a7e4529fd05a659e58bd7a2a242b167ffca342f2272ed51aedc4942056456b11b7242f6b5ddda8b0fc97ff7ddc518dc09c482da6f01e08
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ut:/QRQyi36YOcPbLvw2gAf+PN3NDv6V
TLSH
T1A5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0deaf4c1e199cd236e37b464a9e737d2bcf2f84376f629a1cb3a515e2ce4d259
MD5 29e4d91b6e91b6a6ff825c1d54e0c451
SHA1 c340d9bab404de0dae39a288ec3257e7c968ab3e
SHA512 01a7d0e46027a8e88932d8ed54604719277cdb0a84f45029f76dbfff0dde7f2e7ad4087448bf868745a1c7ec67d63ff4e63f6ac25a0bd5f58232f4a6e8f34f2e
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ut:RQRQyi36YOcPbLvw2gAf+PN3NDv6V
TLSH
T185667C03F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 09c818febbd690a04f1d62390ca7bb77a61f27af2dde791d50486d6d19e8e69a
MD5 706bbf14748e7a1c6f6a1f596d61c8b2
SHA1 da96e2394329716e8c756e36cd4115e80673e24b
SHA512 fd6a1b1c409b638893eb7ace9e697f39ac73f45392bc2370121ab84e86f0e849a04d1aef53e62032acecd5a5d9fc1153289e7632b99fa6c3347442ef92964d41
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0x743TvRk6NwG:N68Qg55nhceWu7PNU3/nDv66mG
TLSH
T1B1B55933B2F200A9C45DE1769F4A873196D27C758FE0E7DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 268abb8a4635702f7ba52fc2bbee165b3aa7db7ecc7bdfbb3d867cb6900f6252
MD5 f443a26fe626b6f2bc110b9ef04d6a94
SHA1 3a61b44952049614796dfdc3ecf80d4358644513
SHA512 1472c956bfa7c3e4fa6b3ed553501bc456771bb18830989a3279ff1bfb64e675dc11919aa895807a9c0e1bfa8bd80f31102824340d0d8303476cbd7b3526eb13
SSDEEP 49152:b3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99L:+y5112gYy5azzVvt69nLKnhZeDv6V
TLSH
T112167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1ea1d2ecc5a2793796e31ba948e8710e138a81525a14adcb442d88f08f4707f3
MD5 a3e39a3eb435d06d575a7270650b472b
SHA1 bc43fcadba6cd44814b6309b38f9d49e8567a384
SHA512 7977c1d4ae0d7044d57d49d447ecd33a5b81866e7bdd2696822443fab8b7c55d46a1d23560f3fc9546ec2ae6b26e73c581119f69dff933fd54c5bca4eea4ff9c
SSDEEP 49152:8B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glVDv66mG:Wu6Jmdxd2dVDv6V
TLSH
T18CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4aed194af66294759f8ec3cffb8c1bd3f7ac186386e92d5532b8ac36d87d9983
MD5 ade050d81b51db7091dde567aa93dad1
SHA1 6e925376d0c577fbe222796bcbf27d0dc6ca6bf3
SHA512 c96560d471d8e4ee33bd49d0692676775bf1f408fec0fa2d84f2ac4ba8b814ea8119ce34db9d131af7d64d9346846bc94ab1975dbd7b794129ffa769eeb1468c
SSDEEP 24576:hhv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx30743TvRk6NwG:T1hpsNoJpF1A63U44CwH7R4x5Dv66mG
TLSH
T137B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b1330efb629c5f50b5a340f7d388c171306c323b17077a3edd1d53ed9881be11
MD5 4d7f3cf8e5bb032c3d250641b7f779cb
SHA1 525ca40f271c5f4479120045a210ad54ec23185e
SHA512 c532a61533a6f517b1bcf5ad69e0df0cab39acf32d40ebb0c445eb02602bf72bd9e6b89490c1a5fa6692e6b17163aaf42f6ee2f80e734a0e113b476dbff01131
SSDEEP 49152:NSuZQIY0Be2KcRVtOnks6NMHqKDv66mG:D5dKii61KDv6V
TLSH
T1DDC5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 397e98d76aeac937038209c569a696b9ac1f14b321a23ef9c84cc51b28a6f332
MD5 1c763fd3529535698bf8d215c89e37ba
SHA1 5ae01234e4099a66ee7c75af5ef18261155d6f2e
SHA512 76931b57051073a2e4def0c36b5509dbfc4568bd20e6b056235264e7f27aba445f69d2c20cd838b35f99d2ff6d6dcb60ca72f00bb71255e26bbe59544708c44a
SSDEEP 24576:DhiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QL0743TvRk6NwG:DhtSn8EApI0fig3giDn0AP5wFDv66mG
TLSH
T1B595BE13F2D900E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 99dcf349ff0734a513cc305a35339ca4b17b22f66b94c1718987ee669eb4e939
MD5 0891cd21f67d0a56505b2876349898a3
SHA1 38e46a7431138d77050d7a466fa9850cbf0f02de
SHA512 a7d0a32cdfc8255624b17d3cd4ddef486f5c31ade868a9feff010ac88941bed808bce85b96abc2eea8db609ec09b9f0c2bf920327654283d1ace8a420e02a847
SSDEEP 12288:JqXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:JF743TvRk6NwG
TLSH
T1254523087396020ED273B9FAD88891C39093BF66FAC65CCEA75DEC2159BC1D06755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c3122b61b26dd222920521c4ef62e24ad01239bcb3eb22fd556bd594508a60c1
MD5 6afcbbfd34bb6430ceee2ec3c211425b
SHA1 0752edaebfc96ef3e5cd76b1a66ddbfbc6264421
SHA512 3c745dc8512160eedf270ebadc4a27bad235f783c5883552bd42ce63ab89877d6265143e43615e1158b865c7ddcf6d2becc4a6eb3510d7bb9ebda148151668b4
SSDEEP 12288:yxXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:ya743TvRk6NwG
TLSH
T1D04523087396020ED273B9FAD88891C39053BF66BAC65CCEE76DEC2159BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1cf3a593c62821b55cb284ecbe62f567df554d85dbf55175ca27c66b40af1eed
MD5 946eb341a6a61a4d0929d8b40bccfcfd
SHA1 63da76e20890c2184b14f414101d9411ba735bb7
SHA512 7fc492e939a9dd8ff98902dfb42604e2dd3dd70f76ed76c849c15503e94758c0d178b8181c1f3f3603e7c3413110bfa1e21305ef92dbdb28f6e411bb861c37a2
SSDEEP 12288:RbXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Rs743TvRk6NwG
TLSH
T1C44533087396010ED2B3B9FAD88991C39093BB66BAC65CCEE75EEC2059BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6868492aa6f6e00ee392f8ecfe369b471a52050b723a81c283188f119f03d057
MD5 220eb8e12b91140c032ba01fa52e3f16
SHA1 2c84c2b1db01756b14a069e10ff8483f9847780b
SHA512 3d8f7e102ad183e1960adbb663d173c9d21ecf83157357c03b30bea38c1d8877ab3346940580b3b58b8b4c8f7631fa15a1e9a7feb611a75929878fb29d7884b7
SSDEEP 12288:TV0XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:J743TvRk6NwG
TLSH
T1F1452304339A018DD4B3F6B9C89591C2D1B3BFA5EBA29EDF97149C650DB83C06A34F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fbdc04efbc89a1af1adbbde09f5013985e908afb1fcad99c421f57e44440d6c2
MD5 4332e0d9ff78b58096a8027b01082dad
SHA1 88c1bef90ac9be7cf32b5d88858664b78327ae98
SHA512 46a8d9c131f860174a584804bb2065154dfc1cbcef1db2acd2728cae24965ac9d69a5cb1c21377b5613b2cc366434e15a8cee5be896375488fdf9fb918afc73a
SSDEEP 12288:18XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:1X743TvRk6NwG
TLSH
T1B84533087396020DD273B9FAD88991C39093BB6ABAC65CCFE75EEC2059BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 085fe7f7fc78732731711450ac47b528147af1cd70e573ce2c05ef667f7cd75c
MD5 37081ebaa10df8d34b530ec9cad11d1a
SHA1 846f88e87f7bab3fcf52b07f6c92744c186a1d52
SHA512 b3d58825938906f5176b51a9463a0bdd0813b50f158d30c62afc3949bff395b1a31429e57a7bf43fe0eb699e84a35ff997db050fbf91a495885c97033b25fc6f
SSDEEP 12288:oFXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:o+743TvRk6NwG
TLSH
T1994533087396020ED273B9FAD88891C39053BF6ABAC65CDFA75DEC2169BC1D06755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f3fbb5366d06de4f792323a64336b9d628b15e089f50349435a5ec83df67a638
MD5 da24f408a514cd5277fdda55e6686287
SHA1 0a589e4b2a1e7085c2dead69e3e168929f4c3169
SHA512 6f8ac3c0b07788c0a8c54f3b746a7e78c7aa53ea8434742054b757a97eafaa858c7d748176c5826cf5724fb5430e91c769d845d41529d59827b173d09336b79d
SSDEEP 12288:05XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:0y743TvRk6NwG
TLSH
T1704533187396020DD273B9FAD88891C28093BF6AEAC65CCFE75DEC2169BC1D06755B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3580c1609f943750943d5ac663557a9b0ed599e127b31a0b7ce8370af7d976b0
MD5 e1a675672c9c4fd0ffdec9f46c20844d
SHA1 01ff14776a27e2b596e3cb295d0d6e1e8c036db5
SHA512 6f9c034048d1066dc257f4a6caed64fe06662ba729bad95865e6154d486448111192b622664ce556b1f1c23d3606ebfb1c850bb58a2388b4a5a239e2387d91b3
SSDEEP 12288:UiZwbVzzFEoS2cPvyRXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:3ZMRzFVSO6743TvRk6NwG
TLSH
T1DA650194B39008F8EC73817ECC558946D2B27C5A4BA0CA5F13A836665F773A01D3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fe89a5cf3178afe214c2e2ae3fe5f76c0a75c20bcd8618f161c925a56dfae062
MD5 add6e8afb32e40445641b334b0a1e1e2
SHA1 f000f762c6bbde11e89ce5de964752d5e3b7fc6d
SHA512 d2d6af1edc473ac8f3756858e4df4b6633ff2718f8f83bbb332098fb2f53e3c2cebc325ef43491b4f8305544b66c6c10f2aebe9ba16db3fa507c1ce549fadead
SSDEEP 12288:q2XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:qR743TvRk6NwG
TLSH
T18D4523087396010DD273B9FAD88991C28097BF6ABAC65CCEE75EEC2069BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9d4a376e68d1111ab7c56cdd0b5547570994f366a735adea963e3d99b148c9ef
MD5 f81516f4f6547d4eac12cbd0fb7cac52
SHA1 e52572abbdf98bdccbbabf94c96d4ed64a7fc4c8
SHA512 c8df7454b87a970475cd71fb86ada224e9af128bc2a9b690a27a667233d327c761ef9634502bc84ac9ee01f95bb736830b04ff34b0b697d64e35b787c5d87cd2
SSDEEP 12288:viXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:vN743TvRk6NwG
TLSH
T1674523087396020DD273B9FAD88891C28057BF6ABAC65CCFE75EEC2069BC1D46755B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 606c35676f369838f83e8694ba7f6222fb3b1df6692ce930f56d3c5ca88ef00a
MD5 5a4eba245bf273ad0dbe8387b651d661
SHA1 fd58ecf6739dab9c70e917976507b873d3438239
SHA512 d08d381816f22df34efbb05b74aa9182cf916c342208be9d27c31147a6b11b3b9dfd0aa3b120667e077f4aca01b431763aca37ed8f83bb1f95e3956748cdd494
SSDEEP 12288:5yPz5L8dXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:4zyG743TvRk6NwG
TLSH
T1D755020773A520FDD1739279C8925682F372B83657608EEF53A446762E772D09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 337e5d38d28b942712eb4409dcb90a3fc2d286651fe72e75ca8caae93ce48a35
MD5 486ffc29205d7bdd22b939eeec5cdb0f
SHA1 93311a75b5d94755e4f39cdec758540ab5f35db7
SHA512 1734e5a98b4ff63b43363dad274ad778d8d9ea3a9bf88078877285be3faf0fb8bc70d9900afc82b12771729d17b0b37b5310b9b6d15e3dfd8262e03179d2c816
SSDEEP 12288:r2XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:rR743TvRk6NwG
TLSH
T1E74523087396010DD273B9FAD88991C2C097BF6ABAC65CCEE75EEC2069BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 676d294c31520b4f38887d5a6e8c0d9d8034bd9b885fcf82e52e05e1511d076a
MD5 0baf03b7d7180dccb3638ff0245a8bd5
SHA1 580f5de6315d8a948e8e2e5f4c0792d83e54530c
SHA512 381155f9155baa71f46bb17ef808136ed1f731bae68252aa0921dd4a452b848c479c775de8a65df294b46bd9809ed573d8eb49fa66e203bb52b0971decfd856c
SSDEEP 12288:H2XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:HR743TvRk6NwG
TLSH
T1144523087396010DD273B9FAD88891C28097BF6ABAC65CCEE75EEC2069BC1D46755B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b972848be829655d8ed5bdcb6198aefe41193d7c1d8743634316017460210f2f
MD5 8426886db5172a3b127053f9e4d916ce
SHA1 433e865b2bfbc857381b7ea54658d1db3824851f
