7b60fdd92c847e48c22a9e6a32a82fb2c78a2cd9b9865ccab2633a2f304d67fe

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_00d69e594869c33e29c23dba51292052_mespinoza.exe
Size 1.3MB
Sample260924-s8texswdlb
SHA256 7b60fdd92c847e48c22a9e6a32a82fb2c78a2cd9b9865ccab2633a2f304d67fe
MD5 00d69e594869c33e29c23dba51292052
SHA1 d58b935f9ac817e868d9d1dfc8c96bc60254f340
SHA512 f0b8b2921e5c79cadd4b1c7b4b94bcc127ebf8df9a2c6efde081397c761a2bd6fac4711c5680ae673c4f4edd75ac1b3c148d40051007d1dfdedcb5e7b28642a2
SSDEEP 24576:HUHm4ZC6OXNbG7/5MiGpxAoYmK9jSjwp:HOc6OXNbG7/iiGpP5K9mM
TLSH
T1E4557D18BB68D4D9D2A2C2FDC642665BB3B6BD38473189CB0314551B5E3BCF8997CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3632	elevation_service.exe
5924	elevation_service.exe
5544	maintenanceservice.exe
1248	OSE.EXE
5100	PerceptionSimulationService.exe
5632	perfhost.exe
4960	ReFsDedupSvc.exe
3208	SensorDataService.exe
5384	ssh-agent.exe
5364	AgentService.exe
5620	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-23_00d69e594869c33e29c23dba51292052_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-23_00d69e594869c33e29c23dba51292052_mespinoza.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-23_00d69e594869c33e29c23dba51292052_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9fde1df83a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-23_00d69e594869c33e29c23dba51292052_mespinoza.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-23_00d69e594869c33e29c23dba51292052_mespinoza.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005d59d1253c4cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000638fde233c4cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004707e8663c4cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c47732273c4cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3632	elevation_service.exe
3632	elevation_service.exe
3632	elevation_service.exe
3632	elevation_service.exe
3632	elevation_service.exe
3632	elevation_service.exe
3632	elevation_service.exe
5924	elevation_service.exe
5924	elevation_service.exe
5924	elevation_service.exe
5924	elevation_service.exe
5924	elevation_service.exe
5924	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5648	2026-09-23_00d69e594869c33e29c23dba51292052_mespinoza.exe
Token: SeTakeOwnershipPrivilege	3632	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5364	AgentService.exe
Token: SeBackupPrivilege	4960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4960	ReFsDedupSvc.exe
Token: 33	5620	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5620	SearchIndexer.exe
Token: SeDebugPrivilege	3632	elevation_service.exe
Token: SeDebugPrivilege	5924	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5620 wrote to memory of 4336	5620	SearchIndexer.exe	101
PID 5620 wrote to memory of 3164	5620	SearchIndexer.exe	102
PID 5620 wrote to memory of 5640	5620	SearchIndexer.exe	103
PID 5620 wrote to memory of 4816	5620	SearchIndexer.exe	104
PID 5620 wrote to memory of 2220	5620	SearchIndexer.exe	106
PID 5620 wrote to memory of 4552	5620	SearchIndexer.exe	107
PID 5620 wrote to memory of 4244	5620	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-23_00d69e594869c33e29c23dba51292052_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_00d69e594869c33e29c23dba51292052_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5924

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5544

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1248

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5632

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3208

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5384

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5364

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4336
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2828 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2828 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7b222d1906f809e0dae8dfd1fda66cf08b809d6c6c395167c45774b825d43878
MD5 85cb36bafa9904a76d6558f730b424dc
SHA1 94c7174f789f547b24057a9ca315794ae43d6f8a
SHA512 de2ad0d6d5efa2d6ffe28de1d40bb699d87f840ffbcde560f6a0eb381a8e14ae405ff9d5d76cdcdf3e600237939e78c5b01c39dbe1cf1eaaa88d5e7be76080df
SSDEEP 49152:yb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnKiGpP5K9mM:U3q60jB52n
TLSH
T10AD58D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 6f9e64e7fa668c9d2a4b284c72e87ddcff780146148dfc034e3c94978f443b6e
MD5 3e99fc0b8e9a86dc9e75d0d3f386aac0
SHA1 8352ac374501668f9a2158730a8883c6352a0bee
SHA512 a34191146593e27eb884aee96c5372f8c58d8fa35ff68d8e4a1721516f7f9322c469401743909dccbe0b66d90aed3ea88b24637ecb11a63f02b7391ff23ec650
SSDEEP 12288:x1XLsswWkxy2lRq2czAr4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:/XYfDtczAriGpxAoYmK9jSjwp
TLSH
T10B75012573E10CF8ED678178DCA28402E632BC554760E79B03E49A6A5F337D86D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 95f79d52669211a12bbb58658b6d489bf504c03dfe50bfb4421fe8ef98549c2c
MD5 3d150f39a922f589c05bf021a643dfbe
SHA1 7578397b6ced19f5282f9d3b963b21b1d70f3cab
SHA512 5582d3e31cc0647b7ecf5017242b9377e940e20d067e6e98b6c8f6dd80d84b5654c733a7cf42fdae21ba1574c80a9d902f7ff2c086d34db4bc4e5d691c0d63e6
SSDEEP 12288:EXZNYVLeyUji0h90ZD0wxpGZIVuNrHsS4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zp5:E0Le5ji0hmxKrMSiGpxAoYmK9jSjwp
TLSH
T1FA95AE26F6748731D073C0B9C5D2A68EE97134825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fd7e80dac6168565b296b1c761451146bcb540f9a16710f5fde113534ae58ac0
MD5 9c9ac5d6bd639e075f45eef63559b355
SHA1 f625a5ae187d6e070e7adc65757110890c01a605
SHA512 d16a4e8c03265aa6ad0c299cac7651ce7285cd2294969d094b401a9320f59df93db075dcfd6c3bffc70ac317fafcb336f5903539c2c0639a331ffd4e9b3b938d
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWr6q8wyuoiGpxAoYmK9jSjwp:x/ezSC6vUzPviHjyJiGpP5K9mM
TLSH
T164756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7df04ddb9f0852e58f19fa0d7cca1b8c308174abd743ec73865957dc0c274841
MD5 a06c88e194f218f7e22685d546366aef
SHA1 88bedf656d3c231d8e8935e4459f5cf1d4a8c657
SHA512 76446c1a4c8c36cce5543a2009d5817823c7958c1cecf31fde6987bfcc2dc7ca1f4b9fdde1850ad9fd53c2a8b6f03a9210cc648359de3dd1f931981d0d0bb37e
SSDEEP 12288:2VJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98v4fPt6tpm+OXhWS6rVoVlK5KZmf:2VbqPb88hv/l+bviGpxAoYmK9jSjwp
TLSH
T18B559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 9f4800755d1299d782f1e5941d2af6d72528c3ded49869c1305af052328d317f
MD5 a103cf77328aabbf9fd4c00cf4d90e96
SHA1 d7ae6e737aa493b4d786b25436502a3fd18b226b
SHA512 c754fc1bba9d701a5d6fdb080b459c5ca892e445211ac0fe0c5d9e27208b30fec5fcf96eb8a74b3dacf1d2b24ff372c74919fa2e89c08c27fe66dcd7e5959e85
SSDEEP 12288:6/G4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:6/GiGpxAoYmK9jSjwp
TLSH
T16C65232363871CE4DF6925B0F8E5B4C68254FE74A9504933125BBFDFD832A61F4A188E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 266bf7f268706c32baea7cbc3f1063450263c3d2b83ce2e5552956dd3868e6a4
MD5 446310d24c25d37460614495e64a89a0
SHA1 a92dc8faef2dc8df8244da89ade53a674bc79630
SHA512 e6606813f3528323ef6f06107b95297c3bca58b7beccb014b2b6b8f203843447dbb4a01106fcfa466ae79330fda9c65fb31d89305d0911b39173465c440ff1b3
SSDEEP 12288:QeBNUbTVO86UX4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:QJIUXiGpxAoYmK9jSjwp
TLSH
T1A275CF3BAE28FCE2C27E9DB86A918640D77278304B61A3CBD165C30EDE235E15D75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4de36523c4cd8f97df217cb5f76550e10ac6c0cbb9a385d7a112a19468e022f7
MD5 b3d3d842fc0e2c772d2cd2d035d53947
SHA1 0e6d683a80421a03bf51e16cf26a38b7dedf9d02
SHA512 3e33898a144e558ecd0cbc05c86039bb98046f4b39e72f2ca98b368df2ce8a4aab0deafa0bda362a283a129f2e2493d8aa90c6eb2ca5ad0aa87b3581679301ac
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THS:sQvGAdlCEL8c/RRNw5CO2n
TLSH
T11F267C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 3f5b52f32574ac908fc3745b5934fc9ea6e03fc8fc55f8f09a818c01ef1b41a8
MD5 b64cded9a6c921ff733bc0bef49c3669
SHA1 f80f3f4a38709d2408ce0fb08f10f2f35a07556f
SHA512 1f5a82b465f684787865bce1d965eae499da2543ff3450d2d788552f2e74c18898fe25ff2745b79aabd5c2514a6d1390c0f2afd97b181d253e9ac13de7628b2e
SSDEEP 12288:iAwSfxL/2Dc3uDLLmt0LDQewsAjt4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoS1:nbewsAjtiGpxAoYmK9jSjwp
TLSH
T1C385E031FA75E436C77F0DB12B26D716542CBE204B5119C3E3A89E9E99302D22376E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7a94e6eac35dbf2203dfd1f931314f434299d155ee8ccfbe45241b92b7436817
MD5 964a4e65f79e70e31b66e2470e3e7462
SHA1 add1eb9d77cff5eb02e1aa7381f540e3df091f2a
SHA512 6464079436eb6eb4553cd333ea8ac6c9e2eb7dcc4546b8cbd6b4f37d80632b4270fad072a0067f3e34693e27e8b902d3a961b4912779897cb765340ddbcf3507
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH7:CUEtQevvqc2W1cpV2RI327
TLSH
T15D474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 84c67e14fc94808a44c27a67475d90db8ac5f7b76e591139fc231691ece6a30b
MD5 8c36752cbf73f323914929aa5bf4fee1
SHA1 0929887192af45c73e8fe53364ab675db88124a5
SHA512 b37598fd169353c9bedacf34ae774328cf1ba4e333d12504eb6755322d6e19f4f3aaf7933eeaa62b37800cbbc9574f77d59b705a46d0e75e375ec97abe6dd82c
SSDEEP 49152:eCbRquA/m2yL5zQfFiV+XenmE3/zNiGpP5K9mM:ToqtVjnmC2n
TLSH
