Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 02:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe
- Size 2.5MB
- Sample260707-c99wasdv7r
- SHA256 eb5cb223a43163e19f54b3ed65447d246088f8d3590a66e39a52f0392cfa8776
- MD5 7bbe26a871095faef3e91030dac0357f
- SHA1 64b8d87de52bfd3a12b40d4839def6b40b388101
- SHA512 2b1453bfca72008fec2bffe0d66b6c6920c9a232167751cb52e0ec506ed8c09c3798571cadc1b4f71974496b2dab438db56beb94aae3783af3b44154ac03d449
- SSDEEP 49152:gm0114YHB9YaYr+1NZx/jajpW9UBKaUbLeSlU:OxCpGUBKFbaSl
- TLSH T1D2C57C49F6954F92E0179B3558FB973AB23C300647668EE72580A6807E536F327B27CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 5764 elevation_service.exe 3068 elevation_service.exe 5192 maintenanceservice.exe 5364 OSE.EXE 4196 PerceptionSimulationService.exe 4184 perfhost.exe 4948 ReFsDedupSvc.exe 1128 SensorDataService.exe 468 ssh-agent.exe 4332 AgentService.exe 52 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\f85162ec84defa61.bin elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000170d380cbb0ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ac0700ebb0ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000abf8f40ebb0ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045b3c74cbb0ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026e6f70abb0ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe - Modifies registry class 29 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (int) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (int) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Key created \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (int) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (data) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (data) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (data) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (int) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (data) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Key created \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (int) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193" 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (data) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (int) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Key created \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Key created \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (data) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (data) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Key created \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656} 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (int) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (int) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (str) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents" 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (str) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Key created \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Key created \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Set value (data) \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Key created \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Key created \REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 5764 elevation_service.exe 5764 elevation_service.exe 5764 elevation_service.exe 5764 elevation_service.exe 5764 elevation_service.exe 5764 elevation_service.exe 5764 elevation_service.exe 3068 elevation_service.exe 3068 elevation_service.exe 3068 elevation_service.exe 3068 elevation_service.exe 3068 elevation_service.exe 3068 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1448 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe Token: SeBackupPrivilege 4948 ReFsDedupSvc.exe Token: SeRestorePrivilege 4948 ReFsDedupSvc.exe Token: SeBackupPrivilege 4948 ReFsDedupSvc.exe Token: SeRestorePrivilege 4948 ReFsDedupSvc.exe Token: SeBackupPrivilege 4948 ReFsDedupSvc.exe Token: SeRestorePrivilege 4948 ReFsDedupSvc.exe Token: SeBackupPrivilege 4948 ReFsDedupSvc.exe Token: SeRestorePrivilege 4948 ReFsDedupSvc.exe Token: SeBackupPrivilege 4948 ReFsDedupSvc.exe Token: SeRestorePrivilege 4948 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 4332 AgentService.exe Token: 33 52 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 52 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 52 SearchIndexer.exe Token: SeDebugPrivilege 5764 elevation_service.exe Token: SeDebugPrivilege 3068 elevation_service.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1448 2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 52 wrote to memory of 1432 52 SearchIndexer.exe 98 PID 52 wrote to memory of 3352 52 SearchIndexer.exe 99 PID 52 wrote to memory of 1200 52 SearchIndexer.exe 100 PID 52 wrote to memory of 1708 52 SearchIndexer.exe 101 PID 52 wrote to memory of 4288 52 SearchIndexer.exe 102 PID 52 wrote to memory of 2712 52 SearchIndexer.exe 103 PID 52 wrote to memory of 5732 52 SearchIndexer.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_7bbe26a871095faef3e91030dac0357f_mespinoza.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1448
