Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 23:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe
- Size 1.6MB
- Sample260916-23f23sfd34
- SHA256 a76ca8a6d2e9af5c38e0f71195197a502daabd006adff4d4f0bc2ce8a729f77d
- MD5 288cba8b414942b2b1a4bbf1bd8c4344
- SHA1 38ca55d56cf29526c1ad8688e5f4380990af00f2
- SHA512 8e9d37a72e2524b91e4fcb9af5b26521bc942e46897685a55459b49b44ea682550a9492489d969e6956ee8fd01846aa7b6cbac24239d138ceaa0ea1fada3ce72
- SSDEEP 24576:Cz9EOG/a+R0gXe4i7ojhsP5Lgrk1TWb4AN5:5s+1e30jaNf1TWbdz
- TLSH T14A85F131360684B5F7C643B058A9FBB954A8AE780B8085CFE3B87E3969714D31A7351F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4356 elevation_service.exe 4716 elevation_service.exe 3976 maintenanceservice.exe 3060 OSE.EXE 3600 PerceptionSimulationService.exe 5204 perfhost.exe 2952 ReFsDedupSvc.exe 124 SensorDataService.exe 2496 ssh-agent.exe 5760 AgentService.exe 1628 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 49 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\F: 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\62b6ad87227843b8.bin elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000049418063046dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e1bae8063046dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d82c21463046dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dba237063046dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a300c6053046dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ffd23063046dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd553f063046dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4356 elevation_service.exe 4356 elevation_service.exe 4356 elevation_service.exe 4356 elevation_service.exe 4356 elevation_service.exe 4356 elevation_service.exe 4356 elevation_service.exe 4716 elevation_service.exe 4716 elevation_service.exe 4716 elevation_service.exe 4716 elevation_service.exe 4716 elevation_service.exe 4716 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2400 2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe Token: SeBackupPrivilege 2952 ReFsDedupSvc.exe Token: SeRestorePrivilege 2952 ReFsDedupSvc.exe Token: SeBackupPrivilege 2952 ReFsDedupSvc.exe Token: SeRestorePrivilege 2952 ReFsDedupSvc.exe Token: SeBackupPrivilege 2952 ReFsDedupSvc.exe Token: SeRestorePrivilege 2952 ReFsDedupSvc.exe Token: SeBackupPrivilege 2952 ReFsDedupSvc.exe Token: SeRestorePrivilege 2952 ReFsDedupSvc.exe Token: SeBackupPrivilege 2952 ReFsDedupSvc.exe Token: SeRestorePrivilege 2952 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 5760 AgentService.exe Token: 33 1628 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1628 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1628 SearchIndexer.exe Token: SeDebugPrivilege 4356 elevation_service.exe Token: SeDebugPrivilege 4716 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2372 1628 SearchIndexer.exe 98 PID 1628 wrote to memory of 5508 1628 SearchIndexer.exe 99 PID 1628 wrote to memory of 4288 1628 SearchIndexer.exe 100 PID 1628 wrote to memory of 3372 1628 SearchIndexer.exe 101 PID 1628 wrote to memory of 6072 1628 SearchIndexer.exe 103 PID 1628 wrote to memory of 4116 1628 SearchIndexer.exe 104 PID 1628 wrote to memory of 4428 1628 SearchIndexer.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3976
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3060
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3600
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5204
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:124
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2496
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5760
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2372
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5508
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4288
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2924 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3372
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:6072
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4116
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2924 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:4428
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 f1af2f80061ce7550d2e39f51cf5191a37074d7d0775b6b87bdfd9d00190a502
- MD5 26bd9097534b4327249d85ae80d17ada
- SHA1 1a76a536385af0803d2e0c2be01882c7e1709d8a
- SHA512 a20c918288499c8a189df594eaa66e241a2025d279acdf00b451e8cc8c1d480c26472b081f363b5d49d565a68375536d3e8d800b566e080592a5b46722afe61f
- SSDEEP 49152:Fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnCe30jaNf1TWbdz:b3q6HjBTU023W
- TLSH T11AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 3a929e11eceb7654d737e9dc3d146bf745955b76021fb7a079282e06ad83a3ab
- MD5 4ed836f3975f770dfd974eb70c6952b0
- SHA1 d95b25d8056e10489885f2a1db9f9d540878fd6f
- SHA512 c6c73567a86c30698fb4cf511e90b7f675130a492e16c2ebba45aa068b77f5472de1136c0cf21b2011eee33a9b37b8ce95cad886c54310344c88254d52ce3ff6
- SSDEEP 24576:gXYfDtczAIgXe4i7ojhsP5Lgrk1TWb4AN5:Xtc0e30jaNf1TWbdz
- TLSH T15685F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 746e93fae7a2e1f8c91cb04de5a70c2c50fd7bb7385e5fc1e112f536070b4874
- MD5 873a9ec89a6b003e22597e950db6bbb9
- SHA1 a4e7f62f2adb0102b3912611c7b4a4158d77025f
- SHA512 266af37530a39449f6beb1de6ba804e2ca3b07ddadc89579a6344ad653df4845d8fe97ac0e07da98f3b058c87d15f926d22ece138582a498c03d27fe398fffb3
- SSDEEP 24576:P0Le5ji0hmxYrMzgXe4i7ojhsP5Lgrk1TWb4AN5:PPji0A2de30jaNf1TWbdz
- TLSH T1E395AE26F6748775D073C0B9C5D2A78AED71308257308ACB4286D77C3E67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 0df779d017448182e56b9f366a2dc11916d93bb09c017eaa1a2c47cb617b90bd
- MD5 302d9653bcfe4958e0ce988de36c5c41
- SHA1 b7ef7b0cfb5de6d18092294ed8f979aff8b03960
- SHA512 41d3801bd58a8bae4d50804624ab2410024e05fb5d1c0415df395c3a8b88a899b088f662a98053fc4daba2637e6416ca208504c3201938d6d766f78b429d6bae
- SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWE6q8wyu5gXe4i7ojhsP5Lgrk1TWb4AN5:Y/ezSC6vUzPvxHjyJe30jaNf1TWbdz
- TLSH T118756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 4cc7c2f7fc1949fe9b321c2d9aff37af4ea7f9e8cc17198a7ee13a9127be3ffc
- MD5 14c876d3e923f031b5235700d6342a9f
- SHA1 63e982412e67768e8f8231665173ff2771360c4a
- SHA512 0961feab2ed1607a3222b377786d5d74fb55d02e92207bedd6c8653bbdec80e4219dde7dd649486e5619412e3aeef2a645fde3e9ed4c67532846da84d484879c
- SSDEEP 24576:cVbqPb88hv/l+6sgXe4i7ojhsP5Lgrk1TWb4AN5:cVO88hXl+We30jaNf1TWbdz
- TLSH T164559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 05229cd82e0a1b9d98f6c8d9efb92b18ddbba3885194431274e9741fee068782
- MD5 8d1272b22c818e80c99e78c1db25a1c1
- SHA1 71f9f34c3816f0bd768b059258089db164e8be91
- SHA512 10fbabc65010825cc0b15308159bca28d2daf72984bd2ee7e2abc0bde05d861045d34d80b2cfc6bafdf9c5593788844ed023e8602e348de1a9cc596a5617a2f6
- SSDEEP 12288:/HO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/HngXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1196523A29F5449C6F38BC3F4A0F7CB91E5A11EC071444E6B47E0FE9318BC89ADAD4469
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.7MB
- SHA256 66623b7b148c44c23ae9e3298fa6c997f65899af2234ecba835a794ebfdaff4d
- MD5 35272608303540aceff00890b4bd6264
- SHA1 e6130fb68f4a426cadf7ff497c4a083c69deb10b
- SHA512 011fda27cf6d25bdea628265e394057f0eaaeafae3c51b79d8211860e71e9d75c7843952a9d794eb1d75216d6ac446236417c0689e1cb8d40eed7fc4381e7ce5
- SSDEEP 12288:jeBNUbTVO86UX0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jJIUEgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T19085CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 c877b3d820cf511c78454c4f16db10b0e06a40f0415e1463cbcc4cb7db4cc394
- MD5 fe9bb7e3fe4d9d023c146e92177af09c
- SHA1 622eaead3b7ff94391335b9b9a4a80408c54b01c
- SHA512 a755de247fac7979bd8e99472f8743dce5ccc68977eabc38bae81a56378c093a449211a9c8b861debde272662d770c06da9459b8a526c56698e843b61632a385
- SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THl:wQvGAdlCEL8c/yRNw5CUU023W
- TLSH T1FD267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 25ed2e7848fd261b451ae1ee1e948d2dd327dc1a93985d7a32fe247ef1a586a2
- MD5 9616f9ab2a7fea8b30a2db1b891c6d7e
- SHA1 0deb735ef5ec9a48437e3f035a555f85bcc5a81a
- SHA512 c14f66194c734284ad71a81d1301779e8ac7368428069a69775c528779851af0187bfcc7354e917e6ec85c79b1bb9f9018251c3fb8c08a9f85ef6d74ebf82db9
- SSDEEP 24576:A7ewsAjKgXe4i7ojhsP5Lgrk1TWb4AN5:iljte30jaNf1TWbdz
- TLSH T1F685E031FE74E032C3BB0DB21B76C716587C6A604B511AC3E3E89E9E59342D22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 593468bb3294dfda363bd22fd861976e3053e196b7612bdc89f9f3912d1fd6d1
- MD5 0c6309942e4cae686f317d7160a8b507
- SHA1 e49cf1c24c0677124ddb12a92c583ae2b102bd34
- SHA512 06aaae28465ced24a3a035a408d32309d5f10b3311cf61609ae88fcc8c438798dd1c05a57f6f42b2985c6ec2671a0aeaea8c98a57edc9da8e3f2f1deb3a8084c
- SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHlp4W:dUEtQevvqc2W1cpV2EI3234W
- TLSH T155474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 90af084f8e4f6ffd24fb03a932444b6fbcc069f0fa1cd08bbed2dc389482bf01
- MD5 9c715d342e4e9d343d9306ccd2b89668
- SHA1 2e9857ac7f495a91a799f1fe07d534b5b4244a15
- SHA512 65257942119aa185004ac97cf6fc74762985eef8c6c13f75fac7402dea9d72238a7727930962f1bcfcdf1da614a3ab4ddb1dd37ec040ccb778cf8ce209079d62
- SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zNe30jaNf1TWbdz:QoqtVjnmQU023W
- TLSH T1FDD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 30a5b2ed2e55ca3a01f5fff438c5a44aead5a278dc5404fc85b35cea841e4a02
- MD5 e661f61f9c88a8b4b8a317f59ba91cf8
- SHA1 352b445c95a356ce065272a20b27acc5edb661a8
- SHA512 1a05fde01d51244ea08550adf512391c4cb5d7553ae433fd155ce0be1b9f053b26be3a9070e3907b10e6aaf731daaa754c4e2961f0e79c1545faf7949e7d82e9
- SSDEEP 24576:mAhGLJIFoiwtA5l7S53lgXe4i7ojhsP5Lgrk1TWb4AN5:mAMyFoiq5ge30jaNf1TWbdz
- TLSH T1AC359D81EBF955D4F5B3AAB899B68171EA76BCA65E30C20F1160D11F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 374ca4b1b790b0c3dd7161e2b41858161172a3aa8209c8c17f4b1b8218f87755
- MD5 4642d5edeea7d375c1a9dac04a761f1f
- SHA1 f25d28bff1e6db4b9b1ba4b62ed44d27fa29f2b5
- SHA512 05628bbda3008a0949eece5663de67a1a2bb4a178e9c575b144ca53788fd2b7d0ef5b7c05fcca5a4ae320a5121fbc8d42d0f5eb44535c3f49fd6eceb36ce13d4
- SSDEEP 12288:5mw5HEjsChNzBFgl0WDm+CY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:UwuSOWmgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T17985F14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 b744c57b2828858ae03b509d0f3c2b6aeebe751557570a79b44ff26a9bc751e6
- MD5 1dc49b07ffde7c8f17fea2ccb56f4281
- SHA1 a459dcaf5f3083863224e743ab18b35bbe5f0b13
- SHA512 799644d1306a81ebd1d5631b47131cc9074aee0d1c87cf3a6af11d6c7cb610b3fc0d2c219f2a5fa1e7c286a290d4087c1357e4ec5518992b42388e3de26d187a
- SSDEEP 12288:AjZ1Iyt0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cZuLgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T13475129637D421F9E2978278D4F28741E7B23882237147CF02A096A71F76ED65E39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 e473eba7000e165fa2d9fa8025e698feb979415833ba0c936e3b25acaa1f022b
- MD5 4d0dbbaec49bb07847de058cddac991e
- SHA1 135944c1c08795cdb97b20a6535c1adfdf152378
- SHA512 387eb15950932078e77a3c3d7ce4a327cc9a3e24a99b7d1948fd40dc3c8eab58b689c9c8f7342ab4e5aba6e5d3be7f361342d32a752e50497213fdcd8e350aa9
- SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:4QRQyi36YOcPQLvw2gAf+PN3HU023W
- TLSH T16E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 b5f2aa0826407c0f2c8be1e559a745bd72327e1abe818204a31a835ccb927d0d
- MD5 8e6a8b15da30b5bb316fb9a5a121e368
- SHA1 470129056c360a7b781732f0074290a3a36af835
- SHA512 db8970d698df4e4a7c1b95ab38bff721316c7c58c18d38ea8280888383fd0a886bdea172d3aa817916c33b480cc0b728c0a22b8128ab656f585822cedbecc2fe
- SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:pQRQyi36YOcPQLvw2gAf+PN3HU023W
- TLSH T172667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 b3f30c98f899dcdcd92b15151db722f085bd653aa434cbcdf8abaa3a50ce0c76
- MD5 f2647d399efe50bc28d254a166302e0c
- SHA1 574fd293dc18d18d1a442cb33507c16cb785354c
- SHA512 cc686302a8e5fcc6f1d5130ed9ad4288b5923c2d668156d811336f3a5441f3a53a5a7d79cf721ad0969e6f939bdf589cf215d7882ceddc5a20628f2bf62876c3
- SSDEEP 49152:z68Qg55nhheWu7PNU3/de30jaNf1TWbdz:tthWRc/dU023W
- TLSH T157B54933B2F60099C04DE1769F4A873196E27C758FE0E7DB855172061BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 4d8a8c211a9454738dfbba1f220dd7ebc520438f44fc9916e41322a0d9b89ac3
- MD5 e2c904cd1f65ae1334626da062210758
- SHA1 6421678fd4a94fc4b4379dccd7551091d4ffbac0
- SHA512 7d8fa29c2ae5c38c358e3a2e9b3433c46a74d214f17fdcf67ce27c99c067d091e4399c08de2828e449dcfec94e7d183fc59b4a80e345c92a35f046e24b770240
- SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99f:/y5112gYy5azzVvL69nLKnhZOU023W
- TLSH T144168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 5f95cee942b4d8f5670d7704205a8a7716201e93c0750a37beb30cb6ea659b82
- MD5 78f0a32de56b884712d0bdb9b7cd5c6f
- SHA1 42de055e2f10f042bb40e6de85f728c90e80dce8
- SHA512 93ebc4d692a62673400152e120c13b75618ff0e4601fb32006f86a9b4b0766aa3215b13faf5a4d22428a0850589ba8fd8770e38a65e108b9580afcc1a31797d2
- SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glve30jaNf1TWbdz:4u6JmVxd2dvU023W
- TLSH T1ECD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 f7550e3ba4e436c92ef921d922c6003b51c28388844544f1871a3bc657d82084
- MD5 a72a84dce1577f3ad5f300f0fb253e58
- SHA1 09781ed0556a58ef2e509acb450e55f2aaf86f2e
- SHA512 5ebdc580b653858f656c5845848452cb631c412b4b842afc51414cfa87d77c1948e4d8a0bdbddaf21cf77b94ef733b5797378c1a4c2ccaf3bd5089f81dc5288f
- SSDEEP 49152:91hpsNoJpF1A6UU44CwH7R4xLe30jaNf1TWbdz:9mifPbRQU023W
- TLSH T151B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 c2782c02d17539b3efa304a2bf4c5b1c433f1d40716b60fddb6dbd9629376fe2
- MD5 c23aa9e361c12fda3dc99bb00f1cd4cf
- SHA1 af91230e53cea5fc5df7aed43d29e1f223927081
- SHA512 91e529b6d282e1a3559005399af0144149bffab65022d0379fc90e643b2f57060091bf5eb09771655733df8745e7a5fcd9ee80b4265d5ee2aeee25c3c490697c
- SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqSe30jaNf1TWbdz:Y5dKTi61SU023W
- TLSH T150C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 6f44fb86de5eb996c6f7e031fb909709b46f65efa2b66a0a503bdc00d66edba0
- MD5 45b1457c076c105f6975be0c0dfc4d34
- SHA1 89d11753cc825c85be50d0dc1daf76fbfb64fccf
- SHA512 242666bd3284cc20794cf17850af97d13029eb946aff2cf5cdd8fa98cbf50aca1676585950a8b06c346c3a7769e4f60d93aab52a7e1a125ade6caa9716ce9137
- SSDEEP 49152:9htSn8EApI0figngiDn0AP5w/e30jaNf1TWbdz:sX2iyphMU023W
- TLSH T16595BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 5d8badc49bcf0676b2c41dd3cb7b2782657e5312228a9b00083f24ff8f16115a
- MD5 fd45dc2a1f360f4bb8a13580bded263f
- SHA1 78c1ec7345f7e7df5d5b4b9226be0aa85856aa02
- SHA512 54178e9aca8bd33bf083633f34f58e086bf7e6506d8fcbb30db9dcf0a4e10e40a1fa90a4b595336a0dc54807ed1e3fb7e5d5973be726a35c46cb86c4c4d522e1
- SSDEEP 12288:Vm0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:V/gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1E6652392AE5549C6E34BC3F0D0F787C1E5E11FC672444E6F13E0B95319BCCAA6AD84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 207a9ad2023145eb5d32a375ee85e8c6cd68e9076f06988977bcf66d5a600212
- MD5 35fa252c3625cb4ef11939fad1cb80d6
- SHA1 c00673d0e54f1b6a609ee382f86ecb2d7016d614
- SHA512 debec16e19de351ddbd9004b2d7c8cccdf2d3d965583573a3da3440697728f101d92b4f31ea7623588bf73797ebb37009396d5a11abdebb1cd7a0cb982972aaf
- SSDEEP 12288:jB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jugXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1D56523A2AE5549C6E34BC3F0D0F7C7D1E5A11FC672404E6B17E0F95319BCCAA6AC8468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 66522b2c6acb5d7feb528f6f34f110ece0166e5e5ae62822d2ad5a1d55a98936
- MD5 28092e6fab02ed891880454748c284f5
- SHA1 03deed717c7726cc2888e8c17c50f29727997a51
- SHA512 81f7a6404ec2a3870761b4949a9b95adddffe60a2a7bde2497b2e9ebce6d1fa6b7a94dfa4247d5d9748e7311fdc7153d6db8066b3a598d941bda821ce3952622
- SSDEEP 12288:Ov0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:O8gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T153652391AE5549C6E34BC3F0D0F787C1E9E11FC272404E6B57E0B9531DBCCAA6AD84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 6e85e258dcecac45c3efccf11da1d534301e85f7bab678cf5d3fe2d6280ef81c
- MD5 b61313feeadbf2c0457c3888d125c9b2
- SHA1 a1a7c1aee5a045bfd866b331f0e760b54b41993f
- SHA512 6ad5cc4b243b6060508acab32ed9218b9565be337a613ed61ba60657a2a8c2ebae37da5fd09f3e6ec4acdf78eb170903339b6b50b063c63cfb7073c5a96a4160
- SSDEEP 12288:1VE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1DF6523926F6505C6E287C3F4C0F38791E6F13EC173114BAF47D069530EB4AD96EA8A68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 bbbd78d35515076ef8b837f106b2248c1cfabdf2aa3e262c6dd2974c34888134
- MD5 a9ae897eff1fcd4c7b471b53657ad071
- SHA1 e52afba245c174e78b96f524482434d65069238d
- SHA512 311dbfce941ddd3fccbbdba0183d77df1d32e23831e2967fe686b0a416ddb066b00498f9f8697b69cea80332475425013141a4d3d455520046a6ec9bafeca25f
- SSDEEP 12288:gM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:gtgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1C7652392AE5549C6E34BC3F0D0E787D1E9E11FC272404E6F53D0B95319BCCAA6AD84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 880a0e9b6eefdd946d60337eadabad27a545a363bcff92d16b16015b33f89473
- MD5 479b5fd4b42b203b5a0898f599879426
- SHA1 d6590719e51ae665bf75e41555f78ed2fa7da797
- SHA512 b938376b114f20174a3ee900157e44ec5ecc944b6091a0a7877cfa1d2be40cb620d4de09bac90b65f8958671428626c6b93f379cdc963b615648c58a86685469
- SSDEEP 12288:DV0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DigXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T14E652391AE5549C6E34BC3F0D0F787D1E5A11FC672404E6F17E0F95319BCCAA6AC84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 bd43392903f63ba7559979f5d8eeacd29f3b0ece0f621fc714b67f9cfcf4bede
- MD5 4f52b33bac8f44e40d66f2604ad05385
- SHA1 31bb6f572872d11fbcfe7ad3f564f5b3e7d696c5
- SHA512 d9590408ae2a18eec8f58f8c6e1615d07588f6a1f41ae16ace1195d7c8c613ae23d6f9da03127c2ebfee5644053f96b2d985857abaabc94e327c71bc04011f92
- SSDEEP 12288:op0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:o2gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T16F6523A1AE5509C6E34BC3F0D0E7C7D0E5E11FC672444E6F57E0F95319BCCAA6A884A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.7MB
- SHA256 74a2551d855cf8b1cdb502c18c8b432a0c34978582b027f520c7c02bdff1fb46
- MD5 84a07535408027ed204b698311efa89a
- SHA1 7cbcd71ae3b18a4fe788c4d6d5621c1e7c8ec6fc
- SHA512 1f7d2cc749b256c1e4e4128a074dff521831d512126a5b07f5f469d2f401eec5defb86798ac927cafe3ec971bc191ef7c62defd86a1bdff68ff37d41f957538b
- SSDEEP 24576:1ZMEzFVSOOgXe4i7ojhsP5Lgrk1TWb4AN5:1ZMEzfFe30jaNf1TWbdz
- TLSH T1DD850195B3500CF8ED67827EC8A68A06D6B27C561760CA1F03E436671F733A11D3DBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 9a868da2c6efb3847b5d989ace0df69f25b03aebbee8bef512fd7cdc4b3051d0
- MD5 ea6456bd85d912f776030ca51ee83877
- SHA1 055a5041d434ed7c112b8126ca53e1b8e4f9e301
- SHA512 2ccee51bde23635f26aa726c85a7992f9573ca4e1ae1c9c61b96da14f129e928c5074386ca596435da8324a92d82fd0eeb97a6208c5c355acbb16ac07cfd3e34
- SSDEEP 12288:ti0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:t7gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T105652392AE5509C6E34BC3F0D0E7C7C1E9E11FC672404E6B57E0B9531DBCC9A5A884A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 861af78e14e5c2db231ed53c490a1c33c40ded996271bcdb0947bc382b91acdb
- MD5 3b4cff4a6d82e33831144a0406f08f3c
- SHA1 8ed58ff4022c1c3101a2b16aab900e16a59e58eb
- SHA512 c2457bbc4e077b2bad2d48df53445731ad179b59ee91fc0e9131f0d71a9718d246568e153d2f9eabd442a91f85b99440fa78cf8c1d67a77b6ec0f3425780c044
- SSDEEP 12288:Ae0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:AXgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1446523A2AE5509C6E34BC3F0D0E7C7D1E9A11FC672404E6B57E0F95319BCCAA5AC8468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 3c1298def8d04e2b3c65c74c44536490abc638882d4fb78901e04e5d716c42e5
- MD5 5b2e747bb2e594c562b0d388a9c6803b
- SHA1 b7a01f9f0a4c8eff4a3ae500a5a14c9f2760543b
- SHA512 be1dd290b50e3f7ee28fa6a3ef81b1f6b9875f5ed241a92b2bb6346d61b930d57637381cc21589d8dc49fefc21673f2f1e28a54d28bb6724584f53454574240b
- SSDEEP 12288:cyPz5L8t0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Fzy6gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1AD75025777A120E9D1678278C4E24B41F7B27C7217208EAF13A057732E376E19E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 ac851cfcf6b965c4bd680f57a21dba5d4f090ef3e7fbd6b259328998a2cc6e60
- MD5 2d2660e6efd419e9ddee4b927a251605
- SHA1 f5058c3f9400dadafbd1399057c8d4c084fba97d
- SHA512 94d4628a5300f50426ccf737b6b7277822ec8fc77a04634d2e60c16c61930f981042e43d41b1753d44d2dfe08639e309ee50530e3048119be26e73416c4c7542
- SSDEEP 12288:Ui0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:U7gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T192652392AE5509C6E34BC3F0D0E7C7D1E9E11FC672404E6B57E0F9531DBCCAA5A884A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 5f3f6fea19734d121e62ec36f05bf8544fff272eaa8345d5cac347a4d675656c
- MD5 9c06550d8d843735abe68f101d6c7a21
- SHA1 95dc87a9e94df9f044556524b4e54fdeebd1ef25
- SHA512 f73c461df87de26f42db6547a0bd1504dd52e1f412444c863648b7d8d4350cb44a8589014ba6319d7cd5d72426c667456fc7bc0a87bc80056db6487654423a93
- SSDEEP 12288:Ii0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:I7gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1866523A2AE5509C6E34BC3F0D0E787D1E9E11FC672404E6B53E0F9531DBCC9A5A884A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.6MB
- SHA256 4f7d63473421fb51f558db75f407a3f9dff46e8eba06b0dfa178fd59bac66c8c
- MD5 ff2972d87140e2cd46ffab23165e556e
- SHA1 442eb172f9d6682921cec9b2dc7ea1673f7f6303
- SHA512 3912b6a076d969dcf0f629c8484d4434b8db22c5e0055f24a3194b3157f2953365426069b59cac8029b1e66a01693b5ca206a856fc5938d774f6c84df1ff5f9a
- SSDEEP 12288:tyPz5L8t0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Ezy6gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T18E75025777A120E9D1678278C4E24B41F7B27C7217208EAF13A057732E376E19E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.7MB
- SHA256 afd6e1a7221ac1ef37a7a9753081cb2cc83c29dba9e82c3242a6cfebc30f9e30
- MD5 24f52395f9611c716f05e22846202a15
- SHA1 130b64f914a4c9a7fb7b1bf1d44f260c2c31d6fe
- SHA512 16d212d8bacae7a5dcaf6a9e2f7cee617a84aedd6a94c4814a66b87121929402913827cea720c1d1ec8ea05c17aa73a6ab924320a296255cb82f71c0fde57673
- SSDEEP 24576:qTdaLl3z0zDMgXe4i7ojhsP5Lgrk1TWb4AN5:qTwLljEe30jaNf1TWbdz
- TLSH T1478502A5B3500CF8ED67827EC8A68A06D6F27C560760CA1F03E436675F733A11D2DB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.9MB
- SHA256 d8cdd0e7027908bfc35e92c1ece16fbaa30b3a027abe019ee9418bd3d5949c4d
- MD5 92f55f0ad821ed7b379f228571bca14d
- SHA1 4cc19f4878d5e04224884dfd8979030ae2fd4633
- SHA512 285020f5bd1ccae22a25ba99955a8f407b6e91d4c2c509492550269576a778924d73602c63fbea488ca98a612c7aa8ffd293f31a2b09ea4651979d9f80ce7239
- SSDEEP 24576:b35d9CHKy7GZggXe4i7ojhsP5Lgrk1TWb4AN5:75d9CHKyaFe30jaNf1TWbdz
- TLSH T18C95CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.4MB
- SHA256 d6e7e437c861a348bc532baf3dcf208520a94cfa4809fa8fc7204cb176e5ca8c
- MD5 2a459c1bc8005210e628c8c7b35b6733
- SHA1 e58df097da52d53fbe324ee1e4fed2c115bb26c2
- SHA512 099fe7bee7a6db29a7e1c60f8b0a9cefecb65662e8f2f68bacdc453cc55668d28f44b8d081f6ec34c3f3d86cd77cd4f4e9dda1072c1a2d18c686c83735b56bb7
- SSDEEP 12288:wP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wcgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T17F6523A1AE5549C6E34BC3F0D0E787D1E9E11FC272404E6F53D0B95319BCCAA6AD84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.4MB
- SHA256 3066a5d39676271fd71dd78f4ae678d4bcab01d75470d5016c9da60097e34216
- MD5 fbefae605b95bc743891d849b9a9665e
- SHA1 a4b3528e28e7d9f5904bdfbd096f0d7c7aad06ab
- SHA512 2cef94299d908596bb06ffcfea6958716ef2c449e388c2f87d83970f898f3c4e2af50cb58d35d2e71e01d6be936af87630008ced47e5fe5a525c69de7fd57c96
- SSDEEP 12288:SN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:SagXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1956523A1AE5549C7E34BC3F0D0F7C7C1E9E11FC272404E6B57E0B95319BCCAA6A98468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.4MB
- SHA256 78524c4258170f5620ef2f1a2b633857ead12302cc7bb92124f51cccd6025753
- MD5 ac551bd8a8bc527a4ca4f68f84bd4628
- SHA1 d32150a075bc2910016e5bdfb797237971a4e274
- SHA512 8d113f91f599e997c8e68ab5d8b64307185e55ed4d1759844f08230783c505aa8f7e1a884c5dad32e4d23fdcafb290bd89f7b032f8e0f5dee93b6e05d8182ea4
- SSDEEP 12288:fg0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fhgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1C26523A2AE5509C6E34BC3F0D0E7C7D1E9E11FC672404E6B53D0B9531DBCC9A6A9846C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.4MB
- SHA256 4e280ac1e38da399442fd670f36af6fb80d9108721fc35317ea1afc7cd9f650f
- MD5 09612f4572702d78ae43b29c3ac359cc
- SHA1 3bc10672038a797e7cc59e2b4968e85a41ea717e
- SHA512 601651b404f8366b070c02132c95c5330362d8cc4c69c26b7816ca3acf28a8edac4b7e4d3f7bbdbce1b9e576e2e5100b86c3fabe7688827a5d55b5c64d0a9924
- SSDEEP 12288:Qi0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Q7gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1106523A2AE5509C6E34BC3F0D0E7C7D1E9E11FC672404E6F57E0B9531DBCC9A5A884A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.4MB
- SHA256 9652bf0573e835fa439106f6b5e88d0a76c1e7a1a4623de459498a8a605a74e6
- MD5 fb51fc9893782b0761630d0c3e7795af
- SHA1 3717739655a0292a6c17fc2a7ecdbcdf882d8530
- SHA512 342935b861dfc433a544f85d5cc42a0af17a8444e3a6569563fbae1b2785d6b7fd8234fcfa86b5b7d72412f7ed78153dce0ee7601b8da378c5a6adcab95c68c8
- SSDEEP 12288:uP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ucgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1B4652392AE5549C6E34BC3F0D0E787D1E9E11FC272404E6F57D0B9531DBCCAA6AC84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 99542c04855e128d9e1312c34634bff3a544860e5982e5ee63d600f0fbd05f36
- MD5 ae4027b1120dd3e1958d6ebb87427fd9
- SHA1 2ea14b1d0b7e88aa6e6becec856324d1f98944b0
- SHA512 5fb7d7afa8fd568164b65ba2a7843b476049498ef35439648c0e9dbec1064fdf50b21662dc9f8775fc0b3a41ae03db5ae7efc3194b412c04dc19b51c6ea2686d
- SSDEEP 12288:yK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:yDgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1AC6523A1AE5509C6E34BC3F0D0E7C7D1E9E11FC272414E6B57E0BA531DBCCAA5A88468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.4MB
- SHA256 698bf97b5bc2b420db8e04e6e90c4b699401c9ed37ca4cfc5dd59314f3ba6654
- MD5 706d0dd153826a5ab54a06dca14d1f40
- SHA1 a9963261cb7fed66b46c3edcf14fd21484d14656
- SHA512 4921935220f37233af8d812b884e33cb3b2cf223fab542771a012a1a9f200c8ff8a615cd63eab8ce52985e2d9fd289e8d8dd208a7b1066c2fe1c44f7237d1400
- SSDEEP 12288:dM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:dtgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T185652391AE5549C6E34BC3F0D0E787D1E9E11FC272404E6F53E0B9531DBCCAA6AD84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 1.4MB
- SHA256 31da22c9fc269d76edd69461367e441240b2ef4f9597a62413d8d2faf5939e4f
- MD5 d92ff9ca0f49e26fe3f88811c76c1fc7
- SHA1 fca62559a66ddba7eaca8672615ecbfb4b835383
- SHA512 a0c9d25f3f93249ef3cdf0bda1e61d0e0bd5f7b62976274d5ca6c23b2ed462595a3a304bd5b5a9cf3bbb8bf102f52df1b0b7df04b4595e410523dcbd82c92eba
- SSDEEP 12288:Zn0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Z0gXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1BF6523A1AE5509C6E34BC3F0D0E7C7D1E9E01FC272414E6B57E0BA531DBCCAA5A8846C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 1.4MB
- SHA256 a02d28c11894183d49a2e8f70c9c7c8cb758d5a64444c089489d5035db540ac9
- MD5 b27be84d149e71af22a6f7173f34ebf6
- SHA1 6f32dd8004004a29d8a06f1d3f20fec088ad6c3d
- SHA512 94b46e6c5c1ae00178bb6af12609d5c40fd47905058c70d39c6c419e7b6bdb431b36dc5943e8e6eafe2361e1fd1170cb73a9ce30a20538cdd62a67ded19e6417
- SSDEEP 12288:YM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YtgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1486523A1AE5549C6E34BC3F0D0E787D1E9E11FC272404E6F53D0B9531DBCCAA6AD84A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.9MB
- SHA256 1ff218450e54a22f49c9be106d324ede2b428dc3384921d254a11cdd181db116
- MD5 a54b8701e5714652ad836b23127d3550
- SHA1 73fee2f9c70abb1dd82c31d605e156211ca375ae
- SHA512 81d129177b67a6b03e25e2911bcc7ec5dab653c738ada5a134bdf217fcd9439539b3ae967cb57ade766b1172385e5e49e202ecf40e41d4bd5ad3dae3e3ef0c58
- SSDEEP 24576:dfwv+k9RX6wkyAIHgXe4i7ojhsP5Lgrk1TWb4AN5:1MnYIue30jaNf1TWbdz
- TLSH T1C195DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 260ab4c010a43e98d33799d293502aa7c4a16f94a753b0cdba83e405f81972ee
- MD5 db3760bfef3bac4e99cb071442eee18b
- SHA1 e8a2cdd9ddb98430b230f459461403de244a6efb
- SHA512 6b0892b5398e6fb02ab58f486f4af7a4522783bd68f0b5764dd8cda3d2fc47f651a31137a3a7737bca5fca332b703b23b8d7e69f2c32c014620464cc97531952
- SSDEEP 49152:PYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fe30jaNf1TWbp:LySzPnU023W
- TLSH T173067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 43fc1e9919e258193a569af0ef41c73051fb7b74b1f47f053f2424b279f98edf
- MD5 76d1409006f749aa9e5d6eea8cf66401
- SHA1 8ec349a63df4bdeacc563324544efeee24cad9b9
- SHA512 1d12e8892217ffb2ea00692f85321216db7847e2cea0651ddbb24d47a5d4a1cf7e77a8f27af9e428849c62b7c68e0da009f096c148f09d4e881cfd2e97e59121
- SSDEEP 24576:747Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY+gXe4i7ojhsP5Lgrk1TWb4AN5:747JUQj1irIhCnDHUPfF/ve30jaNf1Te
- TLSH T16165AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 78cf73c69ed42fce9c27816e76fb3d4d5741d0e0cacf80a746bfbe7ceebf7bcf
- MD5 9e42df197ef1daef2268ed2e4fd39620
- SHA1 973f956e2dc09268a77f506721d3fc41d6a74691
- SHA512 d2c243459c1c6745558d960713c556a1e719baeafa1310e4d5dcd783e2c770007a5420c90c0edc4561c6812d4aff1c81ada35b79eeac2846ca709ac47ab7e82d
- SSDEEP 12288:5zsfS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ALgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T19975F05AD29802D8C15E92B4C3968A41F3733C9593E1C7CB13D0F93E1F79A949EE9A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 edb7081347995728c6d5ea966dbc2c82c80fe73d885dc42d54ebb4554d073c95
- MD5 8c05136a034e7a60d46aeff425d41121
- SHA1 c09f9cce03221b6cca840d1c94e6b759371678ad
- SHA512 045128f7f5ac17bc0802f804da5658e7d071f50fc2f82d8abbbaed709facc46cd052b40978143a6c85730074fd1fd342b48fc98fe7b5498d38a6a928623f8f95
- SSDEEP 12288:0XedQYAU3fDPp+sq2P9eWYi2uSlMl6Ytun86dUileOGrUJBP88rtJQnf3X5a70dH:0XedcUPgWtu8+lerrUJmSCf3X5aYOy
- TLSH T1514517007626DB4FC6A940325E36D6CCA7B07D02EE086F1773C9973F9476659BAF2281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 d00aa9635621754d3bdd9080e938c9280e086af04db4e05eabff7b22bf5fd954
- MD5 b45c5d0186ddd20f16a1bdafd72af4cc
- SHA1 9c6ebf5bff422e4b23ad41e83ab076c86355cec7
- SHA512 974c49fd6ffa04f03453c26f174001a6e88b8d080e0a7e7c014136375cd5522465bf3d6d484c042e3fd551401ecd7f469a60b1499d9c66da1a32ef957cff1052
- SSDEEP 12288:WnXI/qErLIQ5/pA21H5OxVMQm/LiQ3jm3K2yKl8yKRyKFMom2PSeWYy2L6ynDxh5:WnXez5OxVbiGAiHNKnzyTsk8P+C9F
- TLSH T17B653901A5B7EB0FC97A9037563286CDBBB45C03FB492F0573458838986695FB6E23D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 0b3a5be88ebce19c5e226443ce39aac9ac9dc14359928208350070ac3e8ac06d
- MD5 2dce1e2ed7cf294dce816ed6c6fa33ee
- SHA1 6289bc64ab0b016eef09e759544893221d5f8fde
- SHA512 f70acdaa172e20cc5881a5c8306aca7428d5362a868dcf5e2f11189b658fa72ce8d095ab92e14e79cb20d1776823af03cf488e23d266a03a4852b18a1bd23e45
- SSDEEP 12288:w+760DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XTgXe4i7ojhsP5Lgrk1TWb4AN5
- TLSH T1296523629F584DC6F29BC3F090FBC760F5663EC1270089EB52D0BA9319B8CD99EB4519
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 957b69888e8b98e7cda376cd923a5979db9f1032d5564d1c0fe9f1c55e9412a7
- MD5 2548d9b753e8fb417f976384827ddc8b
- SHA1 9e9ed41aac5808ce813b288ced3622ee6874e967
- SHA512 51815ac8ab53b2b1c81712d45b7d77ea93aab16b3cd5bb375b8e0029816afcf870be43cd21f1fb50be03ee93ae3eb6e46dafa8f06835fe62b05163806a5d90ae
- SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bY5gXe4i7ojhsP5Lgrk1TWb4AN5:igb4mBIBhGFRe30jaNf1TWbdz
- TLSH T1EA65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 f0f06c0114a385284a9d4b1e9319055a6131371628763d026ea09ebf43e828bb
- MD5 cd38399de3b8109e315773d073f937b0
- SHA1 59dc35ff3a86d0621d87cdb40650adfdcf291b92
- SHA512 d3b001577fbfc2daae734fd3fbdfd7d333b0920590b871f4eecd25c0b7734fe86c7ce0b095d02c26d12203229a8db80713ae9c8a655b1c13d4dc9e404fb24d0c
- SSDEEP 24576:MG88u8FpJqH1hzria7/mOgXe4i7ojhsP5Lgrk1TWb4AN5:v7ZFPqVoa7/8e30jaNf1TWbdz
- TLSH T15C95F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 c98c7e5c756a7e6c127e29d643d751def11fffe9c572ea04a5b9f4c310c15829
- MD5 6a0589dfbd022b229e400f0082ffa9dd
- SHA1 5df336ca203b9381b26dd428a4d8fb54a6af3b7a
- SHA512 2c71fa1a8dd2b543706739ca3be92261133721cde7ca63fe1b31d029f789da95dc06e24d9d99633fa9007ca8a3bae5b144f872454679010b0189016ff968f428
- SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1e30jaNf1TWbdz:3G05lO43bmU023W
- TLSH T13BD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 6a1ec89993c176a3c77bcaa24daca6c212737af9588c73790cd8e69f8064fbf6
- MD5 e5e4e2695f984c165b646a22bbcb8369
- SHA1 266feb975c74de7799e25d9cf1ef562b6ecd1579
- SHA512 7b64e64db3b763071261984afa808c6a26f7d97ca92774e7cc17302b9f85e809623ebb65d2d3aefd339d3dca8bd76aa5f55b708f69e83d312779bbbeec71c256
- SSDEEP 24576:Nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnogXe4i7ojhsP5Lgrk1TWb4AN5:9a5POZ3+Jt2pasx2+mde30jaNf1TWbdz
- TLSH T14465AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 1b53818d8a48e2c217073c9898ba9a128c22e44752608425b6baff9528fb9d11
- MD5 aff3e3d32591c0842f5951a49bda72f4
- SHA1 d64ad6393f79cee9003b7ed4708e21294810ce90
- SHA512 9a32892fcd5036d0f6b46487ee3d1336292e8a40076597141bbd14b4b5b693dba01274ba88cca0f015f121797ed3cdf8a246eb88be2bb063c400869e4f8ed0f3
- SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkGgXe4i7ojhsP5Lgrk1TWb4AN5:hNc/zEOVHFce30jaNf1TWbdz
- TLSH T1D8858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 4bb97a59351d32fe884a7a11e3a161def7d00f508e736af6460cb9b5cdccb546
- MD5 abe4279a815018d64a94c4041c2d344d
- SHA1 cd247dbc80b732e187a7b0bebb69be01a72c0c6b
- SHA512 c27851bd4fcbc0bf58834d2df14ad8369f844325d4e85ee15caecdc64dd876e20b91f1ebb135535600c8d5c2658a3a8ba6a67272d2f497d9b2843959ce9ef001
- SSDEEP 24576:28kNvNnaFeYhJNtmZBm0gXe4i7ojhsP5Lgrk1TWb4AN5:28MwBtOm7e30jaNf1TWbdz
- TLSH T12A55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 76a90a6fe750abc22bd1f8a1eebd5d800d652a0b009a18ec9527d84789900824
- MD5 95b05e99421ae99a33dae2dcef2f0b04
- SHA1 92476d5e637b6c1199a0d192512156040bd3196f
- SHA512 7a9c6abac2afcdadb9372d4d576093a25e07b0f2bb85dab0b2d72886b4879ec6c29e9bdfbfe9490ff609a45246e46c2d5b8fafeb09e36f31d67a8ebaa50d9b61
- SSDEEP 24576:tPUr+NQSgXe4i7ojhsP5Lgrk1TWb4AN5l:tJQFe30jaNf1TWbdzl
- TLSH T10785E12F66A81CE5E27AE17C85828719F7717852131196DF02E0817E4F67EE8BD3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.8MB
- SHA256 80c618b4650c8805ee91fde4f82bc39f96845d9a203d16b3b8ca6212958da0dc
- MD5 073b2101a1538800043b2b7045f1ec03
- SHA1 b46bd82ed26bc64c0c10b665c3ad580462d48ecf
- SHA512 aa5a56a84f24d63d3e3112977f27f2ea0962469ffc8849dd74b55030d79dfee6454ab73fa9e197052d714faf65c6c40ea4bc7937b1cf0050aa4c61187f6e2950
- SSDEEP 24576:+D3FHshBIYQgAfgXe4i7ojhsP5Lgrk1TWb4AN5:+DVHeBIAA2e30jaNf1TWbdz
- TLSH T18195E17DEA5C04E4E57BC1BCD6A38A06E77138A903215ADB02D0D1B61F6BEE46D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH