cfd05270d2f9f5af09702b4ad038bc6afe057b60e5bcdb5323f487fb72a5f4c6

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_192759295b5d50260d1529da1e01b530_mespinoza.exe
Size 1.5MB
Sample260808-wth77awwf1
SHA256 cfd05270d2f9f5af09702b4ad038bc6afe057b60e5bcdb5323f487fb72a5f4c6
MD5 192759295b5d50260d1529da1e01b530
SHA1 48c66b77e611f96c5f16b0a7e79b5f5d61e4333a
SHA512 5ef15aa1b7caa10db75f3c7cf305b10b3b6d09a926217bfe4dbcd008a93339a50034fda64a6579ca0d751b4c0e7b7cc3d6041992d9cbd601d8374814a1f970bd
SSDEEP 12288:/VDhxbitwzLoGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:BbAw3t/sBlDqgZQd6XKtiMJYiPU
TLSH
T15A75025F77E198F6D56AC5799CAAA760F7B2FC485D10A30F1390A31E2F3B1605D28321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1128	elevation_service.exe
2388	elevation_service.exe
1512	maintenanceservice.exe
3980	OSE.EXE
5580	PerceptionSimulationService.exe
720	perfhost.exe
6060	ReFsDedupSvc.exe
3808	SensorDataService.exe
4720	ssh-agent.exe
1956	AgentService.exe
1744	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_192759295b5d50260d1529da1e01b530_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_192759295b5d50260d1529da1e01b530_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_192759295b5d50260d1529da1e01b530_mespinoza.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_192759295b5d50260d1529da1e01b530_mespinoza.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7f76554923e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_192759295b5d50260d1529da1e01b530_mespinoza.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045a2a7906127dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000112b188f6127dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000650a2f916127dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af34ef8f6127dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000214a20906127dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1128	elevation_service.exe
1128	elevation_service.exe
1128	elevation_service.exe
1128	elevation_service.exe
1128	elevation_service.exe
1128	elevation_service.exe
1128	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4312	2026-08-08_192759295b5d50260d1529da1e01b530_mespinoza.exe
Token: SeTakeOwnershipPrivilege	1128	elevation_service.exe
Token: SeBackupPrivilege	6060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6060	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1956	AgentService.exe
Token: 33	1744	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1744	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1744	SearchIndexer.exe
Token: SeDebugPrivilege	1128	elevation_service.exe
Token: SeDebugPrivilege	2388	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3228	1744	SearchIndexer.exe	103
PID 1744 wrote to memory of 2576	1744	SearchIndexer.exe	104
PID 1744 wrote to memory of 5016	1744	SearchIndexer.exe	105
PID 1744 wrote to memory of 2112	1744	SearchIndexer.exe	106
PID 1744 wrote to memory of 3148	1744	SearchIndexer.exe	108
PID 1744 wrote to memory of 2012	1744	SearchIndexer.exe	109
PID 1744 wrote to memory of 848	1744	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-08_192759295b5d50260d1529da1e01b530_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_192759295b5d50260d1529da1e01b530_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1512

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3980

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5580

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:720

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6060

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3808

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1e139cbfcc1848536001effc5885dc94ad092d087881e1b165d2ac1968c069aa
MD5 5d3c2381ec7137e3fa0d8cbb9e532727
SHA1 1fd010438b3cdd93cbbce2bf071972cfc71831d6
SHA512 926ba641ecb7d9faa2af1b0a76e2ad29c6cbd2264001522336b8a863c69b879417386f1ae26f39cef38b8b12436f17870116eefef7927626ff1ffe604127085c
SSDEEP 49152:Ib+632BuPkFKRrdE6ohvstBhuXjfS4LWxnw/snji6attJM:i3q6sjBTEnW6at
TLSH
T1A2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 d33ac173db9801243081dd135a40866ea389cad2f7e0d6e5413350f27f79eb27
MD5 ce193a08129389a75619465fce36b36d
SHA1 09495ee7faf45ef2089f6a237796a3f53c2300bd
SHA512 115092374d47f3009896f02a53f43421390ceef0812ef3782367e44aa548cdd1476b22eece0823300f54c36b94df942b3f13183fa50f2d29fc77666b61f8e35f
SSDEEP 24576:XXYfDtczAVt/sBlDqgZQd6XKtiMJYiPU:Ctc+/snji6attJM
TLSH
T19385012977D108F9ED6B823DCDA28501EA7378544760F6CB03E4A9691F332D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 cf1194641679896a646f5f428a543684de668d1375c6ac57bc1d2a94301b9673
MD5 69d19b0549757801cd66d9fbe797633f
SHA1 086ca93bbfe1e682f3394a437665f24796f78c5c
SHA512 7ac88329ffa0f085fc07392c2d21da6b920131ee13a1b64c4688f75eb176c8a31e116d19e42a38f14334a655e1b5cccf0571992f191aa140508e0cc780eaa49a
SSDEEP 24576:h0Le5ji0hmxLrMCt/sBlDqgZQd6XKtiMJYiPU:hPji0AJJ/snji6attJM
TLSH
T1A5959E26F5B48335D073C0B9C5D2A68AED7230865B3089CB4286D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d366bd91ec11fe13d3f5d831d93ba965c51d9a25ffdc6dd66661ca3a1d28e201
MD5 16242132ac4c5bd92422a433526135f0
SHA1 7e3c7f38160d0b5956ff1a54a9ee6c5cc8647339
SHA512 a7cebfba1ff1e4cc1d81be3b9ff0307115bb5fb72c683fc1bc58f88fc1298aa85da3902eb61eb1bfcd1b9fa93c2648500a320bc9adc896403a0064eeab9c0de4
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWn6q8wyu0t/sBlDqgZQd6XKtiMJYiPU:6/ezSC6vUzPveHjy9/snji6attJM
TLSH
T127755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1b45e751da5ed20501eafc50f7bed75208b5f475cba97c80b5c8b20e3eaae970
MD5 e3c447be59f99e0c9de01298981869e0
SHA1 62d571b1be4e452f43e2990c47d6a26f893fb009
SHA512 1f373c6256feb2385275797fe93e71937b551ecc730a002d8d45d234cb7a8ad184f6ae3eafd42e5247740db3fc1d2dbc2e431c759f2c1ed4b4ab7d65877e46ac
SSDEEP 24576:nVbqPb88hv/l+YRt/sBlDqgZQd6XKtiMJYiPU:nVO88hXl+m/snji6attJM
TLSH
T14B559E66F5B48331D073C0BAC5D2AA9AEE3230415B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 8f668c77a43657a55b7fc94e4463811628045eb1c224145560e4a67551abaa3e
MD5 9647e0b6816d44b0ce001e2f792a7f9a
SHA1 069fab16c4e3f6a70525589316630a39da4595b7
SHA512 36b85dc76166e25b4e5551c29e943445f320013418064a800247198482c4f9466dd0df06610ae06226b5702519c04e40f073d503a3f021ecce852bcb4a25a2d9
SSDEEP 12288:l9JdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:l9Ot/sBlDqgZQd6XKtiMJYiPU
TLSH
T14C65231F58C39496DBBF5A363EA97800F4733A0CAE48709B95D2B59C5E3C01399BD227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 38c78dbb0858324709a0adc44b9e7e85d7b374da09929220f5fb9077e979738c
MD5 8f603d9009b60102caf8996efc99a443
SHA1 0c6bb956ebf0f1bd3ce4090da660d7c8653ad4a0
SHA512 37f3135b46e779ad528a38bf6e898f8f33908479323f95d7062abd7b28715b8ce75b04afe3a27a037e6a73877932ccaf8475a0f599725418e7b38940c103ef27
SSDEEP 12288:HeBNUbTVO86UidGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:HJIUJt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1C085CF3BAE28FCD2C27E8DB95A918600E77274304F52A3CBD165C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 112b4d4232f8dd4e7b6407df53f826dd72a5991434588cd1f2451fc2aef1d543
MD5 ae27fc71f2624bf55ed540a424b1afb9
SHA1 265d6850a314884badd590aee2154ddfead502ab
SHA512 40e40d1f7e5a3a51a08aa756c91c0027a00f54c4ba75f28ab4e00558855100b33d4e1412e33460aba3768c32b558f32e5d37397460b3a8dfe093a39d0d6ed17d
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THW:4QvGAdlCEL8c/DRNw5CeEnW6at
TLSH
T15C266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 f819f1bae35774207ab42652137316144601f0da66aacead91d418d5029b58aa
MD5 196d8bb4777eacd234fe02a051285054
SHA1 1e7d30fd773c9d4536b91de49d0cd39057814238
SHA512 f743a1124bde999004ad2fdc5c86f8df5dc174be28d9985390f871ee6868194c3f32b60ce58cc8f8d3168529cffd844a2a08780a79b7c69e6094c17ab4181976
SSDEEP 12288:EAwSfxL/2Dc3DDLLmt0LDQewsAjYdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZbc:ZSewsAjzt/sBlDqgZQd6XKtiMJYiPU
TLSH
T15685E031FAB5E036C3BF0DB21B26D706543D7A204F5129C3E3E89A9D59341D2277AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 695390e8ae54b19cda7d718a748c0f2bf94f38ae30465913f7f10d0574bb910c
MD5 405ebc05af2e4de5108aae3649d74e0d
SHA1 dfd2c1f34e4e4400089515422e74ea1010c966bc
SHA512 09301eaabde0fefecccd0999356b0346b929c441971180f5718e6270b4c1ebd0da5af5699e032c9046be01f48d9c23ba91f07594b6c384ed2c97ed0f1e7ec185
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHWnW9:RUEtQevvqc2W1cpV2tI32W
TLSH
T12F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 40a42a063a1f3ec29521c218f3a181d2abe1f71f878e6264a4a8fe5cccf98104
MD5 36ed49f5f32ca12a3e7aa7cb71950d1e
SHA1 eeccdaf266ac06116043ff7526de172e7ee01444
SHA512 a903e927e4f6101cd2ca26aab48cf84e7f3b33a35f82d36fa1c086699ce21c1cce051508fbf61f89bfec00af6ff1037e267a29235ca5f28701c4f3fadce34e77
SSDEEP 49152:LCbRquA/m2yL5zTfFiV+XenmE3/z5/snji6attJM:UoquVjnmSEnW6at
TLSH
T158D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e71fda5631af1b790b1c896aeeeb5493a3da818bd482eb3c616364aadb1f9c6a
MD5 385ceb0472435a0352e41f77cc98cf62
SHA1 704a1fb3045914ebad98216a1d75d0609d8b8649
SHA512 e380a168530c1f0a6b3891ad3dc38c3f514c0eda6bcbf4605cb6ea48711386af2bf7461eeb663ede588cd98bf07a9d5ef633ac53ff378a899e939c28fa32605a
