fd87fb4e13838037251c3afbf58f83b6a7e8d45858a56e0260482c15d33ca413

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe
Size 1.2MB
Sample260709-3bf4faby3x
SHA256 fd87fb4e13838037251c3afbf58f83b6a7e8d45858a56e0260482c15d33ca413
MD5 fd93be02e1b8f9b6fa6bfeec0f8e52f5
SHA1 b070a109414adb843a7237a2e0e4b3b9487eeade
SHA512 73bbdbd0076ec86fbf05ab3ce4ca0dd5050b6fe01081a4d29865a996bd71dd98164993cdd882dab21a866eef1becfe3ccb811d67d11ef90b5f114ee33ce779ca
SSDEEP 24576:g9lxr9ZUN2mdDM6s2f763J/mB0sqFlXN2c:yr9mNh5rh6MBH
TLSH
T151556D1DBB6890EAE2A1C2FDC642A659E336FD38473145CB4310552B5E7BCF81A7CB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4568	elevation_service.exe
3340	elevation_service.exe
5908	maintenanceservice.exe
4884	OSE.EXE
2104	PerceptionSimulationService.exe
2660	perfhost.exe
2348	ReFsDedupSvc.exe
3376	SensorDataService.exe
4604	ssh-agent.exe
1560	AgentService.exe
2872	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\942dc94ae62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000454e1189f90fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024021989f90fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac634a89f90fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e32b448bf90fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001968cf89f90fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e75bcbcbf90fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
4568	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5080	2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe
Token: SeTakeOwnershipPrivilege	4568	elevation_service.exe
Token: SeBackupPrivilege	2348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2348	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1560	AgentService.exe
Token: 33	2872	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeDebugPrivilege	4568	elevation_service.exe
Token: SeDebugPrivilege	3340	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 5808	2872	SearchIndexer.exe	98
PID 2872 wrote to memory of 5076	2872	SearchIndexer.exe	99
PID 2872 wrote to memory of 3524	2872	SearchIndexer.exe	100
PID 2872 wrote to memory of 4128	2872	SearchIndexer.exe	101
PID 2872 wrote to memory of 1136	2872	SearchIndexer.exe	106
PID 2872 wrote to memory of 3364	2872	SearchIndexer.exe	107
PID 2872 wrote to memory of 5872	2872	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5908

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2104

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2660

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3376

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4604

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5808
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3524
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0132730964de12a446c91dccd25184c5805c11540af3b2799a61bacd5ee06784
MD5 6838239ea8756bb246f8978dbe95aba8
SHA1 bd5363df2ad2555554e9a0e6b844c4bd7694d7a0
SHA512 ad96edcfebd6266816987d2c357a9f0f01df8862a2802bbd861f7538a061e0ff4a0e412ffcb9baef484caf1072f920b8cf3594acb9c4157cf28855327d44b4fa
SSDEEP 49152:kb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnr6MBH:e3q6mjBO6S
TLSH
T1EBD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ccbe8546014b8826020781f28d6b44822be2fdf3b38348c0df42400023157c30
MD5 3d53ea1e3189aa736a21b5884fd742ee
SHA1 bf1886b950e4a560d16e73b9084d960236c7b0be
SHA512 883093536d18f1e0fabb49711ba302aa26278f53a4d04a2a8fcac9f855225a0d4002952f75a7f58dd5a3bb2620627804d3a05247dea2658cc9cfbf43325f2bc8
SSDEEP 12288:a1XLsswWkxy2lRq2czAS63dT3vWZqqVB0sqgyIclmHRG2EkG7N2D:wXYfDtczAS63J/mB0sqFlXN2D
TLSH
T10C05F12867D508E9ED67827CC8A18511EB33B89407A0E79F03E4DA251F337D96E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b425d4a2d09ccc25480c2551a2749fc40fc1aca131e4275c43a3f80f8d9bfb5c
MD5 ad7409bb19300f8f41c12f7f82f059b6
SHA1 54949be7459b71fc7511306d1bfb3dce11446cc8
SHA512 af4233eb5e901f7d7aca09b4c39a9cfb4c7ac7b342de086fcadbebc9adf4759a01d3e03b2033b605311c8e85642c69eb747f98929bc5f103c0926bed0048c1e2
SSDEEP 12288:pXZNYVLeyUji0h90ZD0wxpGZIVuGrHsj63dT3vWZqqVB0sqgyIclmHRG2EkG7N2w:/0Le5ji0hmxhrMj63J/mB0sqFlXN2w
TLSH
T1E2359E15F6788371D073C0B9C5D2A69AEE7130851B308ACB5286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b3b94119f6a8378316e656ecd5f8d62355a8c2aee62112a70e4af2678389f83d
MD5 f54a7623c4ffbb5c824c3328c1af50d8
SHA1 cddb345e689736e3ca9818e239a3e281486bd950