T157D58D0976B881E4D1F6C77896A2C647F37178154B309BEF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 034b00f48c3640faf1fccec3ebda16575124abacd16df8ed75060fb69c48249c
MD5 51fa1b51f7d4a946839697d6a80e4722
SHA1 dad51b813c1e87a9828e6796a2d8743b0a53976b
SHA512 12a856c07adb1336f11478e1f94691de4c42cfc7be770a162ce878ce46f8b2f253e3a8a66132c4976259bf8ee99c64e0c6e010a0b91f5e0e037f46370a04adbf
SSDEEP 24576:IAhGL2IFoiwtA5l7S53kiGpxAoYmK9jSjwp:IAM1Foiq5UiGpP5K9mM
TLSH
T19635AE81E7F955D4F5B3AAB8A9B69071EA76BCA65E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 3a780a1e0b0c58b3e152d94c2968095d55bc7a65fead0b7213ec877ba47d457e
MD5 b5cc18aa691e87fc9b9b66e0b01d8a3a
SHA1 ebb578fddf7ff1e5c9af6c947060bd796bb3758f
SHA512 fd1b929921ddddd72f0cc6d13b857601229aacb121168a1c7abceaf89bec57af86e30874c978414e5d77200d32b361d369c89ad7b88e0cb05bd04ada353ed6eb
SSDEEP 12288:Xmw5HEjsChNjBFgl0WDm+CI4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:2wuWOWpiGpxAoYmK9jSjwp
TLSH
T13175F04673A51CF9E9675234C597D036E7B2BC112A21CB2F1360CA5BAF33361BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 b2d122a9891b6e6241a953c90b2435f3a9ed6be33f51414211a87c81870abda2
MD5 7d9df3cdad8abe2f62349570a364e462
SHA1 7f515c1b3dc89b9d1fca30bd64d381d78ed4dc5e
SHA512 57d5cba8dc1c08f92d9a93bf5cffb60a4530d6ebcf64fdc22501cf8c69c6987ad119d908caf2864c88a2f9f097eda194f6986a59e69bd2d816245d498f52a739
SSDEEP 12288:3LZ1Iy94fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:bZuaiGpxAoYmK9jSjwp
TLSH
T1D465121233E624F8D6A75174ECE15446C371BC66673043DF122A9BAF6E33AD26C35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5c1d249e6d3c51f2dc79bc9d08eef134d65d5e1d60369b6e042426764e10a8db
MD5 eb5aea3993be2688c0c62e08cd3a3dc9
SHA1 7c7af1d92aa1c5e6bec07372a662004431435f3d
SHA512 669c48cf9f32684ed18a5b06e36dcf0a3560aca1231ca5c37231e3c8fec1120d8c3cc1becc7db270bc4e3d689c9fd1d327cb4cd6408213f51172d1b90ea3a8bf
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UG:qQRQyi36YOcPhLvw2gAf+PN312n
TLSH
T1A6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8f2cea2cb0a58477ab061e35c048f622a242133802f58ca3c2f11bb30b4cccb0
MD5 1f50da75af9418a071353cbd89736dca
SHA1 70341802ee9c28f0b8358d69b376bd1dd09f9d25
SHA512 4bdfe9746da301f685591fe737b6ef955897dd3ffa71ce7e10354b5d3ae1b5eb6a5aae4d88bc024d2ca2bed5753173a93903bbee0e4ecfad54bb45296a025840
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UG:IQRQyi36YOcPhLvw2gAf+PN312n
TLSH
T174667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fb4f2a254fb4b828bdb9f502b6571c6966f1a6b056ad61a9c681457f25ef4723
MD5 5343d702e5c1b24fbcbfff5867f917fd
SHA1 dbbc8b66d9a27fb5ea994e6329623a62bcb24511
SHA512 e8961a2d53da0feb58ce0d0d891f4f7b12b33f30cd818ae05283901e5fc856c3873292202f7d67e5379a13d8175f0735429d521788155864e9a6cbb920ffad0e
SSDEEP 24576:VwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0KiGpxAoYmK9jSjY:R68Qg55nhceWu7PNU3/diGpP5K9mM
TLSH
T1C2B54933B2F600A9C44DE1769F4A973196D17C758FE0E3DB8115720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0df0527750e634d62a0f70b82a82e45dc5283d7e9c4b877baae5a7fef61bed6e
MD5 682541281eb9fe559cd1da28d7c38f3f
SHA1 79c52c51bdd647b7162cbbd631dd8140b0b7ddec
SHA512 667772ccdab3eb6977c67f8a08aed34c0c6441f5bcbf77a9d84ac4e701895b56329ef576a2023b1ea750e4b0f1b0f91c56dc21627c3e62307c3bf9fa6d54e66d
SSDEEP 49152:43aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99Q:1y5112gYy5azzVva69nLKnhZQ2n
TLSH
T1C0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 36a7cd6fc773a2d06c05f5ef29e418c0ebaca57e1ceacaf6db6413ea68180d9a
MD5 1834711ac47cf0137173e43a8a0ead9e
SHA1 17d726033eebf36f5dfb6364e53dc647063b67ff
SHA512 bab3b92e4e9794f1c3548291b785740922344e324043e7d43c604bc60fe9eea3c196973615f3669a1dc4d5dc88e574288cb8356146a52e22bfb422819382f325
SSDEEP 49152:pB+taZ3usBWOBr4tEG20bqx0z+n217aau1glXiGpP5K9mM:/u6JmUxd2dx2n
TLSH
T1D3D59E13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1f1e9e4937466129ce60c6043047faf8747da012f7543120cd1706ac78dff3da
MD5 779a08d582d3c25b82c73972fc809fca
SHA1 d548eb70a4d7d9579b2e097b5f442f1a9f0f486f
SHA512 0eaaf1d558ea819e88a042cbd4bcdcca534026134286b62174fe8cfcf2573679c1218a92f63a2106cf82fcc0c34748f4f6b09f8cee3da84a1945e18141dc66b9
SSDEEP 49152:41hpsNoJpF1A6BU44CwH7R4x3iGpP5K9mM:4mifPkRC2n
TLSH
T1E3B5AE13F2D900E8D06DD17897569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 66be915e9be9ae29a3468235cf215cb0eab20e1798b410500ce7bb89dabad630
MD5 a9fa614671fb37ca0901424762424569
SHA1 94e8d7dd3ec69e7aed754690a7d261f9ac1044fe
SHA512 576e221b51657ca758956d20dc5f38f0f5fd79eb0e24d5a5385b8f1d5ff59b320f0305d8d1de76e7401dbeb2e6161c689f193678758eab68a7e217c47f56e002
SSDEEP 49152:wSuZQIY0Be2KNRVtOnks6NMHqaiGpP5K9mM:q5dKvi61M2n
