ec82d9daa9908d8d23b0703a6dc3903c3b11c21fbb3408cf3a28094c30339582

Analysis

max time kernel
149s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_4beee7cbf09c495d8b9c990caeb658a0_mespinoza.exe
Size 1.2MB
Sample260916-1pasgaef72
SHA256 ec82d9daa9908d8d23b0703a6dc3903c3b11c21fbb3408cf3a28094c30339582
MD5 4beee7cbf09c495d8b9c990caeb658a0
SHA1 1ee4c6f9790005839cc2c2e308e05cb1f6c26156
SHA512 9d39850d893d01665aff49e38cb7046bf82918de24ed4fd1c6cd95317b4e2563c813a79f6d2c94cc891a6f64e09b39cb5b4e5b60f619a526ecf34b8713e79756
SSDEEP 24576:A9lxr9ZUN2mdDM6s2f0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Sr9mNh5rKLNiXicJFFRGNzj3
TLSH
T1B3556D59FB64D0EAE2A1C2FDC642A659E332FD28473249CB4310551B5E7BCF81A7CB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4760	elevation_service.exe
5828	elevation_service.exe
1480	maintenanceservice.exe
2624	OSE.EXE
6048	PerceptionSimulationService.exe
3604	perfhost.exe
2708	ReFsDedupSvc.exe
4368	SensorDataService.exe
256	ssh-agent.exe
3988	AgentService.exe
5416	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\735c027be4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000908c207f2546dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f3c363c2546dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c45d9e3b2546dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000423c4a7f2546dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4760	elevation_service.exe
4760	elevation_service.exe
4760	elevation_service.exe
4760	elevation_service.exe
4760	elevation_service.exe
4760	elevation_service.exe
4760	elevation_service.exe
5828	elevation_service.exe
5828	elevation_service.exe
5828	elevation_service.exe
5828	elevation_service.exe
5828	elevation_service.exe
5828	elevation_service.exe
5828	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4760	elevation_service.exe
Token: SeBackupPrivilege	2708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2708	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3988	AgentService.exe
Token: 33	5416	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5416	SearchIndexer.exe
Token: SeDebugPrivilege	4760	elevation_service.exe
Token: SeDebugPrivilege	5828	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5416 wrote to memory of 3292	5416	SearchIndexer.exe	100
PID 5416 wrote to memory of 4104	5416	SearchIndexer.exe	101
PID 5416 wrote to memory of 3020	5416	SearchIndexer.exe	102
PID 5416 wrote to memory of 3176	5416	SearchIndexer.exe	103
PID 5416 wrote to memory of 4428	5416	SearchIndexer.exe	107
PID 5416 wrote to memory of 3996	5416	SearchIndexer.exe	108
PID 5416 wrote to memory of 1340	5416	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-16_4beee7cbf09c495d8b9c990caeb658a0_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_4beee7cbf09c495d8b9c990caeb658a0_mespinoza.exe"
1⤵
PID:3116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5828

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1480

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2624

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6048

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3604

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4368

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:256

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3176
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d3eb49ae592fe3d87b12acda28f87af539f0488c1390c2a897208ccd37f59ab1
MD5 6f2d9d30991d8343b745cc1d1f8cc521
SHA1 3c52148425bb751429c72b6348a9b0beb278de21
SHA512 b6f87960f2520db8e356b887c76ab6bceef7a0019232623075948ad5ef8184d67c5d7709c81b81fbd02ac1843579423476e4813c0fc2a888f47ceede2e2077d5
SSDEEP 49152:lb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn0LNiXicJFFRGNzj3:73q6mjBr7wRGpj3
TLSH
T11FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 08188e2508b1afebbf27521088e5edd98b656c9e6a79bc4dac9f0c1bcb801013
MD5 a0af1ea3a74fafb13506dfa6b78ef23d
SHA1 52e470f784e74790ef8d92723acface5412682dc
SHA512 80a80cf9bf79101a20859d4f4733ca87cf8a4f86e01c925062316a3ee0d03a1084874d3cc7a0e811f374422b5567736538aba722b04d8b44513aa39c0fcbe998
SSDEEP 24576:PXYfDtczAH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6tcmLNiXicJFFRGNzj3
TLSH
T1A575012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 73b2826e950e1541071c70f27f7a7e6346567f6a6ff7e20ceb857057fef2746e
MD5 5528c53ef1fc34de04212302cbafd34a
SHA1 7e47461871d1fcce5a03db88cf9661b82f7dd2bf
SHA512 fd85678b8787e5d2be2dcdb6dfea7fd0f611fa66c1a4501fbe632576c706a03f146c2fe87d5bb93e406e70ae01cbb8c97e0ade02b6eff820dfa9c59b191f1c50
SSDEEP 24576:00Le5ji0hmxhrMc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0Pji0Az9LNiXicJFFRGNzj3
TLSH
T10785AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c5dc82260db7fd0a3722f170be255ea5ddaa6bb1eb0629f74a933e4d2858c2d8
MD5 f9a524399bcbe1ed5f4229aa7c78e433
SHA1 3f6efde76a1e1896186500a1a0e34297bf0d5ef6
SHA512 983c976854bb6cf6b5e789326e660ee30a9e648f934446125eaaf32023ada18579abcfc4beb0be16e674e785c4f7cc336a97fc672b34cf528a1100ee1082763c
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWj6q8wyuW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:S/ezSC6vUzPv+HjyZLNiXicJFFRGNzj3
TLSH
T187756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cb2c60f4efd1773d14e4f43111fa0d523ad7dad23eaacab0f5659510fee1fee1
MD5 d4332e58938b0e828194ceca36c980ea
SHA1 f05d33aaca68d99d9093d81bf5bd4606824bb320
SHA512 fff8ee81d5b201464ee6037b84ea1be4b82f66a0f938bd17adca49ce8569a530224ee29436f34499da681a7efd0bfd324589f4bd31e9af14df70d6c74b911240
SSDEEP 24576:PVbqPb88hv/l+Bb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PVO88hXl+dLNiXicJFFRGNzj3
TLSH
T187559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ee8fefdc8473be8269de0e71cd89cf723d3161349cab67c6bf4c92fc8d8fad21
MD5 02ee5269cfad4ddad03bd38c2d8351d6
SHA1 3a21e889579bf73ecf33b3a292ae73ec3718354f
SHA512 4af27b08d41723e045eb54fa6bd978c1395251175ef1689763af2f5838501c5a9e0a4c14be470bb2b8abca8905f2440f7e1d9d84077c907f251ac351b45ed664
SSDEEP 24576:AGg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sLNiXicJFFRGNzj3
TLSH
T19E5523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5E913CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c8930a386dd49d9e270f54976cb4aa84095c4a704b87250830e4a661131a974d
MD5 c1c32a649d422e620f38e287a66a469e
SHA1 f420e407f0cc29ff948121e2595b4e0328e6d212
SHA512 d8ffc92ff2fb3c863d955a21793478789258befcb1034235ac212feaadbb70d1ceb249e33dde11cda79418bbea22af421f0dcd2afe8556868933435f3654366f
SSDEEP 24576:eJIUj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eJIUjLNiXicJFFRGNzj3
TLSH
T1D375CF7BAE28FCE2C27E4C7957518600E76278304F62A3CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 94e0cf400aaf203181b3a0aea872ed8d8cf888dfaaae200393aa661f7756fac7
MD5 b5ab833da8a22183521ad5fabc59aac9
SHA1 27425a156c6822e29fbeb8c1c6fb846c2b4e887f
SHA512 6d1326e2b87657af7ab79fc90b5a8e609f538b97d587ab3c9ba007ad1af417b295844c525ff133a238948a8082e22346eebc83d7293947a3cfd4a3356b19cb26
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THH:xQvGAdlCEL8c/WRNw5CG7wRGpj3
TLSH
T159266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b01d2b8612a6d367c9d82107888603e76c0988f55aca66b56542274b09ec9de7
MD5 8a2f86c0e23d972a88456bad044d7a15
SHA1 6366c6d2324b2781563d554e0f71359f5ef679ec
SHA512 44fce899b0e399575125da7c766f65238602a8941f33d81256158d56495d782c6db54d6f4832d774d6df260dd2bba9286fc19da19cd6efa1e6d3ff42871286f9
SSDEEP 24576:OfewsAjt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sljtLNiXicJFFRGNzj3
TLSH
T1E775E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6fd141c1e2aaa042fa4ea731e736518bb44b9f9417c7ae608cc7c2c11f467133
MD5 6e8ce787a9cf7ad461cc1b9e77b9f22d
SHA1 0f3dc243e0393883199ca33f4ccb88b7074edbb0
SHA512 1a2f5f8244182746c761d1946979b75fdc7a2ffaef9100b4991db0d690be766d3d2ca51bec0ec276dee91aa4a81464ea83be1891691ba553050d2c3fdacb1c34
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHZF9:VUEtQevvqc2W1cpV20I32/9
TLSH
T10D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1f180192455edc5d0c480766bae756576ff360ed49480fcba593070609cb845b
MD5 64db87f8da750e08e2c63dcc5e502458
SHA1 55415463b6854d14d0a1bc3d927f93d96dedbd0b
SHA512 ad3cb4ae818438fa2a05659fed5bccb7c63c699d185eefdced7ae00e15ee4a0cde8f0aa8cef8dc1ec9eea112a7eb3e6c1daeb8d821f1ddbb2c7ae5ef4e132d86
SSDEEP 49152:WCbRquA/m2yL5zLfFiV+XenmE3/zNLNiXicJFFRGNzj3:boq2VjnmC7wRGpj3
TLSH
T145D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ac543d58a7e88f738da615681608e68e77bda8af57f7c3441257ca92f517c09c
MD5 744da19eff7c32da29294632bf85cc51
SHA1 41ec52edd22d68b0bf8ec00f555015742774314e
SHA512 758138d1c14412f2f40f59456dea1d3d3df1c21370a0059b35b3953926b7efad93d9154e6c18a3b679da60f60ddafc0f9af5d309ccfc454a99a8f21a446e4d12
SSDEEP 24576:AAhGL6IFoiwtA5l7S53i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AAM5Foiq5yLNiXicJFFRGNzj3
TLSH
T10A359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f9e859d37864990dc21075b01fb661f5aeccdba201470ddd07d7745732906103
MD5 065147b06e446305d9bd041caa39c873
SHA1 217b134e6e3be094d6df050385addd6296f5c732
SHA512 a0bc313664d8193f7351c986440e2b5e83c2d8fb32c02b346d415a0dd01bd4196f4f9796b9b4153a8fca90d8794a895a25af906492a21640666e3b412d7567c8
SSDEEP 24576:ywuROW5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ywSOeLNiXicJFFRGNzj3
TLSH
T18D65F08632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 17d09192d2820b10bae0238aeacbd8746d0b78406b8459042922efa88dca2990
MD5 29d16bef2ba993ad6c0fe21fa5a3716b
SHA1 debf53f3dec2dc1d7c458db559805086d8d06ea8
SHA512 57540c7c035ca65fbc89bfe8be7e909f00c1d9fc58c796b141e87d90d648afb7003b9d226a5fa09f052534627deed48c32fadb70b395be207b0c8775effabf48
SSDEEP 24576:vZuk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lLNiXicJFFRGNzj3
TLSH
T17355129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4b6d9d5b13ac4092f05d324dde43d7297ff56aeeee658b7774569047451fc0af
MD5 9125fed4cb82fe3710d507f919641c44
SHA1 c11f9e379d66e62a28cd306f58239780a3c87f90
SHA512 7cbf9b764891fa1ff177579e23bc89d65c9ba07abec1fb2ce206e0b769d8f0d9a1e1df9be1b7eb34d1bf94a79317f556442084fd93d81bd3b4a6b1643c5765c1
SSDEEP 98304:DQRQyi36YOcPDLvw2gAf+PN3v7wRGpj3:SQyiKanX+PNjF9
TLSH
T16D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8727ef8065625fc51146d9b8d3cde54538126139454f317d77dc2769dc940ef1
MD5 efd9586434f5c101ea0832857cf2a7a2
SHA1 46cd1410f6b69742115aaf298782a842a931c577
SHA512 44b2a18c969266f2449add3d0214eefcc157c4056819fc7b28a9d1960eec90e1c39754468b3896b0082403147d1ef8c25df7ff03b1c62afc53937aa84be9ded2
SSDEEP 98304:xQRQyi36YOcPDLvw2gAf+PN3v7wRGpj3:oQyiKanX+PNjF9
TLSH
T1EB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a2eea01b4192e077b4575b3193ccfe4a97aa94a5d658b9b39d7d2af5c4a99211
MD5 2eef78f3a0f11b49b336b4cb42eda52a
SHA1 9f7866ae828b55cab39dd5ae694a43dd51a42e49
SHA512 2ba96966e790b7980e19feb18fd06e66fd40e69ee5669561f9d4b665089e308811000b2dbaa2deebc04b7aa2e04fa7c5398a944847d6d4cc3608fa34e6da30e1
SSDEEP 49152:268Qg55nhkeWu7PNU3/9LNiXicJFFRGNzj3:UthTRc/97wRGpj3
TLSH
T13CB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9162a7d2a1c34d59e0515e1d6ea8dfcad885f2a83990368ef61b848fe974661a
MD5 5653e08db8eaf31cf7dc9f231f4b371e
SHA1 8592211a14bf6143768e3ef7f97dedf11cd56b09
SHA512 346fb3585a6c021621b56e18ff391c983e872847f42ad0958df31bde73bbef2e5687ebd094bf57d8c4e3ff21a7c6ac4c6db67ec3382ee7475b1cb7cae0cf3799
SSDEEP 98304:hy5112gYy5azzVvU69nLKnhZg7wRGpj3:8LIHRWhOF9
TLSH
T1DA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e733aee154c8add8bdb84be16fd3a5ce41c2ad49b02d55a8be6a04dadd0faf61
MD5 c1c5d48882c13624fedac424ea8c9b94
SHA1 fb6b827deed48b97fe7a32f1b69395c865000a11
SHA512 7c099f6dcaa4f5abaab0ee8fd219923d2bc7c25001431b7cf7c5e6d7fb6fb0c714618fb2f91b0821c42dfab2a004d09caf85ce9c4d8ff841aa5e32fd8b1ec0de
SSDEEP 49152:XB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glWLNiXicJFFRGNzj3:5u6JmIxd2dW7wRGpj3
TLSH
T1FBD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1215c3ac254fbc04c37ca39910faab9c92923d153a2c811fc3dab155e894c907
MD5 f4d4dccdcd688f15d7c09c8cb994759b
SHA1 98cd590df56a8df8d5bc27633148b4e90efed7a5
SHA512 dca00f30d9d1f93a35a0e63034a1361f253e119c0990ab9dd42245a1178e8c939c0bbdca6b0c609c309a40fca74a7af3b2f237c92684dd7b8179b507ce29c3fa
SSDEEP 49152:b1hpsNoJpF1A67U44CwH7R4xDLNiXicJFFRGNzj3:bmifPqRC7wRGpj3
TLSH
T120B5AD13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fbb54ccd1be6c7fbc83f7ea6733db78162d056555af314ba36c227cc116dbc41
MD5 3480630d4bb981b64bf819cce10e03f6
SHA1 cf7f65a3687a3a72ad7b76abe1bcbd1e09c11337
SHA512 1abb78e4f29538a16b7461cd572e2c8f50dac766836e7890ea98f435a8bc8f13142be9277813000f2298b7f25e7d0ca72222334bf185201bff6b5ff42aa13f16
SSDEEP 49152:cSuZQIY0Be2KkRVtOnks6NMHqkLNiXicJFFRGNzj3:e5dKqi61k7wRGpj3
TLSH
T174C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 773186ade76b62e891ad562ae5d5b6f9e17c2ab7596caf137f9603e72ab381fe
MD5 35755004c98fb480a99da3506b8cf547
SHA1 1edebb95a913a1da75023e3a94426f73c26f81eb
SHA512 3671f37621a8e82569859a5e83f1889771effe8ed3b3a7471afce7cc9f58c32e67fb883e978abf8244f550cdeb75710a63ea1e9268ee503e3a1b63f63bed7626
SSDEEP 49152:YhtSn8EApI0figjgiDn0AP5wHLNiXicJFFRGNzj3:JX2iWph+7wRGpj3
TLSH
T17695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1d86ab70a046818a075baec6520aeef6c5dbc38f22786415ba8e5a7ba77f43ad
MD5 9298aae455e4af2516eafc1394d671e9
SHA1 1f3458262acb0071b26d93af2d8a04535b6f259e
SHA512 c2141faff0a2d2c33c66022e779f1a32cad4848aed2ab86892f8bf2f1523933b4ae9648db779c7558a63e05016e48921f685113961e95311a2f4c46e101f815b
SSDEEP 12288:Y+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17F5523D3558955B1FAFC0039C6755428F5882E2DEB5618E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e17ccb17b8748ba90695a0cb007c9746284a29551760c909b3daef3d57a59aaa
MD5 875056834234a640be4e6b526ef39de6
SHA1 0e75e8120205192735eeb1d949a73c2958b1f24e
SHA512 df0c2fb5a17f82ad6e3580c62df736af51ac6d0cbb57e98071e24b528ce47d9dc916988eb94264e3005d791a5cf44772b14458184a275a53eb1f4f8a1c5e2c4a
SSDEEP 12288:sNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C25523D3548955B1FABC0039C6755428F5882E2DEB5619E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f06d682dfcede24b8ca42a23ef00e2b11b6bfcd839810d7b450621c8607f1895
MD5 2cf3702ffecd8ece2262a9d7a591e583
SHA1 ad9e3610a910b1e32156dbac564aa7c92165fb0d
SHA512 ec3f2ee846efdc53744e14d0718c3417a5a6deb72948c3a060d6d98e6c6170f0f408e3264aaf78b69f14932a5c7ed9fd9829a73c1d607e27294fbefd9e2928ae
SSDEEP 12288:NfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Nr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F5523D3548955B1FAFC0039C6765428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 16f7dfa62b033fc39487bcf755ea491982cde0733e4b31754d18082f981a3c92
MD5 3d3452379a76428280d78bca320d632d
SHA1 0cc0f081cc9b714b329d083456bea53f6e4105cc
SHA512 3d8c4c011ab7e7102534b58a9b24992942e70d8e2d82f5760bbcc0976150081e6ba714c8d0abeb32bc5d2cf5d654a2f6e7092ed8868584964640ccdc30922998
SSDEEP 12288:nVQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T176552392168900E1E9B98039CA764424F2A47D6CD7325AEBD3003D1E5A75FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8d4803a86860fd674b27544075e6482aa28f05beabf13a8708b24d2d7a69e540
MD5 04d2be0c07a76f42fd82b8eff6718218
SHA1 5ed86aa344ed5b48e0b3acfc1892e0ded5704ff6
SHA512 2ed80f27f5b3c22bb08ba5a242d45eaae4db3e9e1e0e8f1f298b81a1c68e6e007a0c4ff68f13287c72351490bc78d78ed7528dd832400d3bd172d7ab21e637db
SSDEEP 12288:1IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:16/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D25523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2767fb2787604ec24be75bdc3f96979c896c2d4c2c701378a11905f740ec935b
MD5 98fd008a6b59ebf1d8c4de67c5f317ce
SHA1 b54eae7495b08ffd3726067b12c87edd7b2d2d28
SHA512 f460ab1e8689d6a0f4268caca382f918635c846ae498dfce602280cc801187fdfecf9709cad0e9c5087d20b057cd711c08dc4427e2471f073719fd94a3554a1e
SSDEEP 12288:nJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AF5523D3548955B1FABC003986755428F5882E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 28c034a14798f85dbebd344ba05651f410196ced0c0bb1259eec487c1fffc26e
MD5 dc020b0b7412483d1a3d5e8bd88d52e0
SHA1 87ddbbc931d429f75217d834f35af8264e09ffe8
SHA512 ccfa0c4f2aaeba50cdfc248535aa6976d9441496d03848ebfc4d2272e5ed174f3758c00ee6aa3549f16052fe9ab61e0b515971d8847bc4426f174dbd6cb7bc78
SSDEEP 12288:dFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E55523D3548955B1FABC003986754428F5882E2DEB5659E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ef5f6349b0b3cc8f427cb354e0bca6c036a6abf018404239d0828695709aa617
MD5 1c7d123f22dd7200946d57fe0061044d
SHA1 903de304fe92edc635a5552bd224d57cef220394
SHA512 559c4f83b9a008d217016676e2dbdc9c89013c3d0107dd6227f71c4e1e6ffacda81a6de6cafef2c1e6548949b519d24766eea61f4261de37cf2d9fde3211c554
SSDEEP 24576:3ZM3zFVSOx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3ZM3zfFLNiXicJFFRGNzj3
TLSH
T19A750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 04b4e5e9ee2aae353733776e8346ddd507d9bd8038798e04a22d4e30f96d3298
MD5 4e7ab63d1d2338a4f1f22a5d32b137fa
SHA1 9fb1d8b52ac73ff9c77adf8e3ca887cc0a357e1a
SHA512 3aa8bb09fde37c52b95d259655d540d0d399c05bedc33ecf91afbd9e701226b43fc675db6cb34ddbe430f99d48627cd340a7776626683ee76a736e79d60f2390
SSDEEP 12288:nyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1745523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ce3804ffafca9c47d943a177fa662200a13e681a751009998e250127fcbb5815
MD5 b8a660a3aabfc17cbf7178671699d78e
SHA1 281f78b5b3f14f92175f043c5775bfea37ddcf02
SHA512 6dadb53f7e4d52dd42ef31e6885d6f94363acfee86e326d46ba7ed49c12ec67d78d2aad5722a1599423f1b0c195a685c4ad6432749a419a0669db8821a09916f
SSDEEP 12288:6miJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E85523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ccc75a357516c296dba1e216ced8f93b056844892c5fedd4e91dfa5354282d7f
MD5 9a2d7f4d04acbb6d0ad1a5934474c3eb
SHA1 23006bb2b2daad68c4c897076baa9c97752dd892
SHA512 6a58136f684dd93c597cebac135aa9bd6f091186467005fae3b3e763f53d107252d97f5ca50fb8398fc8bf3cf0e622afd56022686bf6765b076a567ba3e63c0c
SSDEEP 24576:mzyd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m+LNiXicJFFRGNzj3
TLSH
T136650247629530F9E17A8139C9620915F3717C3647208AEF53642B7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a04a6da7e0cb8817e481d5363cb2471b05591782914b87c1b01b05316b1b416c
MD5 51540ea6732ade09d543cf547e0cc802
SHA1 7c2971910974adcf10da3c7d94a740eb1f0739f9
SHA512 fc4d478f2231e547c3c9c555df3afe6638cc7870f1aa54d37f8a50a1cdad02fd2e71427aa5a6a8aba93dec24726baa5bb66fa989fe2a9fc786a026cd09b0b3f5
SSDEEP 12288:fyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 03e7a28a3ca8ff303325f3942b13c2338813b784913c400bc343359b888e4651
MD5 eb1536fff7a651c6457b77f8e2f341f0
SHA1 7cc69dfbda4e6bf02bcfc512dbad5f1f4ed446b7
SHA512 02b1fc9603c810667ed359e8461b60b199e530fefb6788f440a0389295995f1d3f5e108842bc88eec3a4495fbb79d98b7d66191ce35e12af8224fba86a9493f2
SSDEEP 12288:WyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1395523D3548955B1FAFC003D86754428F5886E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6541b8d8969bf19ef1a6b7c1f19ea3c9c10604c0651b85d5e8798372fb0d7767
MD5 303571bf8e0b7ac5bfa1178464fc7601
SHA1 dca2fbeec07519a0e3ded4868d212975e72f55f9
SHA512 73ac615d752051d475b0de24f3922172258c74b5ae8a645d496bb3a66c0c5cd14583727ec20d26e45b5e5078e8651835fbd046725ab124aab062414e11f6c507
SSDEEP 24576:Uzyd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:U+LNiXicJFFRGNzj3
TLSH
T164650247629530F9E17A8139C9620915F3B17C3647208AEF53641B7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b56db2a2e3d56512ff0cd46a9a909a69eda843e673e19a33ef5f238a86b3ecb6
MD5 a967718a753986a6586492536ae328b1
SHA1 132a8fee73f65dfcab31feeb7fff5a72d59b7a94
SHA512 7b7ee745c7c810fb7f1c6573be9f45a6efe14a0547b0afc4d7fb6c8d91fada17528af0c0a6d3420efcac763c2bb9856ba59b4cc8c5edd3403ce8effe6e9b5dcd
SSDEEP 24576:KT8aLl3z0zD7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KT7LljWLNiXicJFFRGNzj3
TLSH
T1727502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 dd541557e5bde27081061bb919075cdf1224912c93268d209a932130a5f336be
MD5 cb4b3dcb23418450c67b8198882b1ce9
SHA1 e8ac7cc784c41f1490d4436dfc254db5d1ea3d87
SHA512 4527dd01ecd8ce9a9c1a3795597cfe20902338b7d04961fd51cf96359a8eb00d2b9d92939512e2d332aa7efa4459756ae48212592e3f2db6e296225ac1a5f6e5
SSDEEP 24576:W3rd9CHKy7GZP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4rd9CHKyaFLNiXicJFFRGNzj3
TLSH
T13585CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ecc74e90bb1de111ba523ee26aa5e1b567e8aebe4ed76e3a177059c3f3c621be
MD5 f16d30be6927f1d9377bb64238ab01a2
SHA1 cb6df386d4bd35cbbeacfd4247b8d9841a763e6d
SHA512 e498774b83d9428d8453da2c80c3d79968cb1984a1a1087ca9781e81c89da83d845297caf4f7ad382a13d5552bc105b51207f729d930e52e1c7653eb233aaf7d
SSDEEP 12288:r/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1415523D3548955B1FAFC0039C6765428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5b178f21d1f19d1aafb235973596ff76063e8f95fb52848aad9354fcdd093ebc
MD5 82b8dc9b2f4cfe55ce484ba8b30e45d6
SHA1 1337136799e6407c126cde4cdbdef673ba063429
SHA512 a8b683d1c05e5e62bee0df4a072b37b7e4a2fdb55af193a4e20eca52597772eeb4dc5f606ecf00c56c488d28f00913ffb924e754147d202143e34afadde3a504
SSDEEP 12288:nxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:n9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1195523D2558955F1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 85d215dba1968bc11738065a308880ac123ff7906e5ab1f54816a94f2e2c0a17
MD5 cc5a9903ba93eeed60d50b0dcb5431ab
SHA1 7407a693753159e4e6491c345050d98651b49598
SHA512 0a49af4dc84ea5c6916b1e8e6c2d829997eb9d8b45b3a9e0bedd7298a2727ac1e82c74ef328c6843fbfc99572c2966ad758130bbc45cc259b8cbb764c4376ea9
SSDEEP 12288:mkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F5523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f956a3016ebf64a816fa6f18730f9eabbfc6ecd2d830368e022d01b0b95333cb
MD5 8c52e3aeb63c11a77c21ddd37ddd2062
SHA1 074a89f14158d009e6231c1a02e80aa0a381d5a5
SHA512 3063a0bcd059f171395938d42e81c1cbc10f78a17fa628a590596599641f9c41799b6d10872234c2784d2eb2b9f0cfdaa308260326322e083318b63944a25636
SSDEEP 12288:qyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FC5523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e136798be5d214fc5bed930d9549cd80a92281281b11c22460dc4dd3c2b817d4
MD5 91005467a42c483f4d77863908ea1d82
SHA1 9307c8142f6c64bd4ecc7a5d61d1ef753f99bad5
SHA512 d04a37a9cc484a93a49d6bc7f1c7ed65320bbc7d12f6e18b02efa4bbb72f12bf82c2788c1dafc27a3b84350eef8ce591cb9b9273a2ba308ea7855b563cf3bd62
SSDEEP 12288:w/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12D5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8fef7ef7bd4df3ac21c1194f7948e015039044301e92b009fc015ae82aa532e5
MD5 2dc98465fa39e8859bb11416b17a6737
SHA1 c83ef8ec9b16cee36264ecaaf2936305e0cad7f6
SHA512 f70fc755f9a3f08a2fa33de6583ed43b649a76487e7431e00fabd9948777ee42efa6c2821cc92e5af8034cdcdac0432e2c97d3be6ae63db0a886cec067ccfc41
SSDEEP 12288:NqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ns/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1835523D3548955B1FABC0039C6754428F5882E2DEB5659E3E3043E1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7154f4714e337f007798705ac682b103364dce6758bc15550ba8bb92c14a1018
MD5 e27a89783a74c3d60eb3033fc1d39dc4
SHA1 b5d35c27ef0b0a8a0d29f7d750db720ddba1ac24
SHA512 dcf0aeba076c37c4da4c97fd16edcdb8166e5c3c7f6a4714704b23ca59d5e8f69c02245657fb3f46203f2918bfd6878d1405fda0b59de50ff557d071a3bc11c1
SSDEEP 12288:CIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A35523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 4cadfc2cd89bfade13b062591749be6a68be0e88692ef986b18c45c0a87aae8c
MD5 95542bda6c68836be836e95892c9c744
SHA1 3f3ec3bd9fbf4cee9a818fe50e3620094d192a8e
SHA512 a825770a9f13a96d8342bae810db7b5f9387fc540cff57db78ffb7e6675ec2f3296c2aef2af4295ab421c2d897d87259b907b1ec8b55c1f404984ddd37636610
SSDEEP 24576:Mfwvzk9RX6wkyAIA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XMnYIALNiXicJFFRGNzj3
TLSH
T15A85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 917ea2411befc89d521ae975b8d3f0a920d6246faa9431af95849ca53a2dc9e1
MD5 9f018526ff6ec8bc3cb1faee49ec39a7
SHA1 1e9222651efc22c31db07c8b17fe07a3173cf132
SHA512 adfc560f1faf7f80557bd01d18a549b5d75c3bd7a70c53289d3b7ccec2f36b43260360fc4f94fef4d10ec3c0ca828c84ebfbcc0f638c4524161fad8f563aa274
SSDEEP 49152:wYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nLNiXicJFFRGN:PySzPP7wRGpj3
TLSH
T181066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c279d6c626d08bb7c4472360a5012ff83e059710b8d41ccd3ecbe2ef30223ee0
MD5 02d5de28e8d72f4dbafb4890a208f11d
SHA1 ed1f500d11718cc2f944058ec8f4d8072ca8880a
SHA512 628794d18b30cb883a2c3cadf0eaaf61283aa417134f6bf6d5d642a05ffe69131bc9358f93176f8062dfb03deb0e1e57503b23c2982d7c1b8b4ed87233eea585
SSDEEP 24576:n47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n47JUQjqirIhCnDHUPfF/XLNiXicJFFS
TLSH
T1E365AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 31476bd66334c1d68644d23c0f6b5788da52df772368a2b4ba9165d17d26378f
MD5 f9c4774f11b229f1d3a019c562222ac5
SHA1 d83022d0fb491d9218221ce758ad0faeaf1bd135
SHA512 ebba580f178ae6819e5e7c661c6a41f62f7b05929a5b1d78be809baeeceb705e8b89e6f3fa786861852dbff17133d25ef95578e67f4ec04951aa9a1e5ddf4925
SSDEEP 12288:7psfiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D565F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 6b0d7f9bee5b2bc0af1d79a3b8ec45c00715ced0e33fcc45fdb305cb892eb378
MD5 286e336e2f35d34e6330742c2db93f7c
SHA1 931ba4b186c884abd7124baaf249d933f1598878
SHA512 18e844a4d966248fc66025e723a45f4e64017aec79cc9d81109057862201982b52864066995a14968d7220331d34528bf74225f2dc2512db73a00598737bcb92
SSDEEP 12288:5DryzyU3f5SM3b98nUVE3jggOVZ85QpxT0O/hgLZ1bBj/YJm:5fyeUP5SZjOYKD0mhsZ1bBj/
TLSH
T1014528007626DB4BC66940325E36D6CCA770BD05FE49AF0772CA873FC476659BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 bfd02526be87574285fe7948731104b1e01d0340c75572880bd573134503f41b
MD5 da8e257f75322f892b8fbf3b5210208c
SHA1 1b213ea34c6cfbd9efca5057a02d936b0a6bb649
SHA512 3b9d52ef5fe6fe15e9b86e4162350b0608cb5ead1abe545183f4a8c4a3f3f419151e5a2c425cdcaeb21e97adca7199aaed88dc0abb57588aeb37dc75b1b5aa97
SSDEEP 12288:rHWgpymI3zUYuORrRQRVYXaupojYKna7z4LDeoMnuYpcRGlPcay9:yBmkUIrwqqck6T0GZcf9
TLSH
T199450900A5B7EB4FC97E5037473286CD6BB49C06B7892F057345893C8867A6EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4439a6cd9810043f6738eda3db839cbb98e2801824b155dccc3cceba32092194
MD5 f51ceddc392e5d6aa2d18f0dfe81ee51
SHA1 3cda14e4153919890736213309cfca091e30ffd3
SHA512 a3a628faadbd64e780d436815030e63acfa5f3c7ab7d07d68b1bb7a909d366f9698df9e99a2801ea5a91400d76d0efead0780dc6bfc8ca492fba06321d07bdd7
SSDEEP 12288:xF7aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F8552393468D59B1FAFD0039857A9438B54C7E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ec6b67360cf11b727477d0f6696121a0755254352a8e812e564bc97eba0c96cc
MD5 6934846cf1245694a4d14fe835116d3f
SHA1 12882e7720f39d4cff6e4c6e2d9bfc7e35614f14
SHA512 6c323eb2b8e968f7bf3d7ec59ade9591a91e8c10790506f593f1b190b073ab0e156421403442bfe3e01b2432e9b6e731af6fb966c816b841616b5d9515d2ef3b
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Bgb4mBIBhGFhLNiXicJFFRGNzj3
TLSH
T11E65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8e38e49839b13fdcbd4ab83b82114c3b58907658eb55bd0400b60682783eeed1
MD5 ca6e41a74285cd7c4a71069355cc15b1
SHA1 06ff67dfbaa28d037425aff06d1f52a0ae2cbead
SHA512 ff5a649248f6b33471555e81aec84d5e8b6d4cee6fb1ba2b61e4d500daf6bb7fc1203518748f40bb481ba26a8db95d43478e50328926bee2c1dcf0eaab88f4d5
SSDEEP 24576:7G88u8FpJqH1vzria7/mx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a7ZFPqVya7/OLNiXicJFFRGNzj3
TLSH
T13B85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f1551d24d7cf439b35ef7c6a73e3875acc661c99a08d066bafe37dcee781092c
MD5 1dc01726fd2296046c0e79407aee5e6d
SHA1 7bd7878e99a9c6979f03ec0d5e9b1b72a2a0e9d1
SHA512 a7a25093d84391dd09b5beb4bce12cc8fed2e7b88f7d9b0a2c37ab542b0dd86ed14c42407139c15fe978058771687904989262cd81f2f59a67c67c6992f2f0e3
SSDEEP 24576:fPUr+NQF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fJQFLNiXicJFFRGNzj3
TLSH
T11E65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 15960b98ccf74c77f4482150eb1d2b3954b953b842cf675ecd7b4b126b11ce48
MD5 97dad7b55318708dfec7bb2191f7e515
SHA1 a57451ca965d8523133c1c70eda0ab8ae616f8e4
SHA512 60aec37b869cba7785f18fc3dfae184af97d27d60080a32431eb163c5ba36e1d37983603f5a7e9fe670344499c56107046acbeafe389e4720977cbaeb06b7107
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVLNiXicJFFRGNzj3:CG05lO43b47wRGpj3
TLSH
T124D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 960d4c5550a5cf3af2abd4edd6f343831845795aa7aee6919813d61b908e9b5b
MD5 c02a7045a0da4528e6ce8626fd2b523b
SHA1 5792ae0cc3278fd2d6de57914d61e9b9ca264537
SHA512 d09059458433d458635f1c34929a45c95eb75a6ca58d9fc93ccd3725f2f13798ec4b754a6162e4cf8ec9e9eecdbc19b83cf89ef8ab93ae64f0dbddfe7c84c562
SSDEEP 24576:vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnn/TwSfVcYG3K/cJHlnFR+IGNe8jg:Xa5POZ3lJt2pasx2+m9LNiXicJFFRGNf
TLSH
T10E65BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 49bf01c709900811c4ecaf94f269472b252818a982d55940fdd397d8066b2395
MD5 d9b45f5425f67f7f97eedeec9dabbd78
SHA1 3f9e0909a60721da51be580808524864cb30b06d
SHA512 d516f6ca9644ca21ffdbd5d4f436ec3772a7e7e570a1a1fd0f3702acdf8c1e98e17e2083fdaa04f7ad6ee658ef837b86f3f619bdc26510cc01db0c9523fa9c91
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tNc/zEOVHFuLNiXicJFFRGNzj3
TLSH
T196858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e003a8e8925f1a8681bfbd3822a1fd70ae099d9f924e9e0c980ed5ce71e38915
MD5 5c5012198f14015b7f85241b83840253
SHA1 97805ad1172f59776eeab847b2830639f4531133
SHA512 403f5ccfc1d40799a0dc64ceb1aec7eb37e572f7b03876c9e3ce602fb7507f559aa0ac26df992f88358a6939be295ed919f1faecbda943e01907dc87c873217b
SSDEEP 24576:NzkNvNnaFeYhJNtmZBmT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NzMwBtOmTLNiXicJFFRGNzj3
TLSH
T11755AF6EB6A806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 1502a5fa8a4394cf25a4cb2766a5286f5fe34217a2f5f3afea716fa0924cc454
MD5 02ad0cb4d1af48469ebe89d6de15f43c
SHA1 a6890e86bc628e8b486ecbdfea55ebf2f24a0067
SHA512 67a686e40f59314ad4cee0ce5cf332f64bcebcd02e3a1e548a8b9690d597489d3d5d9844b9c1fa4dccf26722a625aeae2b2ff22c7141be3cdbb4293434a6e523
SSDEEP 24576:3D3FHshBIYQgAo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3DVHeBIAAoLNiXicJFFRGNzj3
TLSH
T17375E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-116-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/256-316-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/256-124-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/256-118-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1480-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1480-50-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1480-44-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1480-54-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1480-56-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2624-65-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2624-296-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2624-58-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2624-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2708-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2708-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2708-332-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2708-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2708-91-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2708-97-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3116-0-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/3116-15-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/3116-13-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/3116-8-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/3116-1-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/3116-7-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/3604-87-0x0000000000AB0000-0x0000000000B16000-memory.dmp

Download

memory/3604-82-0x0000000000AB0000-0x0000000000B16000-memory.dmp

Download

memory/3604-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3604-313-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3988-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3988-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3988-130-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3988-136-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3988-138-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4368-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4368-104-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4368-318-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4368-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4368-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4368-110-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4760-25-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4760-18-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4760-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4760-24-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4760-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5416-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5416-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5416-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5416-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5828-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5828-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5828-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5828-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5828-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6048-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6048-77-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/6048-71-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/6048-312-0x0000000140000000-0x0000000140222000-memory.dmp

Download