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5764
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5192
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5364
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4196
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4184
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1128
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:468
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4332
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1432
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3352
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:1200
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1708
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4288
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2712
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5732
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d7c1bba857d1eea6bb93b7b1daee44e4a7af3cf82275a3167c7e6021256ae37d
- MD5 a6a898fdb82bdccf3c692b1ad8429c2c
- SHA1 2cd076a9851e64bb70cde5e6aed5173838239dfa
- SHA512 87be5aed9c48f7f6691cec21ae439366e37781e3688f22eaa74e210115dd7caa87b413ee0a11045cf9093c8f0068e37cc80e695f5f10cb59fc08d0df30d1631b
- SSDEEP 49152:0b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnm9UBKaUbLeSlU:u3q6sjBJUBKFbaSl
- TLSH T1EFD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 1377d1cbb29399e7b38057f8c23ea2c202c40b5ab863a23d4ef2c0040494a924
- MD5 6418f15142091e612e363ffd0e9ce20f
- SHA1 e289cffe3d2f323dc6445f71f0167cc53ea3e9b3
- SHA512 175fd8b0ac369e83b0bb86f051a4745c7335c172cef8261be4026d5d8952d06a0e58d4973706f0aaaa47b5e9bb6e4d0e8143a54c4f2db0d5a66476b88f4aee49
- SSDEEP 12288:P1XLsswWkxy2lRq2czAtXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:tXYfDtczAX9UBKyH/sbsePGSlU
- TLSH T13405F129779008FAED67927DCCA28501EA33B8514364E79B03E4D9291F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 fd0d33ff4b3a68abfa3713d3770f4592881de06edf267c62b3865189851a07c2
- MD5 3f5d1f5c7dcc9d041542603eff6358a8
- SHA1 77f55255fd4e488a195cb525c88ff0db4da96c73
- SHA512 9cfbe8f27f9675d757c8489434aa5057ba618a383623946f5e483f32477db128162b61530923d6b9f4ee09f0e43b8185ccd83ef18b25c20a55ee571b605f8559
- SSDEEP 12288:4XZNYVLeyUji0h90ZD0wxpGZIVuCrHsGXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcP3:I0Le5ji0hmxxrMe9UBKyH/sbsePGSlU
- TLSH T1A435AE16F6748735D073C0B9C5D2A68AED72308657308ACB4286D77C3E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 091e4229b7c41a6067c7675b24a400e381a79b68fc440faa5396da33635423e3
- MD5 6dafd308a4759dd5708751fb637dc970
- SHA1 3ab276ba818eef8bee5776c37c4a1598afc46f12
- SHA512 0730ce4690b19a31046dfd289fc6dc4cca8443e8d661ff2aec94aa3ca9857eb54270da9ae57eb0f6a2b926332d3f1db49cfa206e56d6ef51d9d3c3432e5f30fd
- SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWn6q8wyug9UBKyH/sbsePGSlU:0/ezSC6vUzPveHjyB9UBKaUbLeSlU
- TLSH T1DA755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 a6f716b972b2067211659d220734606a86dad13cbf12f5e9e1045e199aea0897
- MD5 93f8d12cf438c182addef870ce3cef8e
- SHA1 77de6c7cd7330083b31c31911acb7092f08c24bd
- SHA512 3752976090e0f7c03d76129ec0a7e2f62bb465cebc7b37e3fbf8ff3608ead719f2627b303dc92ed9b1079a365ef7e4802fcba9f8dc2bd304ac1b69c4c448b9e6
- SSDEEP 12288:3VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98JXAmzaOJGxfBkmUO3H/oN1FAXeM:3VbqPb88hv/l+Yj9UBKyH/sbsePGSlU
- TLSH T100559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 785ca25df8005ffa3dc0fd6a57d3017b452726eb88e54c82e09372b08975e193
- MD5 5cfcec508341cd009619792a3fa2efc5
- SHA1 11907a7657841c8b0a2f6d21a0a732d18ad22b0e
- SHA512 96caac7d28f7cb479d9698f267d6c7b5c0c64bf9717fd82a153e7a1e6a7b97f8243bcc21654bbdae890e8cf5d7b10eecb808eb187fbf0e942683fce66b6dd3d1
- SSDEEP 12288:PLiXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:PLa9UBKyH/sbsePGSlU
- TLSH T106C42302AF007CABEFD7BE736C696900B671DD74D08DD926B088F4292CBCA61C556D1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 151cf8b33b944f01e722ca8424e4f3f6e69798fd6c93dcedf419aac79c17716f
- MD5 fbd8edf5e1b9d6c9b88684dcf7377574
- SHA1 81b4f29604f9007121f8ab6d545facb2203ee6eb
- SHA512 e0552cfef2f12c8a17be29e91e67696479db9bec4cea93eec91fa02e94db74984e10c8d3257cb467bcaafd829fb1280459a94b44d0a4190848c0e7dcd0077d4b