SHA512 7bfc7befb69a65f6cb4f65fd2066826ce8927557927af31de20c70d2fd98c2dde61b1d263298f9802e4cea66ca5b63e162a6f3d0e080681e58f2a062bc808a61
SSDEEP 12288:YyPz5L8dXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:5zyG743TvRk6NwG
TLSH
T12555020773A520FDD1739279C8925682F372B83657608EEF53A446762E772D09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8f4d699c5bdd966b71e177eeb4ab4be4371fec9ddb41af591bec2b790ec21e46
MD5 5c7229e07e78a74b947584bda995f5c2
SHA1 81994c8ec690a90906c00ff79e5d4ffb5049d89b
SHA512 a25b4c53c60b43a4e6aa585f816591dce2c20caeb3af06a542c592bde267eacc04a79878ef3d77921a034a8dc5c19ddb34ae2fe7694e05864f258d85690505fe
SSDEEP 12288:lCd9CWYoaLHF3z0z04PDvhLXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:gTDaLl3z0zD8743TvRk6NwG
TLSH
T1FB650194B39008F8EC77857ECC558946D2B27C6A0BA0CA5F03A836665F773A01D3EF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4e3f0101e12c9006d748e7be6e83bee9a22653d9b5f2e08a718b0ccf1f1d8625
MD5 0d1a15d7cac84df823abf7d52e759431
SHA1 ba83a06b297dcd8939c127a36eb9891ff1a768ea
SHA512 13449bc3dd763e3a11c69c9e492b53e391298296e05b07c3056a4716436f4c59660ef23548e9f15d36abac981707ccf68f5e088eb02612a24d4399f5a71c471b
SSDEEP 12288:Hi4e7KRdTfgwCHKy7GLbbdIvAXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:H3vd9CHKy7GZQ743TvRk6NwG
TLSH
T12A75CF90F3E410E8F0B39A35C9765512DAB67C5A1B61DE8F03A8661A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f8a63b9292d455c7cab0132d4ccf33d273226ebfa0237c89d9b6434ad7fe26fe
MD5 1c560fca78673d77b00a8b6de6e19c91
SHA1 0374b56ba7e42dda303e8230e26258d59d4bc4c6
SHA512 b41a8d3b37e0ec57ff746ac4b7200ef1ab6f874fa88b5c2983818d12a49a4035732d0459364358c2de6675e4836a9022fc2c05e754ab8670d0b944802f3703f2
SSDEEP 12288:i7XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:iM743TvRk6NwG
TLSH
T1B64533087396020DD273B9FAD88991C39093BB6ABAC65CCFE75EEC2059BC1D06755B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 594cea57a4799ac81d0d931954deb2239c78d00e7d500ccf55134e5350a642fb
MD5 4f7fe3a529b7bd9a5f8b6bd0bc11c715
SHA1 9cc2ad3c9ccb549a3b3b5bebee79f83244fb41ec
SHA512 b5819f5e04b6410fe3dd57d83426cee0f017eea15f2ad012a935c96c19c172625ff13e90d4523b0678f27078d9823c98488b2e650cdd9f5df9014204d55f3a7c
SSDEEP 12288:19XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:1m743TvRk6NwG
TLSH
T1564533187396010EE273B9FAD88991C39093BF66EAC65CCEE75EEC2159BC1C06755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0e8922831a467bb80d88e7053abf1cd3cbf599dd1cf204f089f9b53534989a97
MD5 e59785f1f3bd570efbc917c15f28866c
SHA1 7e88aaa95455a576a351e86910fdcbc656d54eff
SHA512 c3c289715df3c66c2cc008aff2e7adb1e5c79b1144c64d516a164c66610535088f65ea981eab3ae7b16dbc6d964a00ce854b5d7e421248427b582a87d532d067
SSDEEP 12288:tAXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:tb743TvRk6NwG
TLSH
T12C4523087396010DD273B9FAD88991C2D093BB6ABAC65CCFE75EEC2059BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ed3800b60cd1f11337b8e5495d93b625a700e6495da21e2ce5d3f50d866d9899
MD5 98ac5332b0980f5afa2fa39bc1279196
SHA1 ecef9ce26936cf62820bfdcd4c32a05414cc0963
SHA512 3c64ba502b75329c860b95b39642c96bc3c6513f79eb180fdc39b0b01bcf219def34d48ef4253f71e493263bb78cbd1ddaba4e90586eed76d06bac55464f704a
SSDEEP 12288:W2XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:WR743TvRk6NwG
TLSH
T1D34523087396010DD273B9FAD88991C28097BF6ABAC65CCFE75EEC2059BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ebae14d6ab09841b436442610699fd304ed0537df9f09873718646d5354a2dae