SHA512 2ebe9e9611f1c1e3595cb42c0ecbbe1d599c920b8827d113f4b8d50bb9f97d9b9056f44cdbdd6246965132f5e9c263e2808e2a5c3290ef360f7b99a32df00855
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWj6q8wyul63J/mB0sqFlXN2F:Q/ezSC6vUzPv+HjyU6MBH
TLSH
T1FD755C15F5788323D0B3D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b224c5b18f391baa1b38f7ee6bd7e1c59dd3eb038173b741a020776358bb25c5
MD5 4600464215e08bd3158fe4229477c4e6
SHA1 5f12da2194975d99e832bc56876d4565d0e473ea
SHA512 8408ab17d78b18c67f28c0cd89425526a2d3ca6dca9f3fcfa691f13a16035d5821c85c8b66c6e103ed86a66550269335effb5d588224414ef0fe2e9e77751968
SSDEEP 12288:VVJjBq33vb5O8M+l1D0hwsEBoW/lx4/f0Im98e63dT3vWZqqVB0sqgyIclmHRG2p:VVbqPb88hv/l+Be63J/mB0sqFlXN2L
TLSH
T146559E65F5B48321D073C0BAC4D2AA9AEE3234415B31CACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 732d175fdef58bde29b79594e272b679a814c39b4720f59e97f2a6061b22639b
MD5 012cd65e82257c98b17788056341e47c
SHA1 efcc8184f663c72a87fd22e7e52456fdcb98df3d
SHA512 dd318f54b98148fef712265cd53ed4cc5a29127159c01814434469d944b83a951697e7ea9c3b89ee8eada943a4601fd99b5fc5d2a3ab213a86b0dc4aa2104a41
SSDEEP 12288:/Gf63dT3vWZqqVB0sqgyIclmHRG2EkG7N2e:/Gf63J/mB0sqFlXN2e
TLSH
T186C4230C05CD24C6CBEB8E7885F042A5DB25ADB40AE0D93FF4D1F7211CBAA17F664A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 b194f05cf289c3663e7205adda06dec7498913a95a05a18438dd715287e1cb49
MD5 485b421e3a7f88b1fa1dd9b73bbfc8ca
SHA1 aa3ec515d7eae685afb67b316e3b3d74fd24d2a8
SHA512 d01bcb5fa03c9cee0de4def3525bb0b91404daaad20b04499ee5519dbf2b2477294541ce4e6a09617306abd3c428378548c9f3ff5c6ae44a0a98a180f796e460
SSDEEP 12288:UeBNUbTVO86UW63dT3vWZqqVB0sqgyIclmHRG2EkG7N2a:UJIUW63J/mB0sqFlXN2a
TLSH
T1B405CF3BAE28FCD2C27E8DB856918740D77278704B61A3CBE165C30E9E235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 52f604fbee74ffcaf2c835a347554b6f3c54153f3ebf8be0cac95b2ceb41349d
MD5 bb9fdb7676adf04bad2070a6ac235f1c
SHA1 f7064a43f915617902186fece9994fd30799ec19
SHA512 6e8bf08b8f069bdd0a8b9ab1bd6ce3f03b2c1e1411ae595c71079c520ae98aa2131778d211f27f27051ee374f6c0b1d6931f08577aec36dd738740ec6515d2ec
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THw:ZQvGAdlCEL8c/WRNw5C16S
TLSH
T116266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6fb3e025db1472bbeec4f2b49c8c4218e2d8e550945e1eab0b038a3b5cf07c6f
MD5 65c8619e3b9a980e740be974c09a1e90
SHA1 1b8952af743e0918d03c3c0e5461c5f7b11b5ecf
SHA512 fc0d6a1d1de4ac3faae6146f854b46d7d02e36a91a82cb58c287d52ba210bad0e3e992477a56875991f8c3fbe9946799d663799d1b3d08c8fcb3d93c05911a98
SSDEEP 12288:RAwSfxL/2Dc3mDLLmt0LDQewsAjw63dT3vWZqqVB0sqgyIclmHRG2EkG7N2v:yfewsAjw63J/mB0sqFlXN2v
TLSH
T13015E030EA78E036C7BB0DB61B35C716583CB9600BA119C7F3E89A9D59702D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 efb914b4d0c7030223f073131b94e849952cd77daa4f0ccfe953e5e76cae980c
MD5 7d31ebc4685cfc724bcd30af3bf18c15
SHA1 ace68891c2f4893890cdbcaa13ce6c532ff1c5ad
SHA512 c85c31f28b37631e05b0901fd462acf47e636c100a8aae1b59b3a0390f8888663c18579051b5bf33fb551e6018018b7b8a05ed910434c2aadb4925262e79f4d0
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHY6:nUEtQevvqc2W1cpV20I32P
TLSH
T1A1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 13938ac57676431c8e0c45772b75cf4a7222886b4970bda8c5a30db8312eee84
MD5 ff4a3684a5587c6820a5bf462b0ea53c
SHA1 c4abd72f09e57ddb498d4e225f44529464f0bbe3
SHA512 d88290ae616253d374132395d86657eefe46bb51e6afa10277c08200ce77ef695b1615aef02c9ddcfe175e4d86c79934aa40ed2a305bdad5c598add7399ee8cc
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/zQ6MBH:toqtVjnmZ6S
TLSH
T11FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 23030164820b0009cf2ef3b037c651229b8053eccb0ee75b866ffe41ca4996fd
MD5 7f1c249b95e492c2e02fd35c28544531
SHA1 006762e78cbef3be2f10cddf49b48f0a0193be4e
SHA512 29bbcba9e39704a77b175cb8719881382ce90aa7967851cf0c4602035790dfcd10274ed04c9c3423fe37c2a2f7e10272212a3669cf38e9f9352fdfe22d6b3d00
SSDEEP 24576:IAhGL6IFoiwtA5l7S53563J/mB0sqFlXN2J:IAM5Foiq5p6MBH
TLSH
T112359D80EBF955D4F5B3AAB899B68171EA76BCA55E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8ede4972b64ce3721e13693840a913ec6f404f2e7387898ee7d419758b7566f2
MD5 26cf3e3fb439c586aaf7a4aa174bc591
SHA1 2f65e8fa24480622b2e56a8043bd1cb479f610c3
SHA512 46fcc9d3001856404baf62adf5d08cb927da627390d5ca26980e8b723365706365b5680b638aab005d29faff1422e328011cb4a5aa9314606055a9372d8ba249