- SSDEEP 12288:IeBNUbTVO86UhXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:IJIU79UBKyH/sbsePGSlU
- TLSH T1C705D03BEE28FCD2C67E9DB95A51C600E77278304B52A3CBD164C20E9E235E15E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 cb53fbccb1c303b2c0f0dd78e5b089b367e6934cc3fac12eebda5a2a555ca147
- MD5 71dbf30645e1a947fb10cf3051ba78cb
- SHA1 7400e724cb601d52084cf4df8f13d9cd49d68365
- SHA512 8fd693f5f5503df3515237301127d42ac6d0a3687c42ac7cba7079ecae16bbe489670b0668a32fd544a2c0396691fb382cc8d61bf1786cbfd14d6a4fc3168d71
- SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THS:+QvGAdlCEL8c/DRNw5CEUBKFbaSl
- TLSH T1C6267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 5d3a233ed5370a96a355eb58e1e67b9e68c0527fbfa4609368f10ac9de6bd3b9
- MD5 6cd404e7ca7e3f2c9163ca3766fe72c5
- SHA1 b3b03e5da2e5e05b7033d64d562920eb6599b255
- SHA512 6e0ccae0c7a9b12070944e58efcd5fd1e25f4a750fdd52c8de9e6cd5c1d2c8ff81a7cdfc6ae12e050fc2fb60f6b51fa87bac218069df0aeabf30011b1b5e1752
- SSDEEP 12288:wAwSfxL/2Dc3RDLLmt0LDQewsAjnXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSy:F0ewsAjt9UBKyH/sbsePGSlU
- TLSH T16615E031FE70E436C6BB0DB21B36C706643DBA204B511AC3E3E8899E59742D26776E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 45133cb0fcf62ac1743258bdd32a4ff5de94bbebf4bf0054249d89817d303ff4
- MD5 c7d68bd98deb46c8612cef5c97c77938
- SHA1 0e99e0d5ff28093243f038f59249993f7377a9b1
- SHA512 686359075358c3dbeb1e8534485a25a09d6019adfe403407b82db3e16c148b6f5235852154f44f527c5def758c670a33937a6ad80a0a9e011f0b1489301c86db
- SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHMnQ:WUEtQevvqc2W1cpV2tI32MnQ
- TLSH T106474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 6c159cbcda000877ef738c6cd664ba832e0d8f575488da5d9c466f9fc74dffd7
- MD5 07b79168489b5867145e3b7263a6e228
- SHA1 69ed73602ed8cf141b86cb38a9474719440eb167
- SHA512 b342c0e25412cb1bf20db68fae7176229cd2fb2771abc82b99f5766a3e528789719ed39e406fe294460719097176934d89149c8984c29c8aeadb4678e117cfe4
- SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/zN9UBKaUbLeSlU:SoqtVjnmoUBKFbaSl
- TLSH T135D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 7567d1e65c28e1675f07b0ec9877dd1258ebc47852c262279ea021bda848e2db
- MD5 63623a26f23359dee0b1cfbd43ab809a
- SHA1 f9ed71cef79d94bf12b6c0c405d7d34764fbc173
- SHA512 3123ee857684133c7ca05237173122b25279e0c2de107d17af3175dc4c13ab7c487cd817cc3eb9af6852a99e8cfea33fb7e0da4cae7e22675d948b8ab41a1ac1
- SSDEEP 24576:9AhGL3IFoiwtA5l7S53U9UBKyH/sbsePGSlU:9AMUFoiq5E9UBKaUbLeSlU
- TLSH T13B359D81EBF955D4F5B3AAB899B68570EA76BCA65E31C20F2150D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 250bfd818f3b8c5a501dd64db52e810bcad66676e6ae016b24d879c4e5c0a533
- MD5 f4fa4e441e6c4d62a033b48556751fbc
- SHA1 61e311edbd1b8a320f06c1620bdb1150eb71146b
- SHA512 75772854ca98353e587dac3bd054f3df8744231d4bbc29b83a764a0a2f61d5747a1b806e8a6c7dc1967fd4d258e2f7088e16524bd20d94e321d7c125121edff3
- SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CUXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwX:vwu4OWh9UBKyH/sbsePGSlU
- TLSH T16805F10677A41CFAE9A796398557C531F7B2BC112A25DB1F1360C61B2F37321AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 4d74ebdf6d83fffa606bd56ba79da3fb7921fa809a87f10944030b01d38b5e81
- MD5 3d6d8fbd78dda114a1cbf36a02401097
- SHA1 38e1ef878155266361dd408eba04c96e2620a7e9
- SHA512 957d2e8d54a0e3c97faea0294af1c66490be92760249d34b08599eb1219fb11622d730ceb38a4b7b2e04fba203ec30a66b2b9f3539e3dc08df96bff47c0f2427
- SSDEEP 12288:ZeZ1Iy3XAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:cZu29UBKyH/sbsePGSlU
- TLSH T10DE41246379034FAE5A3A639DCE55A00F772B862637A83CF215481292F77BD14D39B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 75bc0b043cab079ac6f0b9a7dceedb429f47aff1beaa7b600c2ef1c61c751a24
- MD5 f3105108c73d98804c9dfc2510f9019b
- SHA1 262dc659766276e41866c88ee1a095bb4a325365
- SHA512 2c0f0407d13369af2c3b3d2644d6a982a447bb9bd695a248f59c793ad636131f17d6f7ba4869827d4a2b36461900b48071643441213230b1a966ff10f878a976
- SSDEEP 98304:3QRQyi36YOcPbLvw2gAf+PN31UBKFbaSl:mQyiKa/X+PNynQ
- TLSH T167667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 41c4d22e5890793da31f48c4862d6d02c6ca8486159f55fbf33bb567ad3220a2
- MD5 04e63bdd5973741ba5ea01aace3df816
- SHA1 2d83b2fc63d5cefa5ae8fff0d0afcc765dbc6068
- SHA512 ca89e116db2258b6329b625da866b549e70ace8705e87b6a28a62c74a44b0f5d39c96ad6882ed0c592c7304a53010c2b3c3105da1a363d333b67e8ee657f5de7
- SSDEEP 98304:tQRQyi36YOcPbLvw2gAf+PN31UBKFbaSl:EQyiKa/X+PNynQ
- TLSH T11C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 b5f8035e17a998f234f3308ec6b437b858ff6508048b64ce98dc3e8884a2c555
- MD5 c6a61ce10c8ed2fbe7fc7c7c76c4ece5