TLSH
T15DC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 627f19c7dd4c0f290c81de0ac050623afeecf33f031d317d6cc126aa3baa8206
MD5 0d04dd7feb7832ceb26114a044cf53b3
SHA1 57252efcbd6a304526ca62d459327dccd4e2fd1d
SHA512 a06cc50da18b6513810b7532d2752b04a04ad0479e21627b77f9a8224d70b090419ea7c3591655f585842fb38a40e79c575d83da9bd968b991a35f141526f7d0
SSDEEP 49152:uhtSn8EApI0figXgiDn0AP5wriGpP5K9mM:vX2iyphm2n
TLSH
T18795BE13F2D900E8D05ED174C7568632EA62BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 1fe3d08eae66eb7708e6a612f1632a400f17102eef3e681e959febbbccf0bc02
MD5 5e73a6886f0d39d28d61f8ed5665478a
SHA1 9bde9e66dac8195a4ea47cd6eb031c782fc3f2b9
SHA512 60682361ca3ef6a5bd9a2820b205140c7a67aa86937c56beafa9bcb9438210f5c8699a1e3812fa4b13b7f3ad21abc3bd3cc284e81485704418a11e2ea4daa300
SSDEEP 12288:qu4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:quiGpxAoYmK9jSjwp
TLSH
T11065232372970CE8DA1925F0F8D5A0C6C254BE79B6500573225FBE9FE873A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ee331e1539b18b8f984ed02b32dac8a906432231cf225fe6ad342ee042f42934
MD5 0adf23b75cd8af397829e36cad10dbff
SHA1 8b5223031c8f2818d199172758d0b47381e4ab61
SHA512 2e923d4cc5e297408389cb50023625fece6c8e3b40eac6a27ddef77588814d39e07bb7c55d0a2dfe6e599c1c6f66a407932edd1364aa921b39d21e13150e386c
SSDEEP 12288:Kh4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:KhiGpxAoYmK9jSjwp
TLSH
T17565232372970CE8DA1925B0F8D5A0C6C254BF7AB9500573225FBE9FE872A7174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 1c95a3298f720d8e0a22a9c38d9a415e95eb76333fa5da3798a6cccf3210df4c
MD5 f6c65495cb4f65f88054cac8cc1621c8
SHA1 c32b32215926ac3619480381c095e70eac887dc9
SHA512 73650aef119ba7f06cc7a7d55bc0ab1e95c5a94cf20bc0efb4ffc459f70895764c0d03ec21834bb0806b6e398a72863a9556088ef9e65db8ecd16adcc88798e4
SSDEEP 12288:Af4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:AfiGpxAoYmK9jSjwp
TLSH
T1E265232372970CE8DA5925F0F8D5A0C6C254BE7AB9500573225FBE9FE832A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 e99299881a7feec07dec7ba07373d4058720fc8d776f2eddb6ef7bfa3e55b446
MD5 d66878e57b00393bd1bedc3e4c20b1d9
SHA1 c75e2d3a0a3ee1f31601d43c415e45c7ad8d2f95
SHA512 5252cac26b0a876ae8cdd8bb85d68a6da06348826694f702efd135dad3276968cdc980041c6bfd9ed912e8f9cdf8276ef0bbde730d1f8799bfb06c94bff74857
SSDEEP 12288:EVE4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:DiGpxAoYmK9jSjwp
TLSH
T1BD65231333970CD4D965A5B0F8A2A096C3B4FDB5B72046BB13076E9F9C727A17870C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5962878a8d5d1d2d532b60e1247bed60eac0680216a8dfef8edafb20697982e2
MD5 eaafdfbcdebc126ee5334fcbaa548821
SHA1 bde17f6f3908c25b1f5f3cfa14decdf37818f051
SHA512 146727e5106f097d2f82f0ecb96bdc60d5ffc550121a9c3b3a11b08c79bf201dd2dd63c5562ee0af5fc8d111decef8b59ce895f04a9c526f0ca7585be5378442
SSDEEP 12288:O84fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:O8iGpxAoYmK9jSjwp
TLSH
T1DF65232372970CE8DA1925B0F8D5A0C6C254BE7AB9500573225FBE9FE872A7174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 2748a81512fd68488c8938ffba86cb1186b5ba31449239076997791f9fe3ecc3
MD5 efe773d6202c5b3591984116c40a8850
SHA1 aa4c799af98f662cc3f4bc164cc14ffc57d0eeca
SHA512 8897864b841c9140ccf3e0d5d3ca32cc847f1257fe4a58d9b53e9e9e7437697694af13ebbf17af738f1b4150f2c8de7d8ff16ea84a49697c20e0898bf6232248
SSDEEP 12288:dV4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:dViGpxAoYmK9jSjwp
TLSH
T15B65232372970CE8DA1925B0F8D5A0C6C254BF7AB9500573225FBE9FE872A7174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 e7466be6ebe1a7b17736e97f3f112645179716e866e2af5139f8ca8680e242b0
MD5 bc95edca494325fac5eaa915f76f6c5a
SHA1 d2db31c0706dd05e7a6c681137fdcfb5c08a0e92
SHA512 3085cd8c4eba5d41427bd04a1d4a3363973a758690302c5290fd593bcdc6d920acb1c9e25980632d7fc1c3be57c31dda34a91c47cc171d7ed39318e06992b64e
SSDEEP 12288:JZ4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:JZiGpxAoYmK9jSjwp
TLSH
T15D65232372970CE8DA1925B0F895A0C6C254BFBAB9504573225FFE9FE472A7174A0CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 50c18e3ba85e1fe9ac293ceb0c1acdfa099317599cd576fe2675d932c6863cf8
MD5 7a5a988f4277cf4bb79645822dfe141a
SHA1 a6b886d0f197462c31fad1660c038805cb5b7cba
SHA512 b04f2dc1cc2e2405ff22ba8b5f96c7733c6a057dad1bec863bb978a52898912dc21cfac5adb388d29fd45193540b93bfb48ad4a9f0f43cf2248b2893206d821d
SSDEEP 12288:YiZwbbzzFEoS2cPvyB4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:bZMvzFVSOBiGpxAoYmK9jSjwp
TLSH
T1F8750161B3911CF8EC678139CC559846D2B1BC6A1B60C61F13A9366B5F333A11C3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 3fb307e7efdebaf0530468fedaab4241de3f3550f39c9f89f885469dbe5efe54
MD5 2f6259d8250a82e498d497870f052440
SHA1 29d6076ab0b245e8ad9513da9961de09d7a95ffb
SHA512 f981a59b0b751667156e5561575f9d4ca95dc42fa0150d97f4bf117c5ca122e5278b29f3672fa4a972b7ad19e0aad0a0891cac8dac08b36d731c2f6a4b0fb2ea
SSDEEP 12288:Dq4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:DqiGpxAoYmK9jSjwp
TLSH
T13865232372970CE8DA1925B0F8D5A0C6C254BFBAB5504573225FBE9FE832A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c72a39bea6b43697853254a8fb519899b61f212e818ccf847aa7fdbd53404fbd
MD5 b8ccb54970a3cf21207926a1fe333156
SHA1 ac3628d1f5b98fe90dae4dfc2f50b9ccddae8b04
SHA512 d659b8bfa828ce41e67ae67fccafb63e580dc4108e19bef068e85548653bfbe878b7f6fa2b7db6799ba02f9198ddb4a6d31d479f7d538528680c8d95bc0665e5
SSDEEP 12288:RW4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:RWiGpxAoYmK9jSjwp
TLSH
T14765232372970CE8DA1925B0F8D5A0C6C254BF7AB5504573225FBE9FE832A7174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 9ec8a114bf0e8254a17038db5496bd1df17c24480caa871ebbff0f5473b297cc
MD5 bfe284721f0bc44dfc97601348218c52
SHA1 8bb08201985f311ded062da5c154c5985b093417
SHA512 eb3e23949ca128333c5adddeab9050cd186a1a20100dca2192b3be0fd57e1dae59205b16b91e2ab502cb31c51488685593feaf133bf1a9540337ba1f340af5ae
SSDEEP 12288:LyPz5L894fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:mzy9iGpxAoYmK9jSjwp
TLSH
T15A75121373A234F8D5365270D8A21942E371BC3657208ABF13655B7B6E337E1AD3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 05cd2e77a86126701fddfb0b3c7f9b28cc7a4226d696d1b233e90bced8e2891f
MD5 a355d7b7b049ceab18f3696147f74f3d
SHA1 0f5ad6c4eec00216a8e223be25168ead2f209cfc
SHA512 2d21910f1eb18c1db65fa412102056b4af2d45eb76d6efa075bddf1ae0ede6bad1a27e87f7bbacd93a2a6457faa33a82a3439593b00c679ef7896bbcde2ee6b1
SSDEEP 12288:Kq4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:KqiGpxAoYmK9jSjwp
TLSH
T1A265232372970CE8DA5925B0F8D5A0C6C254BFBAB5500573225FBE9FE832A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 103abf5348573cad350542c72099aceba2848f28141317ca7ed5aa43242cfb37
MD5 c036f6322af0a76b1a5003e6bb99375b
SHA1 a9a1fb32df690cff32b64d264ab68f2fe731fbb6
SHA512 77b6485cc1eef440bb1da477258466bda3fb5f02715a8d20428476fe07fa663924f29b2709e8b7f659a3ca6fb91814b163bde3c47f7d7f890bda193023bdc3a5
SSDEEP 12288:mq4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:mqiGpxAoYmK9jSjwp
TLSH
T19765232372970CE8DA5925B0F8D5A0C6C254BFBAB5500573225FBE9FE832A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 317d68ab861196f0b40793cc2c6ff5bf8439d49f1f916393c250217911b2ccd4
MD5 f94bd0624f6f660a82147bd8fd182e4c
SHA1 89ea1e8f40a74ae0da309a10c92c551950ff4bd5
SHA512 2dae1b1fcdceb5d3cd5016d2028925b76bbbde8baed054f215b72c00420e43047730a35de91a40d5080dd95e5cb1f19e333fd8a89067cee58c6ed6daf071fc3a
SSDEEP 12288:HyPz5L894fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:qzy9iGpxAoYmK9jSjwp
TLSH
T12875121373A234F8D5365270D8A21942E371BC3657208ABF13655B7B6E337E1AD3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 b555b70a51eb19b5f6acad67740529e43bf8f15d2c10a423396b75f44cf2e4dd
MD5 156c8dd624144f6a636d8a7045cca832
SHA1 55abb91e1dc3a86746b32b4155aea9fcd4357d2b
SHA512 642bab0f21367616e1ce48e793f778be6c67a910e64a41b0846678c9ec71882465edf0fb711bd3893799c318df233a52320ef4b74743eb8b07864e4b81eb95fd
SSDEEP 12288:kCd99WYoaLHF3z0z04PDvhP4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:dTkaLl3z0zDPiGpxAoYmK9jSjwp
TLSH
T140750265B3911CF8DC678179CC559846D2B2BC6A0770C62F03A93A6B5F333A11C39F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 b08be3be54990cc3360de4e99922338a4c4bd19d984aff701c7af0f25ac3fd05
MD5 12e3aff90cfdca7b5d26432cea387363
SHA1 edc04d6e7394d525f284f19299f20747e3de334d
SHA512 696cbbad82a836b2fbabf27e77c72973b462d3abdd44d758792a1e5a4448e19e4b68c1ef8b3153e217f9d7f02f52365aa786cf42a6075ad3af40eef804d8d75f
SSDEEP 12288:Ui4e7vRdTfgwCHKy7GLbbdIvA4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgx:U3od9CHKy7GZTiGpxAoYmK9jSjwp
TLSH
T12B95CF90F3E414E8F0B79A35D8765511DAB67C691B30CA8F03A8665A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 95159dce21e5fe4b2b612cf3acf8ec12e44bf36237e081de7d6b136d6add334d
MD5 8686761df82fa3bb07532eeb9d5c83be
SHA1 e49518a4d62f7de46ed7601a5d87ce93788883d7
SHA512 a985e865aca929000b473dcb343ef5b84d04eeb08967e9e3e10dbd56a49fd03a9dd92a43b6b92b3ff602f3f1e92bc7f32a88c2937fd1310e77179fd674234695
SSDEEP 12288:h/4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:h/iGpxAoYmK9jSjwp
TLSH
T1A065232372970CE8DA1925F0F895A0C6C254BE7AB9500573225FBE9FE873A7174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 7d434e59de41e2e6a468d4168f603f30ef5c5353401adce57bcb9faf34ffad6c
MD5 9cf5353211bda20d590e9abfd553ce09
SHA1 647f5f1c88bde13b0620ca31a5b7cd79d3bcfa7c
SHA512 1e1d4744db9694189bac45282f65297fb72a713d68c979125c0dc6eeb8992693a01a5e130183539a900c2f1471ccf1682b4933258fd49cbcbdc0427646cd50a2
SSDEEP 12288:yd4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:ydiGpxAoYmK9jSjwp
TLSH
T11C65232372970CE8DA1925F0F8D6A0C6C254BF79B9500573225FBE9FE872A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 e53bfab5f38ab1497de7ba33eb27d5d90cc4d3773d98c81c626e696a4aa68085
MD5 5d999d09274fbf7e69e11c44cae7a179
SHA1 496edc3b1a8d6efdf39e0d88d9270509c2d7c926
SHA512 855ef85541d0de88ea28612e32a34364620cb67bb7106a4e4d6a4bbf16dcae3fdbda121803ef14d768cf06684293996b65b837c8ece6af0fbc7b54fdadbaca4a
SSDEEP 12288:9A4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:9AiGpxAoYmK9jSjwp
TLSH
T19D65232372970CE8DA1925B0F8D5A0C6C254BFBAB5504573225FBE9FE832A7174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 ea4bf040fc5c05011c7f5f95f5f1a8c54e03fe429f3e9cfe42224f24003260fe
MD5 ed68c4e19cbd5301bdf140a3afeec35c
SHA1 0a99bf4df37d76007998fe9a2f0ced49b36b6d20
SHA512 aba8c8faee6d3c1aa57538633f18fee5d24dedf994e8bdf0503494cba344a5e502665c697541c909a379aea151681ed525a3742a53837824637f33e8a6e8c3fd
SSDEEP 12288:wq4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:wqiGpxAoYmK9jSjwp
TLSH
T1CC65232372970CE8DA1925B0F8D5A0C6C254BFBAB5504573225FBE9FE832A7174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 9069625944b6cb4372ca81fb1c6ad40b3d5a56405b106d35e2b2fbd5cdeac867
MD5 dc34a3901b6bf10fb3415a3b3b343d6d
SHA1 25e799499233b7655d542af717147b343860f898
SHA512 91b6064ccaa6155e588b595175d63e71eb2152e8ff2c1430ff54a8020b88f9ca06f5d09b37bb4ef278a8665df2ebe53af40f8504eb1d0b42d18391fdb51e1d51
SSDEEP 12288:2/4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:2/iGpxAoYmK9jSjwp
TLSH
T19965232372970CE8DA1925F0F8D5A0C6C254BE7AB9500573225FBE9FE832A7174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 fa0e1f2df4d0ffadfe47fc4bc77dcf85e78ba21b860b74a742fc4e3e8362687e
MD5 81bfec4f19bcf44faf9bf14ef6f8454c
SHA1 f7419b165e37c156ebfd09392c749c695b033d83
SHA512 9d0b7e0cea85ccf5a320ff7f751e7ac5b65c76d03b8c1a19db42ae677eb1f49f53c5644a2c9d1437013ba9585822807e831d625fb136b9e8ed45a9f6890acda6
SSDEEP 12288:dC4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:dCiGpxAoYmK9jSjwp
TLSH
T10A65232372970CE8DA1925F0F8D5A0C6C258BFB9B5504573225FBE9FE832A7174A1C8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 3a8962840a1c372a0034751686f9c0d00114c6707f0580450671bc567d48c49d
MD5 5d8b3d02094abd0e2e89dbf758afb152
SHA1 6ecf004ec4b585779fbfe7d0aca34bcc3ff2c59c
SHA512 797ad1543aa40933def5412b766a0798c7c3203d578e210643cda35e14ecb42f51177bbdd97c8af628390c700a4ddee9cc071734336a8b41acc877157c26f7d7
SSDEEP 12288:A84fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:A8iGpxAoYmK9jSjwp
TLSH
T18A65232372970CE8DA1925B0F8D5A0C6C254BE7AB9500573225FBE9FE873A7174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 c7f7fb0ba7860d2d03fff36ef7e4edd5d52ad2fc529aa6d719380d2ab07ff853
MD5 cd506e0d93d49e8c0df537bd9a75d1f0
SHA1 5bf5a19d3518e33995b2efba2a76b66324961fd5
SHA512 a6230246ffbfd09653ef1a0540aa4dd8cca4eb25b5cf23b9f68cf0260df7a58cef476c41b352929478c554e012d6b3519680d809fcfc90b7ec072df0b0ae6e25
SSDEEP 12288:/fwvD5u+64Lk3tRX69qkyAI544fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgx:/fwvdk9RX6wkyAImiGpxAoYmK9jSjwp
TLSH
T13195D029EBDC08E5E177913899B7460AF2B17C691B31C6CF129A53AE0E33ED46D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 af02363f67414e84abf1151790d6bab8b4f2169335368a85bcd8149b08b70d79
MD5 f00429cef7210f9015d1dd8587989b80
SHA1 cb40e3f92a312706579c220b0caeccf8ac6b7031
SHA512 0b759ad001fe7acf537e4d9ee560e6b28c741e9766faa703e27d86b8348c834658573037293d71499240d71468885a222818ead9a84bd613390d098892cd3463
SSDEEP 49152:CYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LiGpP5K9mM:+ySzPV2n
TLSH
T130066C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7113ea6407028455d3753e612c5ce37fc3c8469fab75e312071e914beeb1d4fb
MD5 95be22ce72ad7eabed24e8e50ce1dd23
SHA1 23b461e4ffbe192cbd4eb1375e417f02466ce892
SHA512 4ce6e9b214269676983098fb62f98b3a0190ff2d7498ea67fc698b66dad5f1ae8fcdf2f0080afb09f8bf8fbd9578f3f2eaa1953b03de8151075e77f3177c75ce
SSDEEP 24576:H47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYRiGpxAoYmK9jSjwp:H47JUQj4irIhCnDHUPfF/biGpP5K9mM
TLSH
T19865AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 06557b2435f1866bee472f9ad5fb22e88432254a0c54244d2d1f1adb851dda2b
MD5 3eb71ce6d0c8e8d1ba309b989e10e5b7
SHA1 5af2b0d9f30a6728145deda7c91e756bf026607b
SHA512 f5d59a61f88fcaff512cf680ed6d1cc8164b5feca6b15f7ead4d7cb8dd9cab9e9482c7b646769acdbf4a3385f5870e3164eff97cce8666a86e6923be772ea48d
SSDEEP 12288:rlsfa4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:AaiGpxAoYmK9jSjwp
TLSH
T1D7750116E29906E8C06E6270DB969581F3337C6597E0C3DB13D1F97E1F32690ACE6A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 4dbf9989009ffaf54fa2a512c9fe4c503a658c5393462ccbd25389046b37c568
MD5 db0ea4ff64db2666441d644dbc8b1e46
SHA1 ecb86ab2acb054fee36236e0dea48f90a4a1a520
SHA512 30fdda684b97be21f37b6989a46071ca3d0997f57e1792d3b7106b332c8432c0486573c8c1df5fd36062c32242a0f534d15faadf5ddcb731e39ff408c6833e0f
SSDEEP 12288:OcXGsBq6qK+V3TK64nj9HSZxUwddd/4On75e:O5sb2NTMHn6ddQOw
TLSH
T1414528117666CB4FC6A940325E32C6CCAB707D42EE056F0373C98B3FD576659BAB2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 92296e87d4d34252ccb4d53fbc50e9db7936361d8704fdd32d5ae1a3b0728c5b
MD5 6ba404c7b3bb0fff7410d31c42cabf60
SHA1 240c312222a66f2fb7b72d4c03abcff452a550dc
SHA512 708b472b66f8b3dc6c0db77460125dd6af93c66da870ff7a54c3b1f4b33a443f47a8a6cf421ca739186dba55828e9a565dac2a1d7c276e4646974b879cf74c53
SSDEEP 12288:bdre+VCVXTXIOXTtFTvgqg3N1wwre6lu6Iv4LQE6:JNeB/Tz6EvUN
TLSH
T1C655F881913AA78FC1BB6032032A5F8DB764EC07B7055F2677C9453AD82AB55B0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 7a23a4cc0cc1f360c25536cdd5985a30c0ab223ece93e9daf3a411631f82b445
MD5 da43f0eb7d05ceddb7c3b77c38a5df07
SHA1 8327c981af8b3323d300a158d8bc8cc7faa81810
SHA512 b92dcd59b4db679c375c5470ac607775b6e71d3cfc9bf588d7113942a32a90827197228949ac9b0b6324f685d8ab6ba9a9c56126fe1de416df823ce29857de11
SSDEEP 12288:847y4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:pyiGpxAoYmK9jSjwp
TLSH
T129652323639B1C94E97925B0F499A0558218FE75AB5045F3610BBFDFE432ED1ACB0C4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ed20a0a9a937e90ddb959662802b1968674354e302aeb89c0952cefe53540019
MD5 02ba2fddf760456684bf4ec64dc23527
SHA1 702c0c99efc60105feb55a73bc8968112e23983b
SHA512 95ee4b12e5287fc394fda543d09df2a61c1c01a19b5fb6fd1ac8260e13a225f58d2a5559f4491887309cf582c194768f02ce64d4e63ca7bf9564accae66bad35
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYoiGpxAoYmK9jSjwp:wgb4mBIBhGFRiGpP5K9mM
TLSH
T1DD65AE1E22EC02F5E0F9E2B4DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 130cede08bae601d827bc85c835eade545bfeb26bda4374dedf187a75628c230
MD5 5d0b0fd900da5afd2e4eacb11793be91
SHA1 3142633c3663901d6c39ec29fa39aa566450d003
SHA512 4782793e5b7d9640036742d1aff1370f067675143dbd9dc4b642c70cd3016f61715620ee8922190fde614a849203929d596139da8122426cbf862214acd278ac
SSDEEP 24576:QG88u8FpJqH1Dzria7/mBiGpxAoYmK9jSjwp:D7ZFPqVWa7/giGpP5K9mM
TLSH
T12B95F12176E105F0D47BD134898646A3F6B1B8251360EBEF07AC8B561F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1bf9b0dff963417dee568fd79c78485ded66fd9d531746ff3c7c16286cc8b1e8
MD5 4580728f7a113a95133cadbf8dc099a3
SHA1 f214fbe5901b197b62adc4d359d55683678c4ba7
SHA512 756e3c114b659d3cf2b9826669db8839687de4114ad265f726ff1c7847e88d625232c2c9cd921740e39df7027a2ac9c478a5fa9f62d4193fded95bbd8578351e
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjViGpP5K9mM:rG05lO43bo2n
TLSH
T109D5C06A62EC11F8D1BBD17CD9C6460BEBB23825033556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5515dc33faa83e34ee24e6d1d4b6f51dee792c87e0647b05fdbf238ff5b7e1e7
MD5 e1bb98965e2944750358a53ef5727f1e
SHA1 67d2e6d8a9b374b5d4535ccd9b0850a7270b6809
SHA512 19a2b7cfd704f42c4eb1e8dbc0206caaae14b9753fdbae610a850ac2fff708b2c52a969481e7fa233ab21bd332c4df5a77f3a5f7aa09df34898fc512a1dd1200
SSDEEP 24576:Lfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnLiGpxAoYmK9jSjwp:Ta5POZ39Jt2pasx2+mdiGpP5K9mM
TLSH
T18665BF5EA3FD01D5D5B9D17CC583861AE5B1382653319BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a8d2f8b3005fdfc61dfc91dd0aa52a92e384205c7a4d312e9feed58bcf717f3f
MD5 06b4ff4447fb1744cece23a416ecd72e
SHA1 ee8b76757c3806ad210a35de4fa9688c764ece15
SHA512 20db44e46e9c8493a1df491f27e3333760a5d88a35b603b43fad16d31ad73b2c09041023406cb08fb27b6cb472ec6bb67f4ac1c10c1e889146e23fbda41d155e
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7FkJiGpxAoYmK9jSjwp:CNc/zEOVHFAiGpP5K9mM
TLSH
T163857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bf170e99b8d241152731314f49fba7fbbfdfb9be1cea92a646cc86ec0a94e4da
MD5 f9bf402074e48a70a1a7bc143a5f54e3
SHA1 5228a2cbda6e6492d1c7dc4d60c6154135211b17
SHA512 2e9d1d83323b5da87705a94d5a53e715bb6b0db8ef4fe136b4c574d7340bc73f167647bfd60b4ae88427f3e96f33e6e9336855a8fbfdf17b437109b13f918f51
SSDEEP 24576:1tkNvNnaFeYhJNtmZBmziGpxAoYmK9jSjwp:1tMwBtOmziGpP5K9mM
TLSH
T14B55AE2EB6B806E4D1FEC6B4DD238512E6727861173293CB5290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 078f9c2bfc496db11158b1c971abc609c6ed90587016acaf97af0f4899087fc0
MD5 0f42a8241139d07037acce5b802c86dd
SHA1 4f615f9d2477af0702797b46bc84b1274259616f
SHA512 c5384b0d2cae6440573284dd93bc66347cf6e6c8d50c3bcc442842a56809cb1e23f01034d566e5ea17ba2cd5f024e4daaa517b1ef748a41045b1557a276c1ef9
SSDEEP 12288:YHvUrBFrEjwaQl4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:YPUr+NQliGpxAoYmK9jSjwp
TLSH
T1C375E22F22ED1CE4E676A178D9828609E771BC62171192DF02D1817F5E73EE8BC39B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 996a5738948f90efc39da8eb398c962b33884d92152200b9d83aa39594b038b0
MD5 ece5f9a3006daceca4c333ba60ef4b1f
SHA1 bff737cba335a1ebd40f52285f3156d96d310a09
SHA512 97cb40a0078940a4d0f2f5eedacf23596e3e539b29ff0e15f3fbf39c80de18f6511a90b691e2ecd54caa0bc60ca24cbaff9f15d0db674710187ca32ea5f26f73
SSDEEP 12288:kQcMxWDXN1Dp/fshBItT1IQgAO4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwM:+D3FHshBIYQgAOiGpxAoYmK9jSjwp
TLSH
T13F85E13EE69D04E4E57AD1B8DAA38906E3713CA9032156DB02D5C1BA5F27EE47D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-236-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1248-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1248-66-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1248-59-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3208-105-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3208-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3208-318-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3208-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3208-111-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3208-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3632-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3632-22-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3632-21-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3632-15-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3632-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4960-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4960-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4960-99-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4960-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4960-333-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4960-93-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5100-70-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/5100-285-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/5100-78-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5100-72-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5364-130-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5364-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5364-136-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5364-139-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5364-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5384-117-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5384-317-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5384-125-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5384-119-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5544-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5544-44-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5544-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5544-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5544-57-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5620-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5620-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5620-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5620-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5632-300-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5632-83-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/5632-82-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5632-88-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/5648-0-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/5648-1-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5648-8-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5648-7-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5648-30-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/5648-27-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5924-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5924-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5924-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5924-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5924-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download