MD5 9c13af8b99d8dc52c7fd4eba3f6d2d5a
SHA1 0bd21c5a18f9742734c87cdc8e0b7c4bd6d3e3e5
SHA512 9b850237808cdf5f6f95d3b7e05b2fb41afd16203d3109a09d29ecb16bbd75a533e5278c7677d05e39f4970eba1c8a95d5588e04235ce251925c36c76bdb7286
SSDEEP 12288:h7XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:hM743TvRk6NwG
TLSH
T1664533087396010ED273B9FAD88991C38093BB6ABAC65CCFE75EEC2059BC1D46755B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 35c7a196f3d620cebb501f0bb609822975e392c07bfaace5c006f41209ce82a5
MD5 569b747ea84930e35ce6bad8f7ee7941
SHA1 9bc325d77af6dd9c7460f6c971b13a5628e14997
SHA512 91730f9fd86d454f53cdb5104eba903da3c1f2bc22b6f882b0c079713e5277eda7ac710cf6812528652ecf5cec100ac061f77136d44616149d106272d28df089
SSDEEP 12288:TeXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:TJ743TvRk6NwG
TLSH
T17C4533087396020DD273B9FAD88891C38097BF6ABAC65CCEE75EEC2159BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c60f27d01ac4c0ad94842234bdcda026374534255d3065ddef46371bdb4f03bb
MD5 e3e30d4459e12509e06c03dbd99a8ecb
SHA1 2838c5733691413579f4e0099d915da015ee8e95
SHA512 1365941284d9cf6ad780dcde7b13e8073137a6408577981ca4441b4aaa88f50639bbd295e97d921a24c31302b4d629e8a19b33fd3596b908cd4873af8e05771b
SSDEEP 12288:08XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:0X743TvRk6NwG
TLSH
T1544533087396020DD273B9FAD88991C39093BB6ABAC65CCFE75EEC2059BC1D06755B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 94048f531199aca6a2561c8a585d912ff840820bd0ff1057cee23bcd91566a09
MD5 a223db4d6351c3b46f3c1d899ee4bee5
SHA1 08cb720c94e97328f53b6284c71921b954017f05
SHA512 cd0152cfed874c43dd04d4f695609be3f92045588f3d4db0ac87454bf4bcc6b5807580b39aa32a95b175a8b1addae6299730a8ea5d1c54c739a872ba489b39c8
SSDEEP 12288:wzXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:wU743TvRk6NwG
TLSH
T1054523087396020DD273B9FAD88891C3C096BF6ABAC65CCEE75EEC2159BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 6879092550e8d93593e97e8e432a276a6c2f289eaa295b7bca16a198e79af22c
MD5 6ed75cc6e97be67850ed273b9edc6e8b
SHA1 c806c7f7d9414fdcd166dd65c7aba8be4f916931
SHA512 012a1dada4380bbb1d575ab6ac4b09a70a5cb633631eaae83484bd0ab8b26744773685ed0452eb71d8be9e9c6c99ad93122cd5e9c8b1e9b72bfa84658538fec3
SSDEEP 12288:48XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:4X743TvRk6NwG
TLSH
T13B4533087396020DD273B9FAD88991C39093BB6ABAC65CCFE75EEC2059BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 64f6d11e821dde6b8c0b1b4751961349ae737e7b34248e45f7bdef6902e88266
MD5 29c1e25122fb8aa9acae42f42e20c849
SHA1 6e288b441cfda8baa8c4f2d79bf1ccec076b6602
SHA512 247dbe1a67899d36ed83dc18df25d4abc8afcc4f1f9adfa8fc07549a685abd9f3fe69d3a43ea755ea84c11498c87949f2bff737f68cb4a067d3df9801c88025d
SSDEEP 12288:dfwvD5ur64Lk3tRX69qkyAI5IXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:dfwvUk9RX6wkyAI9743TvRk6NwG
TLSH
T12C85D029EBDC04E5E1B7923C89B7464AF2B178691B31C6CF029A536D0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a6db5b850a0c2d117da93a045dbbe7c4ba6af1f5f6ce6725fb524fbe59bb72b8
MD5 92b2a72176ee3b5bd98281d6207d1089
SHA1 58f32927e6015c3888376846f065ae0bc2a62323
SHA512 d4081a297e1bec7643104066064477dd3bf6d29fe62d57d39a747216392ddd159239e75802c4ad9a551af596e01b78a803462dd5d7e3c87fd4703b5983e3457e
SSDEEP 49152:EYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lDv66mG:zySzPtDv6V