- SHA1 9126dcc3131635abf5c8606b2333800811278ac8
- SHA512 164c6b1fe50285d9bdec23f6d930465505cbec8329784da6837920be664db264f422c01910f49dfa3703f431d2cfcc26b9070edafbe229302b6552f1c61fe3a0
- SSDEEP 49152:q68Qg55nhceWu7PNU3/d9UBKaUbLeSlU:YthLRc/HUBKFbaSl
- TLSH T1DAB54933B2F200A9C44DE1769F4A872196D27C758FE1E3DB850572161FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 b23628240e0ece736cabad0d3ddf93f0e655160da90d8cf6b5bbb53d49859a83
- MD5 f2ea43bb44e1e693d94549dee165ffc9
- SHA1 55171d176372518302066e2715802533b5a80710
- SHA512 b4620503ad9901c355856e5d44b1656c66301c5049431484faee9b7bd1f2e0de60dae2870e6e3161f5ea36ce853cd20cd0e078ac97c7958515ca0480e80f5faf
- SSDEEP 98304:py5112gYy5azzVvt69nLKnhZaUBKFbaSl:ELIHEWhhnQ
- TLSH T1A0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 1831c8a1984edca419a4624e17dab20ae6a3e92a37317a35a71b2a3459ef3b56
- MD5 ce006e7c9385224d3df163bda05a2b2f
- SHA1 0a6beea79507440a30effab661d475b5cfddb983
- SHA512 0ec9e75b602e1d7efb1406970809952bdb8c53a331444da2813ea85b958a3846d854e8bb427786d0647b6c4479d83ddb98484db99e72b194b2e0cb1fc5290f0f
- SSDEEP 49152:UB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glH9UBKaUbLeSlU:Ou6Jmdxd2ddUBKFbaSl
- TLSH T173D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6EF0A9072562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 dd18edcc1927f32828c9b56ffb2b2f99b52864003275b7afd7c8da8c429297a8
- MD5 343848d5250f44f377caef97066300a8
- SHA1 4a66843084ab092ccb55bd29e0fa0cc58b83970c
- SHA512 19075e0468dcd435a42f28a655407afdd3fc03b29cb4dc5cd1c3e9d7f35cf15f4d71b4cccd017c27db41abbbb01cbab546156eacfbd9539a5fec7576e17fe400
- SSDEEP 49152:r1hpsNoJpF1A63U44CwH7R4xb9UBKaUbLeSlU:rmifPWRoUBKFbaSl
- TLSH T1BFB5BE13F29900E8D06ED17887569632EA72BC460B34B6DF0A90B6961F7BFE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 f49322908467cd44fdfc38dd6f82b91b71f6acde441f612fe98e7afdb0a834d0
- MD5 803b5dcc23e5d8296f93e4278904b2b1
- SHA1 9f4474464624be61999f8a30752886901f586c6f
- SHA512 3ff42d4397e83dd6abfbaa5db2a2aa7e0de8a87907ac0b442fed6469e0e54cc9079c90265d37ae1e4914434cfc9556fc066908fe6659f5bf4f7689f1466c82ec
- SSDEEP 49152:LSuZQIY0Be2KcRVtOnks6NMHq29UBKaUbLeSlU:Z5dKii61mUBKFbaSl
- TLSH T1A3C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 fee283bc80fd6d763312b9a279804c5e22a3cb8ea0ba8cba7c5d3d69d48c916f
- MD5 2b1edebdd8af5c3c86c90cc1b3834ebd
- SHA1 3444bc497784a15ac9f2384f0da669d7d2796db8
- SHA512 451af6a3d9ee81539880ed2ddf742a5bb566382723bd5676cb7720376b9a2eaa864395d964586ec01b35d938ec900d5ed4def405483facd0dfe052899de071f8
- SSDEEP 49152:shtSn8EApI0fig3giDn0AP5wX9UBKaUbLeSlU:NX2imphcUBKFbaSl
- TLSH T10C95BE13F2D900E8D05ED178C7468632EA62BC150B39B6EF0A90B6561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 0baa7b26a4ecbed91765411bfe191e6537cec3960b2f39ebd80dec8f2fad606a
- MD5 0919cc2041ccdbbc975718cdb87d032e
- SHA1 5e1d6c358aa23f6ee33a0de2702006fcf80507b6
- SHA512 68f6fb42236435cbe3da409fee2d08ad61b0e20de9c78dc020a8a351fa3aadf7c173808fb94b981971d9d986d2f10f7aed56ef96b2581842038220f667f63a32
- SSDEEP 12288:L6XAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:LS9UBKyH/sbsePGSlU
- TLSH T1ADC42306BE013DEFEE83BBB36C251900B575EE76E14ED126B08CE0352DBDB618556C1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 4f2e02f4133b4d8932b00c934346074bedebedd6bafb9a10d4ef537b88ef488e
- MD5 f2f115d8cea5d3a9b41ef51f153a6d50
- SHA1 9b5b038dbdc54de3128667c7fb8898464b7ce752
- SHA512 e1311b3912e158574dc03e2c5ff938e4103e4091d119707334685a45c8b00b133ac65707259bf1e00fc4a20009d459111036e788f8aa9d56589848c4a2d7d0df
- SSDEEP 12288:+DXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:+J9UBKyH/sbsePGSlU
- TLSH T168C42306BE013DEFDE83BBB36D151900B575EE76E14ED127B08CE0252DBCB618956C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 eb7d5e849e607ccf4a510c3bf012fc4a5df68354d1872af9f6defc3e713fde7c
- MD5 764685caa458c1e8cb81e5b3fada81fc
- SHA1 7c3d9450073cdc9a06be9ca180aff59f45837af2
- SHA512 fe7ed1bae8a9f84d62da5a80acce0767d97f47641db5facd52bb69aae3f2babc76adddc534c755460f70532b386f3289dd69dbcfb953c33879733fcc6fad5f66
- SSDEEP 12288:y5XAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:yT9UBKyH/sbsePGSlU
- TLSH T1F3C42306BE013DDFED83BBB369151900B575DEB6E04ED127F08CE0292DBDB618956C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 3518a6ef47396287a264370fe51eaf87a9ff949517fe321f556661e418f2877b
- MD5 0cd4cf926171198fba3289db485d9541
- SHA1 ffe5075958ecb1f8224b41aeb3d46bc7b49c5020
- SHA512 e7450b5d576e05a5667efd1facdada60176adad33acbac9f88e9421a4eebfd09da9ac726fdfd3e78bf3a710783de02fe5bde76b8ad236b12ca8513907a01532f
- SSDEEP 12288:uV4XAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:t9UBKyH/sbsePGSlU