SSDEEP 12288:nmw5HEjsChNEBFgl0WDm+CF63dT3vWZqqVB0sqgyIclmHRG2EkG7N23:mwuROW063J/mB0sqFlXN23
TLSH
T1FB05F10926E91CE9E9A78638C593C136F7B2B8112A61D71F17A0C7575F37321BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 83db7680f5d7d52374ed8665090c3ffe9284e93092e58bc64ea30ee0b184803b
MD5 5365f443bb593050ea6370970e01db5a
SHA1 eadc8721818d5d52bd2162ddc6ca289d321e94ad
SHA512 050ff5072c5b5559ac18b40c3f5405dd2dc8241464fb7b3c33237a22bbf63653aff32ffe09ef9ef112a834fce161bf53022718267e93f23ac0b4f175bb9c4bcb
SSDEEP 12288:myZ1IyA63dT3vWZqqVB0sqgyIclmHRG2EkG7N2H:fZu763J/mB0sqFlXN2H
TLSH
T1A4E4120D12DC30F9D6A7863CC9F04645E77278A027B183DF65A093661F73AD66E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 23a50e9d5d3baff63aa42b4138695b86626cae7d8a6b150ddd6f544fa8f0c8e2
MD5 8e3dead54e13e20eda912d6f5571e02b
SHA1 9134cb514f97a7645ef2b263bbbb4514908350d9
SHA512 0abf108e525273f2d20e7f3a7217848553120ebe4cfffc4e553cfc85ffcffbb392f5a9e9f84cab0516e75802ab0632fbdac24cf09255bc701ff428bd5fca15d2
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uc:HQRQyi36YOcPDLvw2gAf+PN3q6S
TLSH
T15B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9b0c04be172e357faa12584c9e2e8a1fc4a9f2987f14fd57ea1ad2bb1c024ffc
MD5 9df0d6ae291b90ff6ce1779ba49620ba
SHA1 c9f2f18012ae6e5efeb59eb3fe11262c43b6dd18
SHA512 1cadb4396a001f1260cac5183173f8d33c46be5461f3f284a6822d890c2a4fa306147b4a2be4cd8a58b261cba3d32d348235dce2657620a92ddf567813422391
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uc:qQRQyi36YOcPDLvw2gAf+PN3q6S
TLSH
T11C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ad39dd4de8959780e581041ea3ae227b1485d2a6a88e715190e159a879fb5bd4
MD5 244a2741625b3238e97d917035af3eee
SHA1 eb4c6baa2690a93a9ba7c52ee54ada1238ce2624
SHA512 04c3d01d1288192e1432193809d57184290f81a825e489246af84b0500c5a80db686bb88184936e24946c700d99fab01d7598b3606326ed26a1cb03b91053ac3
SSDEEP 24576:PwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0r63J/mB0sqFlXNm:X68Qg55nhkeWu7PNU3/g6MBH
TLSH
T1AAB54933B2F60099C44DE1769F4A872196E27C758FE0E3DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4b7d23a972db6903b8e586495ce4b19209412ea7f9dbb0a2b261cb37ae925756
MD5 c7041503b22742aad651a87a2e9e36f0
SHA1 fda83d4c25a8f0d0de3a71efe65e1c9fcff5f5d3
SHA512 142c51a58cd30c787ecc932f3e7b899fdefbfe9b945bc1394b7ef311d45c52b0288606409331e02371bb78dd6c39b4eb7dd3d688675750b5d990d4fe9abfd806
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99y:my5112gYy5azzVvU69nLKnhZf6S
TLSH
T10B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d62d1254aaf7fcdd918b74d214b29e581fbda13b002c1edfcdf59688591a8e60
MD5 7a9ad3c0b0bde784d3b50981f8bf9f82
SHA1 0d8828992d4ef6b06997caad5a6cd1c59ae8ff81
SHA512 29a43984c8855205128babb5c60ec40c89f0be2102286ce44c0e1c9f288042a7473199dd238af725b6d63cee33575fa6696fb4553b1e65f71bdab5edaa652eee
SSDEEP 49152:pB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gli6MBH:/u6JmIxd2di6S
TLSH
T1E1D59D13F1DA01D8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 eae5511b4866ca48b0a812fbd632bdbecc444ddccb851e57d2c15c2d9731e557
MD5 6c4ef12502fadc44d569c52099de194b
SHA1 bac20c218e18216f96bca0df4e47f1eefca5bc25
SHA512 db986f2ae28725c06ed8176681224d9af2b9140ec0248714f50436c591cbe0da79c9eb43608b38ffa019861e626c8c8f012ce3ab0ab452fdb4697dbef12e3030
SSDEEP 24576:Thv8E1hps0+ogd2z615uCMVF1Agz6oUQ1zNOgLLwH7ReaQXx3G63J/mB0sqFlXNO:51hpsNoJpF1A67U44CwH7R4x26MBH
TLSH
T117B5AD13F2D901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cfd90758fdaf5a85fbbbb99337a0c5956545945ef6d66aa0e3ae8e880c9addd2
MD5 1f11aabd9b73b0f33fe6ca2a9050b6fe
SHA1 327038b236a1228002603493e32ba694ccb53108
SHA512 3dc7e011e1f2cf7bec66ecba752088c6b14111b7fd91ac8371f2376405851e07b4a05f2a8e7bf88130525cc57050d41098ffeb58d566e929d11f6219786b4c9e
SSDEEP 24576:U4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6zR04FxGgVG2Onks6xt4bSMHnq763J/mBX:ESuZQIY0Be2KkRVtOnks6NMHq76MBH
TLSH
T10EC5BE03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7abcbb86e7c15fda8f9627c719c35d0092dfd64b70f028ef6289328f2cbb0600
MD5 6e8345e3583013de7ddde629ace94029
SHA1 d59b42c40ea7ad44047957ff012d4b71524d6b68
SHA512 41824d63a91e23c0371fc94bac6876f3ed0594b62b76469a62183e26f794a15f71f10ec63d0cb38943b2cfd8c3baf9870dcd4975dd060fdd595445f507daaaf3
SSDEEP 24576:+hiavrPSLT8EARn+FgyUgd0fJY6Bji3iy9CTn0AP5+2QLG63J/mB0sqFlXN2J:+htSn8EApI0figjgiDn0AP5wS6MBH
TLSH
T17595BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f0c4511b33f4ed2f1a7d4397b627172ce4d2550b0b1c3ba35c912f5fc2896fbb