TLSH
T103066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dbc5046b992984ecda283a84f1dcf1361c6eb4f5c3e25c4c423b271c1b7ad66a
MD5 864cf51760e8f40c5b3d7d161d1b9279
SHA1 df80240858c09165c005255dd17d3515c90d0d74
SHA512 d89e295d0ac5287ff801cfcda923969f74247ba45e6e23bf53f9e008b684c315a0ceedb812b4fff9288c14402ea7e150ceb3a33b59cf5a7cca42c8782278c743
SSDEEP 24576:n47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYq743TvRk6NwG:n47JUQjTirIhCnDHUPfF/VDv66mG
TLSH
T11565AE1DA3EC01E5E1BA927885158A5AEA71742E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 16cd3491daf438e683ca7f607f336ae7f2f6808f4eded6e861f2a6e6aed80dd1
MD5 c0ecdf5ad912f3a970ba10d60c109569
SHA1 67a2becda48e87430892bd8ec6a40f701eecb681
SHA512 fc373ac4d5a68dd21faca95138f7ef39dcff1070bb0ceab357ad1e3ed62cd28a5c6978f340de14b835cc1f5196ecd5e48dec7da1a30eb40d4547536955a2d1b2
SSDEEP 12288:6bsfmXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Rh743TvRk6NwG
TLSH
T14255F019E29802D8C06F6279CB458681B3637D2597E1D7CF52D0F93E1F792909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 960KB
SHA256 0372b46aa814d5f22cd831d64c74f21f6a9d38b672fff6b74f703a97058ef299
MD5 66f26f6bb705a882964543d994149732
SHA1 322de6edaaaab4cb74ed2f4f14b5bb06375e1cc2
SHA512 fbce3e34a319cbd1113fbc098c1641fc9b75f621d315d69bb6e32ee9617b83baa126b47f4b5cce8cc6028c3f813a8b2b047568e499caf0ee4f4c20f9512321ba
SSDEEP 12288:LbdAU3fukT/yDaCQ0ZrWQFqwzzCVhx3RMEH2SB4pv+e:LbWUPZWDaC5I+zzIhx3RMEHfKB
TLSH
T16C250640B666D74FC6A980321E33D1CCAB707D01EE45AF0773C9873FC576658BAA6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 fd792b655385f03d4efd244ab1e41b176500e7c67738aef8227a70951e9fff2c
MD5 49e8a0013e81983a5fabef92c2ed277f
SHA1 4e1b41734b0b100681a5c972d156d7eee6ad1622
SHA512 b732d67872ae636cb9ba860efca7e40b466e3f43e283ba2ab463ae43b423f45bdfd601d04169199e513fab7460dd171971cb71dbddbdb335beb8875d54a38b70
SSDEEP 24576:fr1XCV9qIezMQzrcj3NxLYg1skuQO+f5LZ0fwhuFZZu0Pa64:RS7qIezMQz4j3NxLYg1skuQO+f5LZ0fu
TLSH
T156750B409136A38FD1BB6072072AAF8C7764EC067B456F2673C9453AD82AB51A0FD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e4a50049bdffb575e90ea90111e2edea53b5bc568f92ecacdde8781cbdbe0804
MD5 2943a77a123a33f79fa2c301a4df477f
SHA1 16f23ba46b4475f8c868fe6abaa27999f1e6af85
SHA512 7bc53a375f3986fe6254a0a71600f7b4f91c1ce9ae58a0fd00c087e9cbf6067472f3369d9371d143f1755f509a823967c7bf678596861ccccf974a5241615245
SSDEEP 12288:Hz7OXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:nZ743TvRk6NwG
TLSH
T1254523147399050DE5B3BAB9C88DD1E2601BBB759F809CCFE619E96068BC1C0AF75B0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4ccff97043f0d847a8200c79c49671122a4dff9097fc26ace5b64c1d044dcc3b
MD5 3ade2a63e89407e8d65d7ea60d32a9d7
SHA1 2ba791c0766c3dab6e1a3b5b8d2ab3cc6918095e
SHA512 edb385aa1c0c6c01f840a14b903fa81b91fb4bf61a338d503d3413744061d4f3881277aef920597b928d7fd8ae0aec5924ba7257417cdfbc62bbaaa177e727d1
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bYD743TvRk6NwG:lgb4mBIBhGFDDv66mG
TLSH
T14E65AE1E22E802F5E0F6E2B8DDAA4417D6B278160731D6DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 6ef2b1c8bcc3f0a53f74d90a0b3c04e796e8ebddd119bb51f5277b52a49dc6eb
MD5 f667aa6c74839af0466573fb9a0a9a6f
SHA1 5875306de25343b40a1a01253779eed06c74fb2c
SHA512 f2f0563e34a63bb064b523234f92b103407453746746ffba7140cb9924db4f2df92bc3de3e14cce5440ff2371dd49e5761e1c6c66e14d37a592dcb6cfdbfee8f