- TLSH T164D423027B412CDBDCA3FB769C225500F2B1FDB5E22AD3AFB144D42A1DB57908935E26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 8d873441c88c0468c651546ab04aeccba83405eede5971ef55f771cc69c208d5
- MD5 507c012dce268638afea940e48393fef
- SHA1 11b62bef4ef31ca6d1a07536809e06f359053f6f
- SHA512 bd3e98f7b0b38eb614c442784b45814e5e3ab8ccaeb6e57fd0dac16f5348401984de9eb94e0c3567327f23e44d4f3605c3e9ff100acaf5f58b52c752fbc711a8
- SSDEEP 12288:VAXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:Vc9UBKyH/sbsePGSlU
- TLSH T174C42306BE013D9FED83BBB36C151900B575DEB6E04ED127F08CE0252DBCB618956C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 06b423abdce81bbe3f80969bbf8dc15704e1feb1ac6eb707dac79fe4f168db6f
- MD5 567268fcb22d55d34700ef1087a7a6dc
- SHA1 238a4fccc42a384bdf44775bef6a862cfbfaffe3
- SHA512 e7f1317079f2760ed724571ea7c790ed8a6af23db9577c97658f774043edb3232c570eda5fdb8f9fb2e6db5bec1cde0a49901bdc75119a33478ba0202f784086
- SSDEEP 12288:9fXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:9l9UBKyH/sbsePGSlU
- TLSH T195C42306BE013DEFEE93BB736D151900B575EE76E04ED127B08CE0252DBCB618956C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 332d5bc611abd2a9e4c2b795fc11296fbbc7224fae368345ef3621151bc7b178
- MD5 0c0aaec5428bac955d883f5431c2ca67
- SHA1 9c4139c8a2e578adc13b262faa7b97f0893493a0
- SHA512 e4e780ff20517ff1bf353c5c3a88615021ae974945f5ce329eafe0a2d9dca38e5cb18115ee1a5ed86f8bd3a0f755754c80fcc7e46c809d7930563881035e9f62
- SSDEEP 12288:NLXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:NR9UBKyH/sbsePGSlU
- TLSH T1DCC42306BE013D9FEE93BBB369151900B575EEB6E04ED127F08CE0252DBCB618556C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 2a77bcda6dcde2e9cc7d50c4d548d0dc4de5faccac25e0471d5693a8edbfa0c1
- MD5 fee2f5c9e0557ef4d7c15abf80da5406
- SHA1 76747ef4ae8d975245c13ac85bd8bfb22ac8b5ba
- SHA512 8e0015e9ff8c24ce2da1cd08f8fc320e3369b4fb982cd39305c9774204203fa89cf9d6b71fdfc424bf3f8c1de2794f290742b68a3ba376a6dee059c17a94d2dc
- SSDEEP 12288:qiZwbVzzFEoS2cPvyjXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:NZMRzFVSOp9UBKyH/sbsePGSlU
- TLSH T156050195B3501CF9EC67823ECD158901E6B2BC6A4760C61F13A8352A1F733A15D3EF6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 6e71ee0055b35306aff56cab6fb7e260cdb5216080331b3e4bd803d66aeb6a36
- MD5 4313fc6eefa0865b3b95edf1b4b0d8cf
- SHA1 1689b91838d2460ddc139daead610d13ed402f5c
- SHA512 2540348aecfcb477d9d4e4aee4df417ba859372c226f27c968fe6caa3af1f606e6a71a64f6a6486df3f89b3ae126788c60579c65e68e92a3f7c0950acf206294
- SSDEEP 12288:yuXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:yG9UBKyH/sbsePGSlU
- TLSH T1E8C42306BE013D9FEE83BB7369151900B575EEB6E04ED167F08CE0292DBCB618556C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 2c79e8a610c33f6c928cf2420a63ac4fe906630d0b9e3c11a163216db691f972
- MD5 87cf7fa24685ccdcfe8373531b2397de
- SHA1 f359c67fd4447155867ae5b21e37d6be6d8f6ee1
- SHA512 0987233a562298b4b96ea5c9c310bb59e1bea35848e77e75a06fa5fe355e0e6ac7671b631b90a41348786e92af8f07be10b3e42ced6bbb8b851e85491aa11058
- SSDEEP 12288:kyXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:kq9UBKyH/sbsePGSlU
- TLSH T152C42306BE013DDFEE83BB7369151900B575EE76E04ED167F08CE0252DBCB618956C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 c8ec85b292713c81ea79a743e8111eadff8683f6c0ee348ae7ab6c39bbf91a12
- MD5 b5b104ae84d02a4899be57225f4b19bb
- SHA1 3cb15ea3e4d3066a2d3a9e370aa72bfb9ea3783d
- SHA512 53acdae23b1296e2646ad1bfe3dcd9f37639aab3cff2d8813ab019fe785be1db0804c2805eec0fd01e2930ec268bb62c5c492e9da8848fc1c7b7c64e4dd36d75
- SSDEEP 12288:hyPz5L83XAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:wzy99UBKyH/sbsePGSlU
- TLSH T1BBF41207779134FED567923588621A01F772B8324724CAAF639482362E777E19E3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 1a49c6eee98410545605470379f728c12331d587e5f3209af4c21cf69671c300
- MD5 a340fd580bdcca47cf5b04e45c472ce8
- SHA1 6728980aa14c75eb694f92f858e6c4bdc6aec02a
- SHA512 d3c82a18ba27e50e8195160d5147f94d42df9ee0816ec057ef7274b11a55cba3fbc3d9c663bf64e9dd4c9100d147682938463330ba263d7fcd00cfe8e2fb3f1a
- SSDEEP 12288:1uXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:1G9UBKyH/sbsePGSlU
- TLSH T1AAC42306BE013DDFEE83BB7369151900B575EEB6E04ED167F08CE0292DBCB618556C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 6e246e21553c4070135b24ffcef49ce7c2a8effde0f39d73165f997b1468df28
- MD5 4eef045f0e56880d526daf1e6550e95d
- SHA1 1d3b371cd27db3047aad5e9ef0b609320c6a6961
- SHA512 1f717f008476f1d7b127919ca82497a65de8d47973400d5f362080dce9bb9c0fa3c0122a8cdfd8b7bceb4b8536d0da3b895e0e3b2d2cf8f90f573b0ae9252b26
- SSDEEP 12288:NuXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:NG9UBKyH/sbsePGSlU