SSDEEP 24576:CAhGL3IFoiwtA5l7S534t/sBlDqgZQd6XKtiMJYiPU:CAMUFoiq5i/snji6attJM
TLSH
T1B635AD81EBF955D4F5B3AAB89DB69170EA76BCA95E30D20F2150D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 2dcaeb51787599b0def23921d911a3433c60b66a970958a2c26ba72482ef0b91
MD5 25ea9d873408c106ed34deb1c8a7a90b
SHA1 ccc4df673ad8634264077d12466a237683bbbd1d
SHA512 64e2d01484ad0abc241ea59e4b15915e02692abf254d564f7d234c3fab6417aceec8e812e3af0c89dbf4210cc50894d9cb5e8f0d03fb6b6e16252ab6e5353e52
SSDEEP 12288:0mw5HEjsChNfBFgl0WDm+CTdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNS:xwumOW3t/sBlDqgZQd6XKtiMJYiPU
TLSH
T12085014A36E50CF9EAA786398597D131F7F3B8052A25D71F03A0C65B5F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 b51deecf455e9464d7d73cc29d2e6b181802d35833b45181dd1d89eef3f25d0e
MD5 287e0b8620c85dc826b980aaa950c2dd
SHA1 f5bdc76f48055a0611840025308fa9bcddd6f215
SHA512 b7597f59bfa5d2d0afbca0a6eebab748c52e09723bb6840d2e3577be7afa2fc64618edac93c04939b02d816928de9da7e7617b70c365c007e2c3678046d1c7d3
SSDEEP 12288:jEZ1IyIdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:oZu6t/sBlDqgZQd6XKtiMJYiPU
TLSH
T14B75125E32D160FAD2AB463D9DE56900E3B334196B3563CF12A192A92F3B5C25D3D332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2ab9de89fd43d950b535feefc403931f629b815cbb97aac7a4b562ddf5a5bb7b
MD5 82a70b37c96beaa98921399042cea1a6
SHA1 c8cba8415611a16716e2aa33830453f2659670d2
SHA512 86066d977538613a71b6a3926e641b1efc30d50d2335eacbffe85d2ac2713daa8642fd83a1e46b6e2c57542956114ca4d6eea0d24d76bd794707f2e3604c007f
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ua:RQRQyi36YOcPbLvw2gAf+PN3/EnW6at
TLSH
T1A5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 500a3a8b89f7bb72aaa5f8551dd0011fa3754a39c932f99248bcce7df720a8e9
MD5 843fa50e02cb1efd361e63f4a34b2b2c
SHA1 6ec840b474931faf453f099b35b0d120b87e3664
SHA512 87464ffb7756ec101258a3fddd2e544cf66e8599a7ac17c9612870327c44506c7cc42fc13fe9cf295967f1b4d30ab5e857db54b3ed0302301563b1ed6a3c4029
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ua:3QRQyi36YOcPbLvw2gAf+PN3/EnW6at
TLSH
T162667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 12cba54c990962f3d2c6a8ce744f84501a90e4ce7cfe0909360960036e8e3bc2
MD5 2f986b745aaf4e818bf0eaf6a3bf7b20
SHA1 1cf8ac016e4cf58e106abfeb8ef025206dbfeb39
SHA512 0a586a40efe0797cb4e92c007f399743995cbfd52a21e31bab204d0f832f103dc49f9e3643d5ee71f0242dd50e5a3eea0b9c29ead3792028bfa7750b861889cd
SSDEEP 24576:UwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0Kt/sBlDqgZQd6XR:a68Qg55nhceWu7PNU3/J/snji6attJM
TLSH
T122B54A33B2F20099C44DE1769F4A972196D27C758FE0E3DB8551720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8bb0fe0f23aafdc4484d7b462cc5531005f277a4d543eb7cb85989085c76e45b
MD5 86fdbac0536bf8be8c9265d7b310a27f
SHA1 e419833a3db188680c9ef7bc3d8c1b85fd242e6b
SHA512 199ce3775f66484b535f00d4d3a0f0d29306a805b7ad233511e0165062a972ee38ac3b1bc1eb4107ad27fca447cce3549eb142bd1c3dee50ea15fe5f8ee2eba8
SSDEEP 49152:j3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk994:2y5112gYy5azzVvt69nLKnhZEEnW6at
TLSH
T136167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6cbce8d5868046db83dea6687e54ab58c6ae7f486b86b8956e30bd4125d28e00
MD5 b3d36ef8878c119f2eb95d76c718fe83
SHA1 f3ffc85d4b753215055e8d72fbaf5d28dd4af045
SHA512 08feeee4ef81e250f77a46d78859e2a2c91f16156827c6fde8b623ff4d0d437d0ba52b8669406d586147b07ac9d335d3e70fc7d698a6de6d58f1ede8bd800b16
SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gla/snji6attJM:/u6Jmdxd2daEnW6at
TLSH
T1D2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2ff779a3bd933762fc880817fb205d1eacf7e7ffd614f0784be608d3a879877d
MD5 651f796dbe18251e2427395baa5b1338
SHA1 6087b57d5c6b3cffa6f3a441978bbdef032ff525
SHA512 1612a8fdcdd04d5cfe21b44f48d67f8b1716aaa5d94ee425500f28d405bf326c5664d096beaed04a7e213ac47a068db7bd8eccca42246286c1fb1097e527f849
SSDEEP 49152:C1hpsNoJpF1A63U44CwH7R4xL/snji6attJM:CmifPWRSEnW6at
TLSH
T136B5BE13F2D900E8D06ED17887569632EA72BC450B34B6DF0A90B7962F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8e2d0e0d3b86f9397a33b54f05c1a36ae4d91106ae4f167ec8dbc20e3c232fc5
MD5 209767ddf3f6de77d6eec93b0d6a7d93
SHA1 cb511955487160214d759cc69f06b91a5668fd42
SHA512 2928886fcb20e98ab162e91262083a8b0161829df61b12fce0eec5da549064517a7b566b40be845e6b26656a54cce0b716cd6b65719ced7fb68c4468b2d553c4
SSDEEP 49152:ESuZQIY0Be2KcRVtOnks6NMHqA/snji6attJM:W5dKii61AEnW6at
TLSH
T18BC5BF13F2E940E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4ecd419c069465ecb267c08988406a8d5a3640d7fb7e3ff9023ca23b0f0f548e
MD5 719d64ba0b82edb3af5367a77bd1c774
SHA1 4f3643dd0b6b501c95f790b5f7eb1cb96adc1e38
SHA512 1d098e67c5038d5c093203dc19501535a79ae039a84ab2a14c12f2c144f5627e7bad914fdabf9498f82c552b6678237fb8012f469f651e972df835939eec39d7
SSDEEP 49152:lhtSn8EApI0fig3giDn0AP5wX/snji6attJM:UX2imph2EnW6at
TLSH
T17A95BE13F2D900E8D06ED178C7568632E962BC150B39B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 78ab04a29b37d847650e4250bd7f46b010562a71ada1c8d01392b4fefbb621c9
MD5 0d7b562506587d0719b32f9af24f5d12
SHA1 39d4264c7797bd96208900762c89fc92b35ce443
SHA512 3728816cb4b022e6c91c5f8d02ad895a2d099d7e7c2ddcbc15ebee0409724f900ee5a103786544e13c8ce94873ab7478881cb02b87f94fe8448a7d351adcec64
SSDEEP 12288:SBdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Smt/sBlDqgZQd6XKtiMJYiPU
TLSH
T16B65231F68C3949BD76E5A762EA97400F473330CFE4930DBA6C6B0586F3D01319AD66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 8be61e81f3cbaac7228afa22d8b31dd46f0fb5b4e468fe5e8bb805726b9e62a0
MD5 ca080ceb39dcc77ee31622e9a3508d45
SHA1 e25242d3b3351ad7039581c8d7394a87e46d814e
SHA512 332697883dda5001be385d410439576695669ac1de2d24770a60f545d0fa5fd780dc06617e646cfa94d22cc7c735cb76e8a1470d4b5377737db45b98492ceb55
SSDEEP 12288:YMdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Yft/sBlDqgZQd6XKtiMJYiPU
TLSH
T1ED65231F68C3849BD76E5A762EA97400E473331CFE4930DBA6C6B0586F3D01319AD67A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d9506839069f5ced6c53b5d6c3c2be051016e1b952cf1c1b38df2c298fd2a0f3
MD5 e5160d6b9899e1fdd5305143647cefb2
SHA1 84938f487f5e7c8ed8d23bc76b87f73756de877d
SHA512 9b7ea09d525d8c76fd7ce194b8dcfebc85eefcb0a4819366e13b2fbe32c5004109a377d126c9cc828ecc07e6bba3fa69ef72bcd2d8dd516284df384044211e22
SSDEEP 12288:gadGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:ght/sBlDqgZQd6XKtiMJYiPU
TLSH
T1FA65231F68C3949BD76E5A762EA93500F473330CFE4930DBA6C6B0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 2f782cb170a5ee48601be96b9f39994b20e9b68e4cb1504549498ed9505cbe1b
MD5 25936778c28f8f6b6397535f66136b32
SHA1 6cf07d914823869986b2bdd951de6c6ca05c4eac
SHA512 92dfa311f25a5e0b9ae636fbfad9c7385f255537234ea4e94834f3a88a2abc094bac3be2facd1ab800230e0783e90905f8bedbfb65776931c2f48a449eb22366
SSDEEP 12288:WV/dGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:7t/sBlDqgZQd6XKtiMJYiPU
TLSH
T10665231F29C380D6DABBDA7A5EA56400F1B33A5CEB2671DF96C174481E392121C7CB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 2590ecbbdf79fed7a2fc9d3cc85ddaf62445ee6d5f391a14d8617e13833da030
MD5 0bd66cd6c9f2d9795ee55734b49cd7a8
SHA1 7d2fb817f5e83c0c9d33bda66d6a72b017832230
SHA512 2387f48d8115e3dd27036dac2f5983894604934a49c80fce102874483b36b00ca2ab2e8a7b198a04b0cb5950fdb6528f774b59e28b0701c764f7c2cdd8b31f06
SSDEEP 12288:XHdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:XAt/sBlDqgZQd6XKtiMJYiPU
TLSH
T15F65231F68C3949BD76E5A762EA93500F473330CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 d7557388dfbcfe521be704e2c91e6c3b5f52580ecdbdd66c5135d6597bdd9fae
MD5 044159950887d59bc5e121e19429dd5a
SHA1 3dff3d06c6ede2db658428f0798040b8f2425c15
SHA512 9941601efd5b6980a66d1072c25f5010f8a5b097511fcf02ba6560fae1e1c574b6dcbbdfdf8174f2a35259bf007921dc35edcf174338756b19c5c89d6654223a
SSDEEP 12288:8wdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:8rt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1F065231F68C3849BD76E9A762EA97400E473371CFE4930DBA6C6B0586F3D01319AC676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 71c0e25947fed66852ac9cee2049f8a5ab95338f336954a3789f2a03a0297b3a
MD5 37c6dcb00f756e52449486a160e810a7
SHA1 23b8cb6fc81e6c4559a2931c213fdf08f97ad685
SHA512 f2867ffa1525477740e6eaee6f7520b98508cecaaebc60be5c3e3b4199dc8c30cb58b92f8527f78b567c24d0e713ac8244ea4eec2568f591f16c3f7aec78693d
SSDEEP 12288:90dGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:9Ht/sBlDqgZQd6XKtiMJYiPU
TLSH
T1B965231F68C3849BD76E5A762EA87400E473335CFE4970DBA6CAB0586F3D01319AC676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 4f3970254b7179edc5ea3fa42fd96cda818fcc4dc397272e5c8ef2cb4bf7e119
MD5 23dee0185b73895c9479457e473183c0
SHA1 7f1c1914d5cfb91fc1493867a3ebf1d7cb3b4454
SHA512 3a557cdd1ed1dacda8b4d70d0fc124638b456475d8733c9de2c78ae450abccecf9334374128091fa756d912fb0be2d0241191b7fbdaee0e5bf575ebc973ae4f8
SSDEEP 24576:sZMbzFVSO/t/sBlDqgZQd6XKtiMJYiPU:sZMbzfR/snji6attJM
TLSH
T138850299B39118F8ED77823ECD659905D2B27C190B60C65F03E4366A1F373A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 49a6af92221f81428873a412e24e6e25ce28c29ab9278d7ef752844c3f344321
MD5 02355d707836c0af2791d3ddc368077f
SHA1 ea2961a6d617fa531f8f2d58edff94554948ec5d