SSDEEP 24576:LG88u8FpJqH1bzria7/m6743TvRk6NwG:K7ZFPqVea7/wDv66mG
TLSH
T1D285F16577E102F4D477E138898646A3F6B2B8250364EFDF07AC8A511F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 06c4efe3ff2a50add4f0e88a931ca1ecf665daad802dbff1eca9d7d220da1955
MD5 86bbc17ed2af310437398ce215e9c534
SHA1 107a5a4bdfb405315462f18a87079aabbd9b9f1c
SHA512 b320299a9185c85a85aac2fdb8eb177cf3763c30bf9c3ec419ec4a30d6b594f454c92966573c9ba53e3bc93c2c9c0fbf30b726f0c98143b1110a543743066b7a
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfDv66mG:eG05lO43bWDv6V
TLSH
T146D5CF6E62EC01F9D1BBD17CD9C6860BEBB23415032556CF02A486A91F27FF46A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9ba2488d1ea184b39b92d7c757f22a65175c724654950200bb334de075f15abc
MD5 fcf3ae1fd8320597472d36494eaa4cfa
SHA1 6d61523b667be3c7e560d53d0e9d564b72439241
SHA512 756cdf04c4c6b780c8792cede07bf36a1f1468ee2e12a02222deb99113036dbd1d8cdf962c29f2ec566948e4d4d329e7291617abe752b610072bb480644fc049
SSDEEP 24576:ofa5POZ3dpuWVM50JicR2hG0lasx2+47eidnI743TvRk6NwG:Qa5POZ3BJt2pasx2+mnDv66mG
TLSH
T17565AF5DA3FC01D5D5B9D17DC583861AE5B1342653329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b038faf4ff53718fc476682c3416de9de97b6ad787f1a278740216bf78c643f5
MD5 2670f73f4b91a739f23abc1fee7f93c7
SHA1 8c92f664569bdc1a15658edbc15220c9ed67557f
SHA512 9ec3a6f5969b301a05dfbb772ff4d22984b06759db66698e046d830faef0a85df5394da883ecafe1316c455900c127f152a7041cfc6f6ea4ca9e1f98a83c761c
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkC743TvRk6NwG:RNc/zEOVHFQDv66mG
TLSH
T147858B1623E901E4F1BBE1BE89779546FAB1786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ec50f62e0374d320985282301939bddfb21a618f0072c3e9db3f4e00277124fa
MD5 8de807219d82e65dc8b1bd07750aa6a1
SHA1 3e9ed02dd5b8cbcc98944886275af5af58b7fd57
SHA512 ef76c3bac384b3db56cf801bec5194aab56a44ee26ac814e2819c98550a64de16f696ab46543213565b069a197a68328855307d2134daff42c26f9eae4028ef7
SSDEEP 12288:HQFSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTsh/m17FXI7vgbrWVQhTCh:HTkNvNnaFeYhJNtmZBmU743TvRk6NwG
TLSH
T1BE55AF2EB7B806E4D1FAC6B5CD238512E6727461173293CF5290C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 0b1b762fa81cf8f365e3544bbd19904a1da832030c8b584fd7c6ab8318697079
MD5 f22ad3f26be0c5035fb3796b952a02df
SHA1 ef6926fd749b8ef0dac3cad92d9a0239056b44b5
SHA512 f583e7b63c6dcb8a676efb0f66aab6989e62c4d78160e6d1fbc9fba9ced19a7f1e58f4ffe5043c618a8048df53f21533e055a57c465e433f300d0b76d5901e92
SSDEEP 12288:gHvUrBFrEjwaQVXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:gPUr+NQu743TvRk6NwG
TLSH
T1F265F11E32ED08E5E677E17DC5828649E772B4621712D6CF02E0817E4E67AD8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 948552e28a42ef06f6fd0eb52b46fdc6b777ff49045c225150db968144292c03
MD5 074d4e8cc7ae7b8d28c58c6cf529917b
SHA1 fcf5530addf9867faeec880caee5945fc13a3bd7
SHA512 bb7c0540b5879aeb183d8480e1e84855b12725ee61fe830f462996435c58f785a0736d5530615af24dc7b6ff6d772ee4450f5a942e747932b1ae9e1661f1f15e
SSDEEP 12288:YQcMxWDXN1Dp/fshBItT1IQgAKXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:6D3FHshBIYQgAl743TvRk6NwG
TLSH
T1B775E13DE79C04E4E57BD1BCDA538606E67238A9032269CB0294C1B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1168-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1168-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1168-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1168-365-0x0000000002FA0000-0x000000000323E000-memory.dmp

Download

memory/1168-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1408-21-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1408-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1408-15-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1408-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1984-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1984-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1984-369-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2380-102-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2380-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2380-366-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2380-108-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2380-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2380-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2496-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2496-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2496-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2496-278-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2984-50-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2984-46-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2984-45-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2984-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2984-39-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2984-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3384-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3384-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3384-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3384-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4140-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4140-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4140-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4140-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4140-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4140-383-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4240-9-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/4240-7-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/4240-77-0x0000000140000000-0x00000001401E4000-memory.dmp

Download

memory/4240-1-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/4240-313-0x0000000140000000-0x00000001401E4000-memory.dmp

Download

memory/4240-309-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/4240-0-0x0000000140000000-0x00000001401E4000-memory.dmp

Download

memory/4904-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4904-127-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4904-138-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4904-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4904-133-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5384-84-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/5384-79-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/5384-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5384-308-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6096-73-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6096-67-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6096-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6096-306-0x0000000140000000-0x000000014020A000-memory.dmp

Download