- TLSH T119C42306BE013DDFEE93BB7369151900B575EEB6E04ED127F08CE0292DBCB618556C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 63adece4e5dfd227c3cc7c9f08777a1a2b604d6deea2f2ee40da6fc5b0973285
- MD5 ee3c172f7fe094678271ca30e719fe75
- SHA1 db178aece37daeda1bf6ec4524acc79918fd24ad
- SHA512 71325c06f128e70912be355f6ef381f3d752bbd22bceaf5cbfea4e4c6b6bc404aaffa0427bfe8b6079189224da5908673f24c0ef50771b6f05fa3e9a0fe96c13
- SSDEEP 12288:dyPz5L83XAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:Uzy99UBKyH/sbsePGSlU
- TLSH T1B2F41207779134FED577923988621A01F772B8324724CAAF639442362E777A19E3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 c2dfbdf56a027c2f6c93711ae95daf8521ef1a112d269c594b3cbec261b0bcb4
- MD5 943161189886f5f4bcf4fb89095002af
- SHA1 e1c69b3a410c893fe58c00a1c38cc3451ececcda
- SHA512 ea3f2e61cd0ca2598522079580082b11b5e83bd5113bde9588d3dd37a5f9b90129249ed5027d1b70e6003ffa177ba33822d9159675fbbddb8099ac8fa40d1fd8
- SSDEEP 12288:/Cd9CWYoaLHF3z0z04PDvhpXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwX:qTDaLl3z0zDD9UBKyH/sbsePGSlU
- TLSH T19C050195B3501CF9EC67823ECD258901E2B2BC6A4764C61F13E8352A1F733A15D2EF5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 36eea4b4ade495fac58f9c628348ad66003ff1e49d64ed77cadb18cf8692f53e
- MD5 a3fe93b860ae98ad4d36cc8bcc79658a
- SHA1 8fd6846c8f4cd4135e5e3e20addf8db355696d48
- SHA512 4c74594375d0302312e1101fa106bd711052cb6ef638ddf5742710585e59659725c3900739ac4b99473024c2a6b3b62ebf1ff7dba512af8836e6b7a8fcee5176
- SSDEEP 12288:ji4e7KRdTfgwCHKy7GLbbdIv8XAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHG:j3vd9CHKy7GZP9UBKyH/sbsePGSlU
- TLSH T1FC25CF90F3E414E9F0B79A358D764501DA76BC6A5B31CA8F03A8651A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 6ad9838abd19d1aa65eb39175b5f45f86f54a8c8e7dd7b183ad534fd1e02557c
- MD5 b7177eccc07e55d7f6016bb7ad15c440
- SHA1 7ad91d03ae3c429f37bbd736f5679fd59537ca6f
- SHA512 7d88bcb9bd4fdb81cb2cab7b0ef710f524192305d32f8ff986e453174a9cf650e200814fe42a1576246b10d49765175b5730978b69b4bd24e9662caf56816203
- SSDEEP 12288:oZXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:oz9UBKyH/sbsePGSlU
- TLSH T18BC42306BE013DDFEE83BBB368151900B575DEB6E04ED167F08CE0292DBDB618556C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 b88c4c79c09f099d85b78fdaf56c629272dffeb2bca6f1baecbb58ae79568991
- MD5 33e2c43e00ce454ae632f10d7a011ace
- SHA1 d07fefa69f8ef64bdaebc3827557c61554a601f5
- SHA512 ea995b827d0dfdad3db5806fcf01a84877b7590057fa4f4954e7775dd5719b7a8ed3b470eff73b42fab19fdb60d088e25d45d17e0f7b15cd760e105471005815
- SSDEEP 12288:7XXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:7d9UBKyH/sbsePGSlU
- TLSH T1E1C42306BE013DEFED97BBB36C251900B674EE75E05ED126F08CE0252DBCB618556C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 9d6d46d87b9437cf5624b99dc83dab14c1c645b4c74bdf87b844a88d082af59d
- MD5 1c02e407e592c25bd0ca5bb080a2a7c6
- SHA1 f4fa112250585832d1915feb7901022acd4e5b15
- SHA512 786b5920803a42cef2658317474ead6f6af3b8c219e675c911f1149b995c7dc094214e5bea99d3d6aa6daec8d317600b60e5f9a1402f40b25669fc84e9e4b056
- SSDEEP 12288:38XAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:3I9UBKyH/sbsePGSlU
- TLSH T198C42306BE013DAFDE83BB7369151900B575EEB6E04ED167F08CE0292DBCB618556C2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 1bd07c61400f9f4237bb4abac26833e89e5bb40c7bc95327c25b0fe3fc3f9f83
- MD5 eff5799dd3bad8f79625a5adb619e066
- SHA1 8c84348c3a074e94de185bb7de6c966fe0b6ff0f
- SHA512 82d16ac4e1e6f6f05ddd86b8fc29e7796178c89df300968a26965cf54600519053325a4d63626c0941b845d13ce2fb73f5f768040d2623f8dcb1e7ea9b00ded0
- SSDEEP 12288:+uXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:+G9UBKyH/sbsePGSlU
- TLSH T1CDC42306BE013DEFEE83BB7369151900B575EEB6E04ED167F08CE0292DBCB618556C1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 edb146d9325499ac8e23ebd611dd147dcf3ca484cb2362715e6e07ff7edf4947
- MD5 421e74a688dfd052860f2b343d96a5c0
- SHA1 e3f54e4461f3f6e4959f024c3cbd23cd8837e6eb
- SHA512 77ffc40f156d144394042c5dd5c0ec86a7662f666975996c5ddab428fa08760d41f4e0489e15a2fafad5b543b237b22f5cb112e4461ca87538ac044f491451d2
- SSDEEP 12288:XZXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:Xz9UBKyH/sbsePGSlU
- TLSH T118C42306BE013DDFDD83BBB368151900B575EDB6E04ED127F08CE0292DBDB618956C1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 b79fe34f6589d4a5db5b8e086f63a1439512e2bdb919182fd46ef186e983755a
- MD5 18192c7ff349b643bc7c74de65b4b9da
- SHA1 8f23103c8279edd7852ca36174cd1c8f728dd62d
- SHA512 0afbd1bb5e089ba6f4874f20ee5a448eabe8aee2603a4cc1388a5d0a39de99c083801c91d1dbe11de577acb870867d6d19003922cd28f6760d6850aee08ed88b
- SSDEEP 12288:n2XAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:nO9UBKyH/sbsePGSlU