SHA512 41c04088f8b35c3dae066e9a9ff22b04f36bd782ad7d9bc605e71bc6737c18a2f395fac9104d0e6a979cbff730f3992f7dffb246c63a09715109b67fc0662cac
SSDEEP 12288:vtdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:vqt/sBlDqgZQd6XKtiMJYiPU
TLSH
T19865231F68C3949BD76E5A762EA93500E473330CFE4930DBA6CAB0586F3D013196C676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 e9b2782beeccc0e77e537451cd16243927018c7aa6ce4ff4fb2a016b8a3d1d9e
MD5 1c329a9d71fac94809206446ceac1282
SHA1 aa6456a4eaceb478563d7ef7fbb241948b8a38f4
SHA512 6a2b6caaa73b076c1c4275dbb080e36e82450a2a222aa48e95e7c4938be7cdc7ed5778d348e7622bf17c14957c3e920673455a98ed115a5ec8f2ce8b15dabf40
SSDEEP 12288:j5dGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:j+t/sBlDqgZQd6XKtiMJYiPU
TLSH
T19965231F68C3849BD76E5A762EA97400E473330CFE4930DBA6CAB0586F3D01319AC676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 639ab52b9eaa05aaa5ec4c39e25c301b0518d8fc49091634d7066243e2721fb0
MD5 233c14ef9506779c64a735240929782f
SHA1 de2535d89be0a9e3019aa570d2e0162e5cceb349
SHA512 819088689a0920d18eec43e3cf00c3978875e238bc50f3a44e64429e3f07c2041784cc6758969da2ec8b0dc5d922257afaaa713208c15caaced55fe6df5d1145
SSDEEP 12288:YyPz5L8IdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:5zyjt/sBlDqgZQd6XKtiMJYiPU
TLSH
T10875121B72D230F9D27B82398DA21901F37274395B249AEF53A4567A2F372915D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c46f32e6cd7fd704a13bcb8c5eb03efda7cef28e92a312a32746d38bdf36a713
MD5 11ad7564fe433972e0b497a204c20306
SHA1 482e3c7a1c038046478653968a3d08de1d654cb6
SHA512 68a3459e8ffb8ccfb8a111a9922d34c9017341e6c20b6aabe0968ecfcdea0b5c0d440bf66eac40c1c0777ee7e34a3eda737a84c49bc8e5cf2826a93e719c4180
SSDEEP 12288:vtdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:vqt/sBlDqgZQd6XKtiMJYiPU
TLSH
T14E65231F68C3949BDB6E5A762EA93500E473330CFE4930DBA6CAB0586F3D013096C676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 0877bcde0866ac084b23f712a7ade47eb8902fc6e05c32dc9bca311fc7249e8f
MD5 f1ef99bf4c967f99d45adbafd28d775c
SHA1 a5810333aeada160fb08d6919aba6df39570eaf2
SHA512 79171abf443e69ef174e84a9a22b166a720c4c8ffd4c1fe807ac9296d43aea8c7a8fc2cb5417dc0534221cd5cc620066e1de816a95732fe8ac56b278e7ab7313
SSDEEP 12288:qtdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:qqt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1EF65231F68C3949BD76E5A762EA93500E473334CFE4930DBA6CAB0586F3D013196C676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 62bc304a42c9ef1bc61b5e7d1069f948de143dbc7a85a130c2f30202f3d38f74
MD5 5b5b32bf9dbc0cc7d5abf77b953dd257
SHA1 fed517e1aceb5a358b9ae5e623277e17d5e819ab
SHA512 1ddd17e0e2ec50a0e2578d4da12f559219b9c028033a3424c4c9f7d29aa9c99dcb1d7365aaa935254824b5014208147051672ccb8370d6adbfc9398f4b6c434e
SSDEEP 12288:XyPz5L8IdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:azyjt/sBlDqgZQd6XKtiMJYiPU
TLSH
T16575121B72D230F9D27B82398DA11901F37274395B249AEF53A4567A2F372915E3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 03442e28765b048d8cdca9956a9c23c3160c359ba5956c073543c9451e1b3ed8
MD5 4bf31f2a8e88b01e25b3b4826e33f5ac
SHA1 49550ff8144cca2ab9fffba4c55de6f3d335bb91
SHA512 0733852d8d83e0e879334ed7d439e1f320a1d300cf43a89a15f0985f3854c79f700159655c29f25f43cc7b92f9dd7f125de09e80fb70e9cd554d1faf54c35e00
SSDEEP 24576:7TBaLl3z0zDxt/sBlDqgZQd6XKtiMJYiPU:7TcLljO/snji6attJM
TLSH
T1C48502A9B39018F8ED67823ECD659906D2B37C190B60C65F03E4366A5F373611C3DB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 6ea54829278cc943891666e7f41aed283a6187a403a29b1cf3e9d0c8b8654192
MD5 e9cc8553d2d2d8c8b4e35757e744c22d
SHA1 c648b463c60d8aa43757f4307765b253f0dbd12a
SHA512 52f9d0c0fa8115ce86f69255f88125c0acb1b3a0dca3a0cb52ca662ac294c19a509c7e94e792fc49f7c9a68015285cc543f47bf6af4c650854da782e07aa1d95
SSDEEP 24576:t3pd9CHKy7GZtt/sBlDqgZQd6XKtiMJYiPU:Npd9CHKyaR/snji6attJM
TLSH
T11A95CF90F3E410E8F1B79A358D765501DAB67C9A5B31DA8F03A8661A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 b9e8a40e92c46caff63561e2d99f8b438706bfcbd65568b94fda200f9e24984e
MD5 e6bdc5d781decfeed360a27c6549d050
SHA1 70991ec66e7a8d43de6ee1a024468719d07a34ea
SHA512 b0ed5e9ef80f89d90bc521663aa0fb6c508dd4c274628cdf88a0437cc9ca40210148b858cf97d6f6a17f2db135dc750775043b0245f7263cde85c6d669a2e193
SSDEEP 12288:d6dGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:dBt/sBlDqgZQd6XKtiMJYiPU
TLSH
T15365231F68C3949BD76E5A762EA93500F473320CFE4930DBA6CAB0586F3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 59ca37f5083e7644a5354fba2155bef4e391f39d2e3c76db9e2bf117a54630c7
MD5 198e7a1cb3ec41cc8e968450c77704e0
SHA1 e5d75a156b531cdbcb645827e5ec28665da1940f
SHA512 8af610230bc2652bc93e2edafa4add0fccce6cdf66fc56c51ba954fabff82aa1a277646658703337658ae5e0bcbb05e67b4deafa1d4bc4ec9f185598f30f4d66
SSDEEP 12288:hodGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:hDt/sBlDqgZQd6XKtiMJYiPU
TLSH
T12265231F68C3849BD76E5A762EA97900F473330CFE4930DBA6C6B0586E3D01319AC676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 ef65011fd06563122ef2ef074c73e2eafdd79f032985c6caf567f11077040734
MD5 0b0643808c18cd6ac3bf7513c8aa86ea
SHA1 3d9a2796f46ec81a53afa3a69ccc87ddf3b924be
SHA512 2c6981f093fd9c01f0d28d4aaaf8860a3acd2b772bcfaa73a7cf0ad6bf4bae752d79046a800c1c153908c7099c881ac997710cdc49682b9ed0f82e9e3b33de99
SSDEEP 12288:z7dGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:zct/sBlDqgZQd6XKtiMJYiPU
TLSH
T1B465231F68C3949BDB6E5A762EA93500E473334CFE4930DBA6C6B0586F3D013196C67A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 2bfacdbb6b0ec75ba8ade9de953ddbab21ebca8d2c7783bb528007532280667a
MD5 e880d28603f95076160acac0fc387043
SHA1 8d255325902a66d3431808b9f4b61e7f55a05fd0
SHA512 9ec69c89966f66a733e9ae297250b1a4113a8812d866ed6d774592a76c7891a1fcb51fc45e74ba089846c09c8b243bb28a3eecde9b48c0c41ebaadea1db2c893
SSDEEP 12288:otdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:oqt/sBlDqgZQd6XKtiMJYiPU
TLSH
T15465231F68C3949BD76E5A762EA93500E473330CFE4930DBA6CAB0586F3D013196C67A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 bc4b2b516e0193ba082c5803983c7320a435c60c99f21af08b1a5761860ea4e8
MD5 8b33b101ea7a22511466cb8993e4f962
SHA1 d2d9385357a067e45f706805752e040a92b6aa47
SHA512 7eed15659587ba0eaa4329362868f40547fc5b8e1ea7c3b0e07fca181f52f611f68e328d16b2b7425e0b27dd8a6584da4a64b76a0028cd3a46a8b9094fdd2091
SSDEEP 12288:a6dGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:aBt/sBlDqgZQd6XKtiMJYiPU
TLSH
T15265231F68C3949BD76E5A762EA93500F473320CFE4930DBA6CAB0586F3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 8c27fd6df9eadf7a10fc2f300f9907eb400ee2715b4b0576288606d675aade7b
MD5 e3ce36ab9835e8402692db43e072625a
SHA1 37c3d3a5b9da157b141f957a890310105472131f
SHA512 a3901c36bdea7541bc6ab4ab5b52f83a1a292f976bb75425afb057bfb098b7c2d547b0071b708978f7ed175f2e25c1bf91152490a9f3316ba86ae0a9d6a77853
SSDEEP 12288:D1dGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:DSt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1D865231F68C3849BD76E9A762EA97400E477370CFE4A30DBA6C6B0586F3D013096C636
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 3c1251287516af1021d7411e7da178bc33be6ef24dc8012f24c0ea7ad6d600ab
MD5 9e5bc6a56686cb3fce96db3eeee7a1b0
SHA1 ad096996ad8c7025c4bc37b643c5e0ee45820c93
SHA512 593ffda56edd6bbecde642eb713b15764b3b45ad86072d0e2aa98333ecaa0e287e2effcdee63958702c7cc6dd0bcbddfe046304badc1f554a76143488e504a70
SSDEEP 12288:SHdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:SAt/sBlDqgZQd6XKtiMJYiPU
TLSH
T12E65231F68C3949BD76E5A762EA93500F473330CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 823e5d67bab2d2748d14a098372605d5c918c11ea52f8b3c05a1bb330b322231
MD5 18a510eff80ed331cd5e82b1ac7b630e
SHA1 d9baeba47fa3761ea5235a4521519e857f6f33ea
SHA512 7410f834f7abe11d4d85b3f2dc614552a759efb11a55f69e75d96dc91a0878bb1266de661a79bb0b6653f9bd28f49690e0c7fccc0f39bacdea10902803460c30
SSDEEP 24576:9fwv2k9RX6wkyAIut/sBlDqgZQd6XKtiMJYiPU:tMnYIk/snji6attJM
TLSH
T1D295DF2DEBD844E5E1B7923C99B7460AF6B178681B31D2CF029A53AD0E37ED05D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a97211a83dd868b63836c92482c8836efc6da7d9ccf6cf9c347bcdcdec05be59
MD5 050b89dc92b2d9ef1d38d1ce5291b7cc
SHA1 f423572009d6d88d9c9bb4c2faae59d26b64a1ba
SHA512 c6cba7e6ccb9f71b8317f8ecaa031536b7976f7a282119b2389fa66a573b283a0d9baf39356c7c8d1377d59a89a3595d1921caeb749f44d42091fa8ed8f0dda4
SSDEEP 49152:+YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03/snji6attJM:NySzPfEnW6at
TLSH
T176066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8a838446b31af45c6cdb25921e51781be87125526de13c0b806d982488447721
MD5 941dc06d545f924fbb44d79c360ceba7
SHA1 bbe9ac658fe2da421caf3d7b992b8b0c7af61bff
SHA512 dd6cf43693c6b73488badfb0d614135f16e214eb468f751e7bb1c5c87447ff9b5266244d9b143555ce49fbd6b744d9d73350318c2e53615da274fe9758832276
SSDEEP 24576:m47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYvt/sBlDqgZQd6XKtiMJYiPU:m47JUQjTirIhCnDHUPfF/H/snji6att+
TLSH
T1C065AE1EA3EC01E5E1BA927885154A1AEA71742D1F31DACF12B0837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 d0f394fbc3d0ecacd2f14c983a7c2c56d43d314bd49fb70423ec24790df4b7a7
MD5 fd37421fbe7e01fa89a7d37e18474601
SHA1 24e04bfc524698136fa910b92e6ff13a23f13765
SHA512 ae4b1ffec5e2598740b1045d270ada1c9cf0fe392b9124b796bb8a28eef4f1ca71dcc5425095cda4d76d2fe4a97a9e8ba6fb810ffcea6f0da76f39b02e662433
SSDEEP 12288:2Vsf9dGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:L6t/sBlDqgZQd6XKtiMJYiPU
TLSH
T19675F11AD29541E9C16E627ACB565A00F3333C2897E1E3CB52C0F57E1F3A2915DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a47920f0f9c8694b2d1f8b0096be8ada3803591385f35e1e516e70b845ea1f81
MD5 f8f4494660faaeac49ffe50d2b1501b8
SHA1 ce48e6bf51ba1d1717856a1d354717e9bbebd240
SHA512 0e925863a309333b025dd9218f72ebc5f6b65213c76f0cd1c3e2c2ce4f3470a438f5f5a3017543499296a4bb9bf1b6691e28044529721900d2d73ea32d26bb69
SSDEEP 12288:dGkFU3fJxscdQ8xaed0ir751Xg5J98LPWJb0fh0D:dGoUPwmQ8AKtE98KJbsqD
TLSH
T159451840766AC74FC66980331E32D1CCAB707D41EE05AF0773C99B3F9576958BAE2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 3d01e9eeeaec3ec92601692f910c999b64020dfa79859462a0d8c4a92f7c5fac
MD5 314d9f6f14062751e495e11ab0419b65
SHA1 9ac076e75131dc2aac8d2fa82dfaf86834ae1235
SHA512 14f1e43aff68eb4510519c0a9b84261b300979b14835eb0f5ae46615b834320ff4cc903d785b70100d486ce643611494ce13e1e1cb9de117ce782f564b9cd8f6
SSDEEP 6144:pDcWo4VX5R3KwgGdqx04vuNACRawTvuNACRa7vuNACRafvuNAF4hZD9tMxLynFak:VX7tgGIyQ+tKviP7Oxtd4PZF
TLSH
T14775FA406137E38FC1B760320325AB8D7BB4EC16B749AF1677C8443AD86AB15A1F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ed5e65c08a500487ec644c1c2a50e4018605702d7e74a84e9c6204d61d22cafa
MD5 81f417ae39b20bb7fdac94b24efadb1f
SHA1 d8067f7813c3b2c868cb7f8627a1de1ea06dbf6f
SHA512 3d437595502f15a749a58610b61a773c06d93a078124ce5cad5cf21e4af7277f6fe51fb88ac6ca5382f57acee67531be21c6cec24ff4e1e900b2c4e178770e91
SSDEEP 12288:eO7FdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:xit/sBlDqgZQd6XKtiMJYiPU
TLSH
T1B465232F65C79897EABE5A7529A9B400B137331CAF0470D7E5C1B1986E3D0824DBC72B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7716b55b908c3faf2fd6cf9f2893185ffdca51df9d9e0f5a73720a6d2c812e9b
MD5 c84963a64aa440fda97d92ae69df6423
SHA1 8f7684338fc6e81bb3a9382a28c91236ffa4ef0a
SHA512 7fb69c896a1545424d6b6ae7cc48c0a9dfdb2a1c992540dfe5c1f9830a3ac2c778dbe1512dd510dc22075e4b72b4785f58a974ea32c9cc2b359e511e99dfc26b
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bY0t/sBlDqgZQd6XKtiMJYiPU:+gb4mBIBhGFl/snji6attJM
TLSH
T18C65AE1E22E802F5E1FAD2B89DAA4417D6B378160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 7d86a9805d639dfd3ad9ce1874ca26109062c95dbb783d8ea306c29ff8a85abf
MD5 7700c2f240b2256d58f5ff447dc3621c
SHA1 6f6642c0902ed99a0fbe396dcab5143a72dd008f
SHA512 ce67f88d7c119a94a3ab50babe55c64c067455993731ebd43340691100ce1138b38c06a5e3016f47268b041c70fdc1d1d1c0b1d516ca7e0c6b3a2304027717b4
SSDEEP 24576:SG88u8FpJqH1Nzria7/m/t/sBlDqgZQd6XKtiMJYiPU:J7ZFPqV0a7/m/snji6attJM
TLSH
T1B695012A76E101F1D47BD1388A864663F6B2B4251364FBDF07E88B551F236E10B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 571c6176010f8055f407e6f84c8e2803843ac87160026d6675ac12eac8dbfc6b
MD5 9045148baf598eae46326ed715bf1a72
SHA1 917aaac0e7cb4717b775dda4b0771915357fc05c
SHA512 45ee86baf2062e77f98f45a705ab1946179bac669ec166ff54f7b5e488321064330a29001c75863b7c95be43c6a89ba1b1766a0fd9aaec3632660d3602da816e
SSDEEP 12288:sHvUrBFrEjwaQgdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:sPUr+NQbt/sBlDqgZQd6XKtiMJYiPU
TLSH
T16285F12F22D918E5E67AE17D89828709F77274651712E2CF02D1817E4F279E8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8030f060fb49667b3eb8de2f862abe4949895ea9af237988ca122cfe8a43725b
MD5 21c1e8fa72df41f3dda46b328f5f7139
SHA1 e5a5a84b4218bca9864a3a0d258166d3c093fe14
SHA512 14e24ba6ecd407d210865ba150d58f6d6c2ff999c7045ab465dc8ad98797175675a3a91c4560173dcce94933bb203f75ba4bdcade2de341a752cece8c285fe05
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjB/snji6attJM:2G05lO43b8EnW6at
TLSH
T1C7D5CF6E62EC11F9D1BBC17CDAC64A0BEBB23415032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5c8f20e03961facca63198a6f4f664505577e0ee06b0e56b66d53f90d77a2a38
MD5 5b2ec77f68f5eb786a21439853e4e0a8
SHA1 2c57009640f96fa76671989766c2b7f09f5e93c9
SHA512 7298c4a0116e1bab4ab05134513ccf129be81423b45d3a3b65f43a4a227a58980bbd51a48be11e34e96b7e661bf128be9accfeffd7bc6ee931ac05846c9a19e9
SSDEEP 24576:Rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn1t/sBlDqgZQd6XKtiMJYiPU:xa5POZ3BJt2pasx2+mJ/snji6attJM
TLSH
T16765BF5EA6FC01D5D5B9D17DC583460AF5B2342553329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cbb77e78fd5939269b90afc090d194bd9b5482ee90798eb975d1818de15a8acc
MD5 6ccfea9b3141948843e3461d94207357
SHA1 04daf5fbe056122614f3610a2f49b7b4f73a3388
SHA512 81d7c082d69f97ff8f4de02fdb367ee6c4155220ef8279c01ff8fb93ced12104ed475322e75c0c773f0af7a79ca6b2b5893f3b51c433076c194f2ed22060f5c5
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkXt/sBlDqgZQd6XKtiMJYiPU:PNc/zEOVHFG/snji6attJM
TLSH
T1B7858C1A22E901E4F1BBE1BE89779546FA717869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a8cd3fa07f7499f7dc11735e3bb52ece39821f674ae2cd05a55268a414048a9a
MD5 4107c58f2b4a5d43aef68eb4bf3f5e43
SHA1 10978ce6bec0298da0921444b61961a8be289a3c
SHA512 ad828de8778e97d780b037321a86828195cc928843711a363d586ee95dfcfca4abb4db3a5cca8fdf16c9a6183c76053a7902e47820d29c4d6894b3380080b84d
SSDEEP 24576:TTkNvNnaFeYhJNtmZBmkt/sBlDqgZQd6XKtiMJYiPU:TTMwBtOme/snji6attJM
TLSH
T1DD55AF2EBAF846E4D1FEC6B58D238512F6727461173292CB5390C13E0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 8bd156be35ef3f5e883c432dfd5dbb936cd5882576bff8f7c7ce3ddb12118583
MD5 7b65e09940c5e355bf39fc794d48f2d5
SHA1 6c54a3a1a65450408c598e0086bcd0615e8805fe
SHA512 43dd6b2ebb148f0bee7223f8614818d12878afc97883a6e4ede4fcb5682ce716053670e0cb26a6cf590b379af0be069b76e0b3f7ae9222652d859244a6b91fde
SSDEEP 24576:PD3FHshBIYQgAGt/sBlDqgZQd6XKtiMJYiPU:PDVHeBIAAM/snji6attJM
TLSH
T10E95E13EE69D04E4E57BD1BC9A638906E67234AC072265CB02D4D1B91F2BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-304-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/720-81-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1128-24-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1128-26-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1128-18-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1128-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1128-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1512-42-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/1512-56-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/1512-43-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/1512-51-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/1512-49-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/1512-54-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/1744-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1744-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1744-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1744-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1956-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1956-131-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1956-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1956-123-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1956-129-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2388-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2388-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2388-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2388-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3808-98-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3808-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3808-309-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3808-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3808-104-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3808-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3980-271-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/3980-65-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3980-58-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/3980-59-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4312-0-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4312-15-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4312-1-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4312-9-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4312-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4720-308-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/4720-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4720-110-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4720-118-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/5580-77-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5580-71-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5580-69-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5580-290-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/6060-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6060-323-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6060-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6060-91-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6060-85-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6060-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download