MD5 b955074a9cef5a100a9e314497c96ce5
SHA1 b334df5686388ffbc64e28055ba13b1bccd25cd1
SHA512 a6946f2ad05fb4aea8ec6b7971c7251237578e978dc95a34c6f9ebb5f38f7db6072b38ebcc5f61303a70b25b22a79380c548780b3039bbb114cc0dcc7fb4571a
SSDEEP 12288:4X63dT3vWZqqVB0sqgyIclmHRG2EkG7N28:4X63J/mB0sqFlXN28
TLSH
T11BC4230C08CE14C6CB9B8E79C1F04294EA286DF42BE1D47FB5C5F3212EB6A277A64D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 08ede776d8ee59099aae1cd1e1abfeef882025f1d19eaed37fb3c7ef6d883640
MD5 b7194b0466c9b16a22b452491a8b581b
SHA1 b746164f9a6289e1aa93709fa9c17426bd5c7d54
SHA512 7619295d21327877c5cfcd2645c1b1d223d2eb3084203ad25c25d28295be80dd6e8f7f1b45000061409bb2b157558476ea5edf8a0c705be4dd52c1b99185166b
SSDEEP 12288:4c63dT3vWZqqVB0sqgyIclmHRG2EkG7N29:4c63J/mB0sqFlXN29
TLSH
T1C5C4230C08CE14C6CB9B8E78C1F04294DA286EB42BE1D57FB5C5F2112EB6A277764D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 a9110fbda97abc7dc51e8b09d4dfc0faa7fbb37e69ad1e1de21815e3392891c7
MD5 cacec0945a461be55a8049f1bebf5fcb
SHA1 2cf1fec04a3bfc01efb13e22daa201c1c176af65
SHA512 e097b6ac2967d2e85472764c26b1074dd47f44bf2ad9363b81f3da2f765d8a5f4ac00c92e301381348b771c0f13096190d3f9cf180ce4ae6cb28e37d575b1360
SSDEEP 12288:9O63dT3vWZqqVB0sqgyIclmHRG2EkG7N29:9O63J/mB0sqFlXN29
TLSH
T1D3C4230C08CE14C6CB9B8E79C1F04294DA2869F42BE1D47FF5C5F2112EB6A2B7B64D95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 bc2c24e77c1068463ef3e37ed682b364b90ea795d1b84dc0b32b3c81de8ead72
MD5 8b702dc6662cd65385cbeae77b9ea605
SHA1 a815be98217b91007f53dea35679f204b5d4a885
SHA512 bdf291daf696581178a73131340659bc93ae72e2dad99d1bb4243ea809dae5b2eba71cd9f0d25018a64bf9afafe87a98cb07eabb15ff4e91ede832d1f9c53af5
SSDEEP 12288:kVZ63dT3vWZqqVB0sqgyIclmHRG2EkG7N2U:a63J/mB0sqFlXN2U
TLSH
T141D4230806CE10C6CAABCB78C5F08254E775BDF417B1E6BFB580A6111EB2B167A34F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 00e9dbb33945e26b45084cdda13aaf2ebf418e82ae5adad2535f8498c21ffc7f
MD5 e3e34e270d74e2031070c469146f3f7d
SHA1 e61eeb004343ae309afca73883560174e1dd4d8a
SHA512 1ccb7b9b2d9b0ab080e69301d52534f7b176817f3cb7457b8748c65316db9ec3c89e5afd05b43fa08ceaf002e34bfcbb7b6989e9d3841dd40d6c68b7254b04a5
SSDEEP 12288:vB63dT3vWZqqVB0sqgyIclmHRG2EkG7N2H:vB63J/mB0sqFlXN2H
TLSH
T134C4230C08CE14C6CB9B8E79C1E04294DA286EF42BE1D47FB5C5F3112EB6A277B64D95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 cb8dd28b70bf9140d27ca1e4a9b28365435c89f788a50301d945473f01bbe0dd
MD5 c281f264d4092e99f9e16119c7b31791
SHA1 a4bff08367546ffa88ba0164aa61bbf2da62734a
SHA512 dda8ad7c7e66619c05064a2b856b587864a26b721bf9d1c8152e98d80e3454afea802b93fba444d9669a1f7696a71bdeb8fe10b21e8b1285789373141b50a030
SSDEEP 12288:Mo63dT3vWZqqVB0sqgyIclmHRG2EkG7N2H:Mo63J/mB0sqFlXN2H
TLSH
T154C4230C08CE14C6CB9B8E78C1F04294DA286EB42BE1D57FB5C5F3112EB6A277B64D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 e3a60b6395f753a3c9ca07d7f4a12a101fa2d76c99f50ca2220ca33569079479
MD5 464395a5402121ee8a44a135d496500a
SHA1 60f04642130b48c68c390a22b0cfcf92e67f3203
SHA512 515120737d551547c58b7b6a4361de9b7e139a1a27fd2b404978f9809ca8ae8a1f36fe1071706ce9aaaf26b2528ebf9347b9659889864f7bc19860b180e4c713
SSDEEP 12288:xk63dT3vWZqqVB0sqgyIclmHRG2EkG7N2/:xk63J/mB0sqFlXN2/
TLSH
T1A1C4230C08CE14C6CB9B8E78C1E042A4DA286EF41BE1D57FF5C5F3112EB6A277A64D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 41fa5c9516d388576703b34ca556c79452b573e3c0d3bf4034564d4e1903a685
MD5 1f87dfac8ea5d1e7d385f89cd2180fc8
SHA1 2d856aefcf2f8e6c7d5f8343e241571f957c90a6
SHA512 6907444e27b520c95bdc222ea4617d8006d3fc3e079e3ec9bbb040bc0236a322cf8597294748419016913b003b26cd43c3b3380d890a8436fd86ac53c42d9f0e
SSDEEP 12288:KiZwbDzzFEoS2cPvy863dT3vWZqqVB0sqgyIclmHRG2EkG7N2v:tZM3zFVSO863J/mB0sqFlXN2v
TLSH
T180050158739418F8DDA7863EC9618906D6B27C690BB0C61F13E436261F733621D3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a9432a6c7bcc799cde7191e9021f4c7bcf3c8a2ccccfef4ef8717cb0e26500e4
MD5 3f2baa4057f5ce2496bd16d7e38e4db0
SHA1 d5b9dbc4ff1244a64f8fa1cc5dfce23b5984d242
SHA512 e614dedc63cdeee5ce2a312553a15e27ef7518a9c4b7ab2520fd62c9ac20219310e5caf3bdaca022370a8f31cc8e5bbc2278168a3b4f34c9c784cbb437fe5498
SSDEEP 12288:PL63dT3vWZqqVB0sqgyIclmHRG2EkG7N2R:PL63J/mB0sqFlXN2R
TLSH
T1F3C4230C08CE14C6CB9B8E7981E04294DA28AEF427E1D57FF4C5F3112EB6A277764D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 48dc2fb68ecfe61b6e7be274020d96e4748070c321d469a32f1da6f722b81aa0