- TLSH T194C42306BE013DDFDE83BBB369151900B575EEB6E04FD166F08CE0292DBCB618556C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 581KB
- SHA256 c6d0d421e25586126a85c92c33d899a4f7f3d19dd5e91b341973bf983d26cd32
- MD5 cc1380e1e21d0bbd17d39bd0c6bdc326
- SHA1 d9bbfca586abdfc19edd989db09eec8e03d44df5
- SHA512 0822a3d3ddee5cf2b0fecf0c9f9dd769f71910a3966cd84ea7ecc68d1e7305e17559fecc5fd7b88e9254b61a62732aeb585ff2f4c0a40647931cda232aa34698
- SSDEEP 12288:6AXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:6c9UBKyH/sbsePGSlU
- TLSH T187C42306BE013D9FED83BBB36D151900B575EDB6E04ED127F08CE0292DBDB618556C1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 581KB
- SHA256 39a61ad9f8fbf23611a8d626e69f3f7463495864693ec70d78076eb367e57837
- MD5 b40a85ad28e2476965c09d9a92e05b63
- SHA1 1685f781015c310b48e9e26964ac0c3dcd19a7fc
- SHA512 16a73421b9db81b1b64a9a89eca6bc3ea069ff883e1619251220cd2e0543ee50f7c2c002d925e38d6f9dfc61de8d0e40d3a45701cde53ef3012de41ee883be30
- SSDEEP 12288:KxXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:KL9UBKyH/sbsePGSlU
- TLSH T1CEC42306BE013DDFDE93BBB369151900B575EEB6E04FD126F08CE0292DB8B618556C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 581KB
- SHA256 a83f91a23ca1947ae565203dda9ef9b658d9dda2cb978a91eeda9f1f666dd3f8
- MD5 53db2d62377c9d03ee21f227c738b321
- SHA1 03a668e3a7d26d84346adcf5d97298dff320c542
- SHA512 88ab17a47bfabf4e0403180e4ce58d04c5c76f11a955c12c92ea86b06063d3172124c0d7c7cec319b10d62e144ad7c35149cba73a5e3ebe6fb2eb9beab9cc95f
- SSDEEP 12288:qAXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:qc9UBKyH/sbsePGSlU
- TLSH T1D0C42306BE013DAFDD83BB7369151900B575EDB6E04ED167F08CE0292DBCB618556C1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 31f7d4f5230fc6270de13ba18efbdc2363299f5032398973fc5e1c0cfa6e3a4e
- MD5 6273724c1e4eb80a8454b33ce3d8d46b
- SHA1 5427a8ed138abf4a5f88619b51d5ca9013295a49
- SHA512 a561db13a0526cb4e764074bf2d7e10ca20a89c00f33f315a3986ff9de9fb54b7d5de5a2c07070c49ea47cf69f93e645a2a4f10d228ed6829c52919e20c156bd
- SSDEEP 24576:CfwvUk9RX6wkyAI69UBKyH/sbsePGSlU:SMnYI69UBKaUbLeSlU
- TLSH T14435D029EBD808E5E1B7923C9DB74606F6B1B8691B31C2CF1299536D0E37ED05D3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 9bc1d36de4c4afff56c4b0a46d9916f705860f74f3257ca1c2ff14e97baa55f1
- MD5 0d83a0377db3f47c834abb3466db3347
- SHA1 99e5875a4acea7278d599605a7cebb63b0c53aee
- SHA512 0e74616444d62adad0728d9be140cb2697049712bbd823cc15c9f53adf73b36c9228e92c5038d8e521d3b6b861331e90c6fce088b324830dfc69d23b04c3d13e
- SSDEEP 49152:fYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK039UBKaUbLeSlU:KySzPVUBKFbaSl
- TLSH T15F066C56A16801D9C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 de175c1545841a8a032b61a65e145a628d9d8ca25fa00b4f570427bb21a22b29
- MD5 24d1c6b0b1de469df6482ac1c392b0b1
- SHA1 dbbc21f68c2a91977e6a3bb5b78dcf7022172c90
- SHA512 e9b74e661bd4748dce2a76ed786de6259a5a517f6c9297b7060b39e6dc2261c9dc3443dc57611816d4ff33794bba90f5acded040e9e3a0b25afc33e317e6d9d5
- SSDEEP 24576:e47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY59UBKyH/sbsePGSlU:e47JUQjTirIhCnDHUPfF/H9UBKaUbLe/
- TLSH T1C265AE1EA3EC01E5E1BAD27885154A1AEA71742E5B31CACF2270827D6F63ED44F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 436e9e2d410510e19d4e3965b729afea072aa3a1e2faecd3ee6bba94788cdacd
- MD5 fc69bbd2b8e4f48900f853dcb968a85e
- SHA1 d596ede059f25a64816ab55a1297a9a77747b829
- SHA512 b43d31436faa97a053de18cd93cdc33b219fee419804a92ed09a7b7b8fd2def9ea094166e5f6bd32be1a291ada0f4851eea797c45070710737f8a19b82d4ec65
- SSDEEP 12288:ubsfeXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:129UBKyH/sbsePGSlU
- TLSH T1CFE4010AD24416E9C46EA276CB555A00F333BC6593E5D3CB62C0F43E1F7A6909DEAB13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 ee792a17479b25a88b991ed98721cc369db4d6f257ab3f894f2780cc913403aa
- MD5 6a2f9e2faeb35ae6b36dc704a7f4442a
- SHA1 cf8868310b65ad8fe445389e77a35d28cf981126
- SHA512 f55b3988196aab3239105bbbcd22e017c99bf341c9f9d938db596b839f24e435d18f096aa2791d0702c1cb3e3fc61a0aabbfeba781ebd842235746f1cd49e165
- SSDEEP 12288:/hqTYVi46kTgnCMiAPx0m4xo+W38aAPmza:/MTYAUAuTxBW36Pmz
- TLSH T1B8451611B626D74FC6AD40725E32D5CCAB70BD42EE44AB0772C8473FC576658BAF2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 73a7db88eaeb82f9ca5f5f295d9abafc288472766f57d4d5caf1be50a20e9986
- MD5 8962c430157b69e63559367e50999f2b
- SHA1 421d8589a19fba62f08624bc25c07f41d0e36026
- SHA512 506b83c28dedc51d20e7ad1bfffb04047a2f235680531b61aa6265491551131475c031fb2ecd4269a81b91f06bd0fe5b935bf0e5e037d3c50c52170118d9cd4d
- SSDEEP 6144:mfKDe1HfJ8XhCxKYmYw2VGOt+qe1OQWWzufKDe1HPKDe1++AcpHm8VfKDe1H9fKm:6x+Oz6hSNJmU