MD5 ef57fa55d13394bf265b3afa2d3527c4
SHA1 e6b1cf8e43818125dd1d279a1489a666c834c526
SHA512 59fdb67375bbd4517bae09f8ba52ba6dd06bb458ef32a169f2e9cacb4e1cc2d6898ecf1f314464a167753a84f2769eae25c75e8e32a600754bc2d5f63da8e0d5
SSDEEP 12288:dv63dT3vWZqqVB0sqgyIclmHRG2EkG7N2Y:dv63J/mB0sqFlXN2Y
TLSH
T1BFC4230C08CE14C6CB9B8E78C1E04294DA28AEF427E1D57FB5C5F3112EB6A277B64D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ad899acab5be215e96ff7ae4439a9d3b934e21ee1bfb823dcbce780779a865a0
MD5 94220e5c2bc6c971b0bdf4865bbf9242
SHA1 8e1f7ecad8a51ac701a88952b1232139fd97b9e7
SHA512 25bd5ef17c6287f40407709f9750871b6c9a95835576933f6d8bd4c562c7cc18836aa1da5a04d81b68e35beb65fca5c0b6d68b401ccd996e363bcaa747a36316
SSDEEP 12288:PyPz5L8A63dT3vWZqqVB0sqgyIclmHRG2EkG7N2K:izyA63J/mB0sqFlXN2K
TLSH
T1BBF4120B22D930E9D1778638C8A10A41F775B8750770CAAF67A453722F777A16E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 65e78532536be79e82d4763a1fb1e5faee47fcc484d45b1940105c09011882d4
MD5 d0380e57754a324c58b8672d49a00acc
SHA1 ae112dcddc56e2cc38567c6e19e91b4581c722e2
SHA512 d0774b6459449c693d121a54df904880fa8ee9015db828911fc82040aca57b7c81b6272909341337a6067364c8b0e753bc7654e05e6ec2bc605479fb8ef1069c
SSDEEP 12288:HL63dT3vWZqqVB0sqgyIclmHRG2EkG7N2r:HL63J/mB0sqFlXN2r
TLSH
T182C4230C08CE14C6CB9B8E7881E04294DA286EF42BE1D57FF5C5F3112EB6A277B64D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 b6e26024b69a348274f9d9c75e8e9c5b86158c15dd4cc219bdd76e83a329c879
MD5 8101d55c65e8c79c59142fdcea2b40d3
SHA1 f2ad6ae9aaca6e8a87cac36648137cff2a97a94f
SHA512 b0e5bd03d0316c2dee21be24a3449bbe6c68cbb844cb5ea41b40af3b757d5e2b5f4944895447fae4279ee039d0661cb1654a447e6e727e47f0965b4fc062eede
SSDEEP 12288:VL63dT3vWZqqVB0sqgyIclmHRG2EkG7N2r:VL63J/mB0sqFlXN2r
TLSH
T18CC4230C08CE14C6CB9B8E7881E04294DA28AEF42BE1E57FF4C5F3112EB6A277764D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e30bea623e9c22566ae6327c849f67c65e3115ae6e2aa24e627a181bcb555e26
MD5 19dfb4f0ffd976a3769b3e724a945808
SHA1 6a47d3267de76c3233f376ae0093117deb905f42
SHA512 9c1b57ca1d43a93bd0b31f7552e2679f7b2c4be6885f47c9c3d8795e7d0379118c06ee20af6dbb231452e891b1cff33f90076b20ff5a33ac9ab8fbd23eef4101
SSDEEP 12288:qyPz5L8A63dT3vWZqqVB0sqgyIclmHRG2EkG7N2/:3zyA63J/mB0sqFlXN2/
TLSH
T114F4120B22D930E9D1778638C8A10A01F775B8750770DAAF67A453722F77791AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a5404d7a09f40ae984948f5e76106e57e2f99ebaf7afb9cd4ade25deae6f3ddf
MD5 35768661d90c35274a7fbe629ba96fb6
SHA1 6798a0540eeea4490f456fef3dc9b4085369c585
SHA512 61bec69c4fb44849545430c6b982618c16e024ce853eec0257523bbfa2d3022caae511d0fd855b61334aff6fd2867fa9b35ea0ff40f16770a4dbb4416cc154a9
SSDEEP 12288:ZCd91WYoaLHF3z0z04PDvh+63dT3vWZqqVB0sqgyIclmHRG2EkG7N2H:ET8aLl3z0zD+63J/mB0sqFlXN2H
TLSH
T1FC050158B39418F8DDA7863EC9618906D6B27C6907B0C62F13E436261F733611D3DFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3a4161ae4df9c6967452f2d80c3790a8ce662c5ea9408ef9cb733f7d6cc15811
MD5 21fc61e5904aae2b4be3b021a0f0c33f
SHA1 712fe1c906edf94f6df8004e4002c834d155d5dd
SHA512 3a5ca974b793d45e33f3ed654ed61133d5978ef5fedcf227bab16cf888f1e9ddc92d0e42382b00312cd49985c03d6a938911422b1db0cc24030abee99935c529
SSDEEP 12288:9i4e7+RdTfgwCHKy7GLbbdIvN63dT3vWZqqVB0sqgyIclmHRG2EkG7N2r:93rd9CHKy7GZK63J/mB0sqFlXN2r
TLSH
T18425CF90F3E810E8F1B78A35C9714511DA767CA91B71DA8F13A4661A1F33BD19E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 9bd80ddd2e58ccb2e7068e04d26ebf35a56bc64027a3a2ca4bbfc2a6f00f3451
MD5 603e6a4ce20b15c98de794dfd12e4624
SHA1 dc82569665a55d115ed9c7ebc8d774e6328e313e
SHA512 dde0fef159e1d8738c69f823a402105919ba0eca9027b1faab8d9a6be5fa8eb22a6e7d5f406ec77dbd4f9436e10b25a55ab20dda5376963d2efd5dbcfe774af5
SSDEEP 12288:fu63dT3vWZqqVB0sqgyIclmHRG2EkG7N2T:fu63J/mB0sqFlXN2T
TLSH
T1D3C4230C08CE14C6CB9B8E79C1E04294EA286DF42BE1D47FF5C5F2112EB6A277B64D95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 7ba14aad29bb2a623fd937d8e48fd78695abfb87a884c916b463c9dbadcd4a6e
MD5 337518a590aeb2ddadb1d438755f0c22
SHA1 03381981c44ce318fc2d1a6f8bc296eaecf8d0cb
SHA512 4660d5c2538b6445c38394d38afa7d531093f701d4bb6d81fb967cfa0b6fe02dee5c7b5edac9a827cd6ca8744d76b6277a987d2a1ec38f2aa89c9cd27d34a6ca
SSDEEP 12288:hg63dT3vWZqqVB0sqgyIclmHRG2EkG7N26:hg63J/mB0sqFlXN26
TLSH
T19CC4230C08CE14C6CB9B8E7881F04394EA286EB41BE1D57FF5C5F2111EBAA277B64D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 be0deb5387a39dc34738f9700e98a5f9906c90c2625071f6f869a6a534a8f973
MD5 45294564db84f3aa76604458feade958
SHA1 406d217a224ecc6cb29a3b63627cfe4659949fce
SHA512 ec38617f4902dc7e8b4b8e26dd9d6b9e73ac8d2b8ed97eeda3cfb0334e258bca94d1a80042a9837972a04a36e5f68c45b8183be7749000faabb6aa0f10c7b7d9
SSDEEP 12288:cN63dT3vWZqqVB0sqgyIclmHRG2EkG7N26:cN63J/mB0sqFlXN26
TLSH
T1A2C4230C08CE14C6CB9B8E7881E04294DA286EF427E1E57FF4C5F3112EBAA2B7764D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ef23bd46c2d2793017a2db2d67b44fc2c4d981e82bebe323b77e9e8017035e5a
MD5 ea3d47a4a4b31ae3d373552998292476
SHA1 5c721465a668fb96114ab4b9a09f13545ee9188c
SHA512 3f708453436c5632916662423194b73aced1791ec186b76b45fb4cc6e882f3f552548e9e694ddde32d2af3e095cc83ca52e2aa2b08aa8c46b73f5decfd36a8bc
SSDEEP 12288:lL63dT3vWZqqVB0sqgyIclmHRG2EkG7N26:lL63J/mB0sqFlXN26
TLSH
T1BFC4230C08CE14C6CB9B8E7981E04294DA286EF42BE1E57FF4C5F3112EB6A2B7764D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 cde7964e51baddd2ea6283a6967c581e7cf2eeef4bd1ef8a69adf67131ed9f3f
MD5 19454c887fe0e8e03da53be3c711cb10
SHA1 0af46a587ebb818a052b5893e4e0555d50a71dc6
SHA512 ec37a1c30ca84c797ce9d0a422c5f67c9a30f3896a95ddc08e51e0e69a0b18124fc97a174bd8f8ecc804f39da1412b413b406f9f36ae2802a5eafdab85f2d1d7
SSDEEP 12288:9u63dT3vWZqqVB0sqgyIclmHRG2EkG7N21:9u63J/mB0sqFlXN21
TLSH
T108C4230C08CE14C6CB9B8E79C1E04394DA286DF42BE1D47FB5C5F2112EB6A277B64D95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 4cc653a85a8b67069c9cd8655930ba6992758d2046e877710010b5e652f8ee83
MD5 2b0944dfc921a3f8c0fc073f4ed4eb33
SHA1 edd0a21e4e41bd3b4eb00853681aa969987e3467
SHA512 b9fa679f999c892bf95e3e211892137b97b76c5a67d732855141e939faad10c5ff5c7489394dd49df16d38ca4f31f295700f2f5d9e8c4afcbbfad78404531553
SSDEEP 12288:VT63dT3vWZqqVB0sqgyIclmHRG2EkG7N2J:VT63J/mB0sqFlXN2J
TLSH
T13DC4230C08CE14C6CB9B8E78C1E04394DA28AEF426E1D57FF5C5F3112EB6A2B7664D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 40d4edac5c119475c18880cab6f10fde00cd99da70132411b485ff2ba60649b0
MD5 79283ba89bd6378a0559bea1a10d991a
SHA1 b81abc7d8fa02769baf8edcdb60ac1649241005c
SHA512 cc9a213910a9d3940b214f4980aa98c85adb7694e556a2bce7c5ca1442d93a97b2b2f17f92ea75075a5f6035d8bf13cbc846540581ffc5b672a3036ebb3b6b07
SSDEEP 12288:YB63dT3vWZqqVB0sqgyIclmHRG2EkG7N21:YB63J/mB0sqFlXN21
TLSH
T19CC4230C08CE14C6CB9B8E79C1E04394EA286DF42BE1D47FB5C5F2112EB6A277B64D95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 5f5103030b835f900b408f0985bd1eeabf58a1fd52af00d407bffc4b3b19bacd
MD5 389e2e7d416976011f47b9d206fdf671
SHA1 745e54fe02d0f5c87f8fe43179fade8d0aa20303
SHA512 41f7a0a0614eb87118bb5631b5d6b4bdc4aa7f20868303dedf0dbdfc12af690a2d94f192b51903d5d4df23467f3684cb12fe9bbe211c32b0cda9467fe91204fd
SSDEEP 12288:kfwvD5uE64Lk3tRX69qkyAI5163dT3vWZqqVB0sqgyIclmHRG2EkG7N2Q:kfwvzk9RX6wkyAI/63J/mB0sqFlXN2Q
TLSH
T1A935CF29EBDC04D5E1B7923C89B3460AF6B178681B71C6CF129A536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 30ac44db1293b8e351469c6546a296da806ddcca9c00bd28cbe02a4a9147640f
MD5 c6b9dcf4028f50b578137f45ac439e2b
SHA1 c144333efbb1b9636558d8a9bbdcb88af8b46f79
SHA512 39fec52562d94201da34999ee58307b74d60001e936542be0efa0acb2d91fb98c5017edd14652d2b0defd236b6f4d1e2ee8df26430d59d2689700d91fee1fd82
SSDEEP 49152:QYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0y6MBH:vySzPK6S
TLSH
T12C067C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 98aa6d86a07ddba338a78af52ae11891370392ab3f3258725e9e347076a0ad29
MD5 fbba1d537e7ba5afbfbdf3c029c7785c
SHA1 8a13e1da268c350d353f8a77f2e84eb488d28981
SHA512 58e6892aeb2d7bf8291d1868d9576dccee74923cbacd29b5554d3fd4325e099ca5fdb1a3d6ff431f1cd2138aa0634d60f937169933d4e046cf025e6019f84049
SSDEEP 24576:T47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYM63J/mB0sqFlXN2X:T47JUQjqirIhCnDHUPfF/C6MBH
TLSH
T18465AE1DA3EC01D5E1BA827885554A5AEA71782D1F31CACF22B0837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f749c06c22be993e2ec1bcc6b61b86404a5254009fbeac4f61bf3abe5ce540e5
MD5 26360d14752092d9a8caeaa29ae7a0ae
SHA1 de0851343bf36423f856f105298dc66babe58f78
SHA512 c32dbc1c7a82c9ed501336fcb54993f38f5fc2cee8ac029b8899d05251fa950dbce76b75f0e747ad53519a5bbd4697631a9c67a8c15ffc8538bc77e8e831564f
SSDEEP 12288:Dpsf763dT3vWZqqVB0sqgyIclmHRG2EkG7N2z:k763J/mB0sqFlXN2z
TLSH
T18CE4E009C29812C8C1AFA679C7914641F7337C6447E1D2DF62C0F63E1F76691AEE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a9417e57367114746d0fbcb449f70456717fde425f12cbbe6d13d011a2a7cee8
MD5 78c58d7cc57f0960939ca9fc92738933
SHA1 0e5373ab8602fbd034ffc432c31af39879b515ae
SHA512 214e8e98cd756bc839216bf1fc49dab6ad549ad055e1a47cdce1fa00f18286dc01f033359ddf44951ae16991a220821dd2f829c6c699334787aa7ac9b01fcfca
SSDEEP 24576:IYfYUP+3UCixTOSS6k/OEMP1JlYRibBsp:bYUkUlxTOjL/OD1J0GM
TLSH
T1A4452741762AC78FC6A950325E36D6CCA7707D01FE05AF0773C9873F8476668BAB6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 515ee6b950652827931caf7d24b081456235a7fe18f7bece10bb5ad714393371
MD5 365279b62946049aafc644b61c7db8a1
SHA1 8991a0159a2b89497f7508259447ec4febca8bc3
SHA512 61c924a13622ca5004217ade280fed4d529c46161d08281d158c4884d83b3b2d4e9dd39af468731754bf4ab8b6c851b0802e04d811a18f43ab1d2be26b729fed
SSDEEP 12288:tTkm7NzDUsU1uKNCsUMyHhZJ4xOMeVlfHgu+C09SyJp9SyJP9SyJMVk11sIocx4V:tTk2NxglXu3fkBK
TLSH
T128553A41B5A7E31FC9FD5437423286CDAB74AC06BB453B0573848A2C987797EB5E22C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9f2280ad4c262f1baff62a91849271a789ab1bce4de402a3e2fa961ad0240865
MD5 68ccb5207b5c99ed9ab2ad0fee6cc57c
SHA1 95fea8804a42cf00cc0cba23a410093a7f24c95e
SHA512 7ba1f77cc8ea6361802d0a365898cddab21821c555ec6cf62b12aa06e912232bb0fce2d74b827133b44c3ac15c39eb89a75056cfa79b15cd7257a200e061bd6b
SSDEEP 12288:QM7D63dT3vWZqqVB0sqgyIclmHRG2EkG7N2L:RD63J/mB0sqFlXN2L
TLSH
T139D4231845CD18C6DABB8F7481F08224E629B9B40BA0D4EFF485F3111DB6E97AE74E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 530bc74463bcd53a0afff5a42d940b3252d6dc9ddb11cdc0ccfa7a586a446e9c
MD5 6ed87e960d933998682884c0c28e0ab4
SHA1 d53d279ffaa269e2e3cce9c2e0d103caf4994dcd
SHA512 62929a0e56e2bf047aa7dcbd9987cdd171c0279d5236e50847c89ab501ad3bad12a210af9f5ea6d0c582cd41f3b0fef963b72c1cf199f9cc6b71286c0fa498fb
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYl63J/mB0sqFlXN2R:ngb4mBIBhGFM6MBH
TLSH
T11065AE1E22EC02E5E1FAE2B8DDA64417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b463358c519a6a5da59f4755a4882a625135f1c5a7296be5103d7beb2ee9ac66
MD5 df8f8e691b3ba1dfe7f3751a24d7f476
SHA1 a508b0442d4f2cc14e8cd46a76b8124dd740eb13
SHA512 15e947d76846eae6dcb9cee9aae8e1d7c3de386764f2320f2f722eed944b1921d80cfdb8fdbc5cec74919ba3d59c61062c712f9ca06bea56b28cad1163415e2b
SSDEEP 24576:sG88u8FpJqH1vzria7/m863J/mB0sqFlXN2u:P7ZFPqVya7/t6MBH
TLSH
T10135F12566E501F1D47BD13889924663F6B2B8240374EFEF06A88B511F23BE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 46cb2a29f130c72fc023a58ebb92fbbdd8392c850135e83892e768498c53012a
MD5 8544a9b542e1021bb07f24704e2f70ec
SHA1 e238239928c21f11ed7ce979c0c6a6f0d50ce3cf
SHA512 9cd9765d036b8f1ccb1680140943f6f96cd664ada5374e2a96a32197d71ae5debc331f4579d2e2278e7454bd5226eb80b4027808aa1bc7771f11ac5fbf0ea84b
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjo6MBH:0G05lO43bn6S
TLSH
T1EED5BF6A62EC11F9D1BBC17CD9C6460BEBB23425033556CF02A486A91F27FF46A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8a2c4ed7d9366c4014827f0300af8ddac6296e99198811e11297a2089a2bf19d
MD5 0f98de8d06635cfc292b1db2c871f27d
SHA1 2c33638b3f8de59e39f5a260fa7181e6d9081084
SHA512 cc47740e4f5c97479e080753cee57c6720f58300df17301b1b8f2908b5288886ff01eb69c98ae15e671491df9c6d30ad991cdb451cc4664accd0dc1292188862
SSDEEP 24576:5fa5POZ3dpyWVM50JicR2hG0lasx2+47eidny63J/mB0sqFlXN2Z:pa5POZ3lJt2pasx2+mg6MBH
TLSH
T10065AF5DA6FC01D5D5BAD17DC583861AF5B1342113329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a9d6add97fb82baf7bdc735dc480470be17687a952831720d98164f593371c12
MD5 ef6c0967f3d33bde3d4012da9499e1ca
SHA1 d25f39a15e5dc44f7173e3177b1b6d7b4a230e45
SHA512 1bd29dd72f78e227dacbbfde14f25ee93754b6dc32cac83d106d457431adc6f24487c0a67e201c780862231eeb85640eac59180c0ff5d991e164806d045cf725
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkU63J/mB0sqFlXN2v:gNc/zEOVHFN6MBH
TLSH
T115858C1623E901E4F5BBE1BE89779546FA71786517308ACF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3e53be7c67254330df77f3cfa5f7fd0876162a5c45b3ea2398f526ab20f88e68
MD5 9c1a12064a90c5dd5a05866c60db3dfd
SHA1 6f7e5d10829246d72e88a350dc92866685be58e1
SHA512 e83fc071365ecdcc31e6681d70756f3453e1bdf6d25fe1e6ee30b4688e0a997fb41165f0fbbbc1438dba33f932fda42c0697f042560c49578de7272928ae996f
SSDEEP 24576:zzkNvNnaFeYhJNtmZBmG63J/mB0sqFlXN2y:zzMwBtOmG6MBH
TLSH
T17755AF2EAAF806E4D1FEC6B5CD238512E6727461073293CF5290C13E1E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 079bdbac6e2a558b3775548bec6973a2e74f4989e70b63f45ab791bc640e6750
MD5 ef83351e90af8276c4fbfc0cba9f9a08
SHA1 b70d67d0fb1b13be9edd1de61acb7c6f6f0a862c
SHA512 8f676a798181a213d5e98374f297bc00c0fc698debb6b9764557e2afc27f1272273be09bb1353baacae5457283fa2e953e88f2cac79623073bbbadc3797f6a53
SSDEEP 12288:YHvUrBFrEjwaQ463dT3vWZqqVB0sqgyIclmHRG2EkG7N2z:YPUr+NQ463J/mB0sqFlXN2z
TLSH
T12405E12E22ED18D5E67BE17D85828719F771B8610712D2DF02D0817E1E67EE8BD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 617867c9556c15cfeed0607702cc32f1aa7feaa50ff12543cfb0404d9cde0998
MD5 0081b147009c5b29ddd70c700088f905
SHA1 c35bb06a2cda459d1abde2bc0396d62ed44c067f
SHA512 17b007c5b1f74468b5616c9a4e2ed790acf92535a6a802d7f658cffcea8712c1aa31b24ffd28381c19ccf0bd1b43703f1c80cb972a5911b982fddfc64c3cfce0
SSDEEP 12288:fQcMxWDXN1Dp/fshBItT1IQgA363dT3vWZqqVB0sqgyIclmHRG2EkG7N2d:nD3FHshBIYQgA363J/mB0sqFlXN2d
TLSH
T1F625D03DE69D04D4D57BC2BCC6A38606E77138A8032266DB12D4D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1560-131-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1560-139-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1560-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1560-137-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1560-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2104-70-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2104-313-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2104-72-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2104-78-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2348-93-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2348-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2348-333-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2348-99-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2348-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2348-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2660-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2660-88-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/2660-83-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/2660-314-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2872-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2872-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2872-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2872-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3340-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3340-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3340-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3340-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3376-105-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3376-111-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3376-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3376-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3376-318-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3376-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4568-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4568-25-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4568-26-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4568-19-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4568-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4604-125-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4604-119-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4604-117-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4604-317-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4884-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4884-59-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4884-298-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4884-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5080-16-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5080-0-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/5080-18-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/5080-8-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5080-7-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5080-1-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5908-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5908-50-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5908-55-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5908-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5908-44-0x00000000016B0000-0x0000000001710000-memory.dmp

Download