- TLSH T1A965D7409536A38FD2BB60B207365F4DA764EC027705AF2673CC447AD86AB06B5F93C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 7e83aeb356d43a022bdd8c55a549e1c461357c9b8aa83017ee75e18264ef0907
- MD5 0952e47f5ab41594bacf1467be53d283
- SHA1 a5d9c05d15fc78860539721c2abe12724143d7cf
- SHA512 d98f69a5e563f7cb849dc9f34272f29126c1c1e2203a48890ff1f744a4121aeee4c19cfa8275b9d9f09c4e9a021160fd845c7550d08a6defb45a0cbd95a57f65
- SSDEEP 12288:kM7mXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:F+9UBKyH/sbsePGSlU
- TLSH T140D42302AB407D9BEDB7BA7218295500723AFE749749D1E7F048E0292CB8BD1CD76D1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 67abcaa88db582f404e7d6e72cb3d5a6fa6266212d6f1118168851be13661900
- MD5 d23b3b7f97d373d05c86296a87075eb7
- SHA1 f02ac3c17894a708973ee2786ed2b5a361194860
- SHA512 bc21e59f899bb69b865296adcbb27e00048f226e42701d809baef46b284aec19df045cb2ee08ca495d8918f4e4f0c5b80ba03b7bce78c0de2d72bef3652acaac
- SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYg9UBKyH/sbsePGSlU:Vgb4mBIBhGF59UBKaUbLeSlU
- TLSH T16965AF1E22E802F5E0F6E2B8DDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 008690580f7f39926e5690a0845b6a79f089e54fb6a1fd6351fb343d7003ef97
- MD5 f56d22476ae71012b1d54f12207e7cfd
- SHA1 c4880d9e1f14add5394742965b4ceb1aacf7a2d1
- SHA512 4373e5ce7a0ed5e8d19d827f7508082b209687351082314134b72b6f366ecd39ce91530a25f6d7ed66a389f164e18a3d4befd72d18539587f492cfbfaea2f519
- SSDEEP 24576:bG88u8FpJqH1bzria7/mp9UBKyH/sbsePGSlU:67ZFPqVea7/o9UBKaUbLeSlU
- TLSH T1E335F12577E101F1D47BE13889864663F6B2B8250364EBDF06AC8A551F23BE14B7EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 c8068bdf0424c235544e49114ab51f7dc8dd91e26065c7cb30188a95de0fe2b0
- MD5 1692d8a0144d5c903bdc2b3518d8ac6b
- SHA1 b3639a9db773123cb5d419dde6541c300a12e13a
- SHA512 6196bfe6f0afe2ad5233dc694f919ef6ac5f0450c4bb82710063fd1a487cda507681f91f48641127490c54df7383ae79feb8686453a45a3a4e74f9573afaa0c0
- SSDEEP 12288:5HvUrBFrEjwaQvXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpHVwLJeU:5PUr+NQ19UBKyH/sbsePGSlU
- TLSH T19205E11F66981CE5E676E17D89828609F771B8621312D2DF02D0813E1F77EE8AD3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 a11c4cce9b3bc41b14abe1b3c2a3358d75f1569524441cd3ba7d087de161e014
- MD5 760f308f84ae81b44307806f64478be6
- SHA1 504957be1b4704ce1e7384e99bf1bbfdc69d0d19
- SHA512 8047e23d9830c646c6cd186ba061fab7688768c73dd937830910edd3b7272b092d8c7097a21fb3d088fe16a368fcf10e3913e8db86fd487b6a66f4befb48d9d6
- SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjl9UBKaUbLeSlU:YG05lO43bSUBKFbaSl
- TLSH T1AAD5C06A62EC11F9D0BBD17CD9C64A0BEBB23825033556CF02A486A91F27FF4557E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 dc35ee3983c2ca541b9ee6d89a8ca4d02c9efc10353a57e42b5b8cc950ff9c7f
- MD5 e9e2c6efc71fcc61fad086544d842260
- SHA1 dbea55d54b9fa251a89df0bcc4a027a9393d699a
- SHA512 9fb18cdeb0ed7480844adec1c311789693d376fc49ee5245dc3e65b316c7c9e2ec3329505b0b5f84ced32dcc7402fe23791a63037d40b46b1e841b2408415741
- SSDEEP 24576:hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn39UBKyH/sbsePGSlU:ha5POZ3BJt2pasx2+md9UBKaUbLeSlU
- TLSH T16A65BF5EA7F801D5D5B9D17DC583460AF5B1342253329BCB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 7fe853f13a159a3361173b6d0fa308bdf7e8e803ddf995d1b0fa07c30f7c8083
- MD5 c1dc755c627f74a965b60d1f2685a9f1
- SHA1 53a545c944a0d22c9a58f1d6d9e208b0d73110c3
- SHA512 dac0089e926731692cc5888f5bdd39d019d9b04658127d822ae7c9ff80c76de54f0ed26efb281a949679ccc95774bdf86bd271dd75e9e22eaecf3926d5c005ff
- SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FkB9UBKyH/sbsePGSlU:ONc/zEOVHFI9UBKaUbLeSlU
- TLSH T1BA858B1623E901E4F5BBE1BE89779546FA71786553308ACF0291811B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 82a4e0d5650cc1c9966656e5f5e56e01322d01ed48adc10b49b679a93706c71d
- MD5 3dc5c96e8ab08b9dbf47921460b8efca
- SHA1 fab55dd7edd9106d898686297d1adbf58dd616d2
- SHA512 ab6731d254084206c971e557256a152df4ca4db2b6bf1c9c4dcddc0370b224580a057d4121a81ca4bbdc65c49e8ade50982e2e564b961d6402a281352e48a935
- SSDEEP 24576:7TkNvNnaFeYhJNtmZBmL9UBKyH/sbsePGSlU:7TMwBtOmL9UBKaUbLeSlU
- TLSH T17255AF2EBAB806E4D1FAC6B5CD238512F6727461073293CB5290C13F1E679D89D7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 9c8b0e876aefdb4aa02afc0438fd23e91367af78f4fa3bca0973c59687d7e723
- MD5 9a6228124aad67f80eb6af6bf2d61369
- SHA1 50ae5922653eaf3fe48db1bded1cc894819f23c8
- SHA512 4e9a74e20f9ab640240d3ab42959fead0a184f088c646ac6827b195e6e15dd5291f2815aeb19b7f58e05a2da82c37812e887f6aaa8f273f80698cd64b04343ed
- SSDEEP 12288:XQcMxWDXN1Dp/fshBItT1IQgAaXAmzaOJGxfBkmUO3H/oN1FAXeAqLRcPWeHSVpm:vD3FHshBIYQgAy9UBKyH/sbsePGSlU
- TLSH T17425F13EEB5804E5E47BD1BCDA638A02E77178A9032256CB11D4C17A1F6BEE46D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH