c7e62aba49f5639d82a308336dc964c40308837cd0ded5336b991778ab0b109b

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_1da1637e2c89c8762a964dfe65cef0c9_mespinoza.exe
Size 1.4MB
Sample261003-ttserasdkc
SHA256 c7e62aba49f5639d82a308336dc964c40308837cd0ded5336b991778ab0b109b
MD5 1da1637e2c89c8762a964dfe65cef0c9
SHA1 624f65ab26d5d5a4e91a60e17ba1d655f3388e4c
SHA512 4882747005e943d23410a60051179715161818d68a90820f1c04e29a6b0dca95ecac9c44437f5ea4da7e7c43c6d95d09120b8c3ae488ef8da9f265c850e94a71
SSDEEP 12288:FVthxbitwzL1PAXruYyVHHaf4HJ1jwssawsUoN9PqIf:FbAw9PiQnDJGaz9
TLSH
T13B65016FB7B544E2E21AC279C99AE661E371FC956C20A30F2750A31F2F376706D24721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4928	elevation_service.exe
3324	elevation_service.exe
1980	maintenanceservice.exe
1132	OSE.EXE
432	PerceptionSimulationService.exe
3796	perfhost.exe
5284	ReFsDedupSvc.exe
5512	SensorDataService.exe
5808	ssh-agent.exe
2320	AgentService.exe
4860	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-02_1da1637e2c89c8762a964dfe65cef0c9_mespinoza.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-02_1da1637e2c89c8762a964dfe65cef0c9_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-02_1da1637e2c89c8762a964dfe65cef0c9_mespinoza.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-02_1da1637e2c89c8762a964dfe65cef0c9_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6f52f57ab68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-02_1da1637e2c89c8762a964dfe65cef0c9_mespinoza.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa73a4445353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000862860865353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a46e6d865353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f92157865353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2600	2026-10-02_1da1637e2c89c8762a964dfe65cef0c9_mespinoza.exe
Token: SeTakeOwnershipPrivilege	4928	elevation_service.exe
Token: SeBackupPrivilege	5284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5284	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2320	AgentService.exe
Token: 33	4860	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4860	SearchIndexer.exe
Token: SeDebugPrivilege	4928	elevation_service.exe
Token: SeDebugPrivilege	3324	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 2608	4860	SearchIndexer.exe	103
PID 4860 wrote to memory of 4284	4860	SearchIndexer.exe	104
PID 4860 wrote to memory of 6052	4860	SearchIndexer.exe	105
PID 4860 wrote to memory of 5620	4860	SearchIndexer.exe	106
PID 4860 wrote to memory of 5592	4860	SearchIndexer.exe	108
PID 4860 wrote to memory of 1604	4860	SearchIndexer.exe	109
PID 4860 wrote to memory of 1660	4860	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-02_1da1637e2c89c8762a964dfe65cef0c9_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_1da1637e2c89c8762a964dfe65cef0c9_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1980

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1132

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:432

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3796

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5284

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5512

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5808

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6052
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2964 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2964 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 53d3597d70f8aa6ef900b9a97896c39beaa8b11eb4f94106cc99b678815d2104
MD5 2ea608758ab5421ea2f20087266c7de0
SHA1 f366b65374bd9d29a544264ab468cd3b2bcb7d30
SHA512 b4ba0fe2da99b9869a14f11c89084d1e8a174a05379749c01b817960b7e295f4e1cb08b6282c6f7f35b28df530ca2bc5533a7ba2ac7850fe711a814823242b76
SSDEEP 49152:Bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn6nDJJh:H3q6sjBNDT
TLSH
T113D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.1MB
SHA256 112399d5e2d90e5eca96574a70ba8781e610289f76df4210918af909ddf8ed15
MD5 58a9044ac5b6c4ae0967fbf9a01817f2
SHA1 08619a7323489338e8689c661bf2c2f23ad9691e
SHA512 7488d8b30ef2011b490dd8b14d092b5b1a6de4cd314ad2f108e4c254e8c596854c5111b1e808f17ef413e0abb86157fe1d6306257b9540154710b75efa3469b4
SSDEEP 12288:E1XLsswWkxy2lRq2czARPAXruYyVHHaf4HJ1jwssawsUoN9PqIRPAXruYyVHHafS:CXYfDtczARPiQnDJGaz97PiQnDJGaz9
TLSH
T134A5122967EA04F5FE5B823DC991D402E6317C954BA0F68B03E4A9361F337A41D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 14fd4a21edc730b40f5a84861d5cff0501f8265f537277df4c64901a593b200d
MD5 3e2c405093d2e83c19bbf6950c67b4c8
SHA1 497964b7813db7a79edb30f17f22ce34613e7ac7
SHA512 eb8391e16c035218d25e61ff8a138cdf5db1ac561677a3d78e038fa65eaf8922689dcf54634e2696f264e72f19902f8797d1a7e4c96b869d33fd59a339e96126
SSDEEP 12288:3XZNYVLeyUji0h90ZD0wxpGZIVu2rHsGPAXruYyVHHaf4HJ1jwssawsUoN9PqIO:Z0Le5ji0hmxlrMGPiQnDJGaz9
TLSH
T14A959E26F6788331D073C0B9C5D2A68EE97134865B3089CB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9a118eaed09d35393ff542df2419586a28a778ea377203053de74c63a7158d89
MD5 b67ad5f5509dc8f77f49d619d8712387
SHA1 49164282e4c72f4398d95e5af721a9533ef39643
SHA512 20b4ce3140d117f372b8b58f6dce015df7462df771109f2c4d8576602380169fd1accc100712c59065eccf84a7fe07e15d81bdcd00ef28f5713cb19e0ba117e1
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWn6q8wyuUPiQnDJGaz9:9/ezSC6vUzPveHjypnDJJh
TLSH
T12D756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 381624a87a919b00487e85df97564f86d390433d3a5cac38001a6fcd4d8b5130
MD5 ce4bf91317ddbf7685220fd641051545
SHA1 711341b4a170abc7fb97eca0a151c1f69efd2bbe
SHA512 3f405d9c4fbdd4f9c3a6bccd921baa59ead107a437c9dbe2017d60cea41d139e27b0dee4099a639aceeec0faa414d70e495358da5b641ab0c058fbe0bf8046a4
SSDEEP 12288:fVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im983PAXruYyVHHaf4HJ1jwssawsUo9:fVbqPb88hv/l+Y3PiQnDJGaz9
TLSH
T18155AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 1e0b1677c5cdc9e4628475940ce7bef5d56da53d52bb93c398f101e5a3412db2
MD5 ddb6b81a2dffec52bbe952af5470883c
SHA1 1369fa1ef83eb87e4c8e92af0e2afecb0ead042e
SHA512 ea3591f2dd08ca677121f09c9f3b20abc9bafb35036d34291843ac153487ed7fd4e056c7556268179823ffbdacdbbdfc164f43862785227f81faef712c870557
SSDEEP 12288:2/SPAXruYyVHHaf4HJ1jwssawsUoN9PqI:2/SPiQnDJGaz9
TLSH
T1A9552367CBAF4051F34E677AE6C8F4072038BFA4ACD4E41718697E7B29746309DA2913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 3e9d546311c0d5d32d0f3b34b239b07a93c52478aee9837d21f2da84a8e632e7
MD5 65b26ca2f5e2a06bcc7b94963d8fa803
SHA1 758f57637929bcb5eb944bfca158520ad9aa43bd
SHA512 597d7a0e51b49b7fa790ade65bd22f4034a18f11d731e6163d22099460fe70c8d39fcdc295027b35bdc4275989ffaec8cdacabb24ac3fa1888c090bc5f7b850c
SSDEEP 12288:BeBNUbTVO86U/PAXruYyVHHaf4HJ1jwssawsUoN9PqIX:BJIU/PiQnDJGaz9
TLSH
T12075CF3BEE28FCD2C27E9DB95791C600A77278704F61A3CBD165820E9E235E05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 816f51ac882519361ae5d8e0ef87a08871dccf6db7f49a2e070c70cf21e511b2
MD5 727e744bdc221017da8388f37f28e1ce
SHA1 8b1314b775c3d45d06ccda3ecc43aaccca8739d7
SHA512 0137ad5e8f3d45888a45ae12fcb0d6591c0bdea5c06581abdf7e46729bbdf736e0844fd2537242e1aeec3cefb16aa27ef34219a58c669e31004dce275b3f804f
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THd:BQvGAdlCEL8c/DRNw5CmDT
TLSH
T194267C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 2eb77df9357887e6155f2f8c1beda34e696e56630659e522e34b05b5e708936e
MD5 9f45c64f6aefc31e2baa390d42bdb4fd
SHA1 1c231192da6b71e018c941e2add927d570345cde
SHA512 4777df7a030c82930c4202db3b5401e5bcc9174038a6ba30dbf74ea9e12dcd125ae041cb8543ce5446a30fa61f6721ad89a497f693f577c4b7312950bea94fc0
SSDEEP 12288:pAwSfxL/2Dc3lDLLmt0LDQewsAjFPAXruYyVHHaf4HJ1jwssawsUoN9PqI:aQewsAjFPiQnDJGaz9
TLSH
T1AD85DF31FA75E032D37B0DB61B25D706143CBE604FA129C3E3A89E9E59702D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e2cf5665acf2cd20b911c31569034b601a73be63f18bd8b5754d4364491fa48a
MD5 64a7584cc12cfb871433ca16144fc522
SHA1 b7f4b6d15db580d0b021fa90dc7f94c539d188fb
SHA512 4a73e552af51a683b6859dcb3924c2d2eacfc2eb24bc3bff7ea06af704677d6ee6e7746ef23d2e67b69a0ed2930d3ed2894968bf5aaa8883763702af97f4d8b2
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHR:TUEtQevvqc2W1cpV2tI32
TLSH
T11B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6d410ba7b0e850d67b279e2d0f46f6a5c72f0911e6a1efbf37898200e560a41b
MD5 c6b555790e864a84823a53216c7a49e0
SHA1 4c473ded8d3914cd35971fe18a40e771c4605129
SHA512 a87d4f976fa193808c26ebdb281497ba06a6c65bb0bd22a28c05af67a254ee48675ed33184ec9456a8d7749d04e883eca9b7c21139048da2ca6fe492d0c6b58f
SSDEEP 49152:/CbRquA/m2yL5zTfFiV+XenmE3/zVnDJJh:YoquVjnmKDT
TLSH
T16DD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dcae08ebcf947b3363c47d805120a4c765e54eb5d501f038d7c0b3f2a7eb5f24
MD5 09632da672cbaf005bf107c56e632d87
SHA1 6496415670ad489310de04d4ae1ad156bfe30ebe
SHA512 78f6351277f03c1aae93c7edaf44166be284f28294bd3f4d62fea3ca8e48f23e3a13cc69a4d0eead41fb65377e6f8ecba9d7a7ab2dbc70bc6929ac59f0441bc6
SSDEEP 12288:bAZ/GL3IFoiwtA5qy97S9uaYFLq3ODPAXruYyVHHaf4HJ1jwssawsUoN9PqIi:bAhGL3IFoiwtA5l7S53oPiQnDJGaz9
TLSH
T15C35AD81EBF945D4F5B3AA7899B69171EA76BCA65E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5cdbdf173502a62900b931145fa713e307f35fc534347af207724ac42f8d8200
MD5 c15a37ed9a1884f939767da8e6222c43
SHA1 f74e865fce93b7075086cc2ad6da74d0fdd1625e
SHA512 c4d2962cd98637cdbb2cb3ae88e8cd129731b04392ce91ce05e8ed44f67494990ffc96ff2f1c6d24a23b7660c251d498c65c028a4f1133249a42201edc3b15ec
SSDEEP 12288:1mw5HEjsChNZBFgl0WDm+C0PAXruYyVHHaf4HJ1jwssawsUoN9PqIV:wwu8OW5PiQnDJGaz9
TLSH
T18675F14677E90CF9E6679239C687C136F7B2BC112A21D71F1760C65B6F332216D2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 9a27eecb7cf888143bd0c1534d331797e9f5d9ac64c638194ef41537c896bfe3
MD5 4a389960bcad00dd31c6daf4b1728486
SHA1 e6bd4891a09dda7426c95f9e82f7b331a256592c
SHA512 3cb73c726f7fc4bff5e3dfcb7c1875c836bf83a15ef996fed0d6ff2f1f4c100bcd1032d2deff7b04454ccd6a6c4e6f22b3fcac8d3bfbffc8a356344d8f28dcd3
SSDEEP 12288:2aZ1IyVPAXruYyVHHaf4HJ1jwssawsUoN9PqIr:HZuOPiQnDJGaz9
TLSH
T15665126A23EA20F5F397933DC9D49506E3307CA26B7193CF1524566A2F32AE11D36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6f05e3d04fb543367f80a0633289b6ac9ac4ff1fb511242912fb6fc1f6ec64b7
MD5 8671f5e967bd2f2c61204c8472828024
SHA1 787c63073e0fa4b457ea83fdad095352aab4cf8b
SHA512 e50a25254615c0b18a9acf07f7b106a189799f162ae7041e8df266e617209a039ab736686320bf88cf9aaab12161755769d4b62d463449d2fc94d1915899a646
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UR:3QRQyi36YOcPbLvw2gAf+PN3vDT
TLSH
T136667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 37ba1e931a37f4cb72a7ba20620c275c0556eb4ca1c27ee73ce41fa8f343a54e
MD5 133353b839ed439d190240fb0785a6bc
SHA1 d3e31f835af0dc3c36b8f10e96b8b3eb28d30008
SHA512 4d1384ae278da8028ea8f438fa9493504faa2d035d03c70adc60bd2353ac12e85c0923990842708fb4131e4dc6a738007b75f84af991c3e93ff249ff1f36b783
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UR:ZQRQyi36YOcPbLvw2gAf+PN3vDT
TLSH
T1D6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 48931d8e071dea20397d6309c882c5d395019889fc685a762422b5aea94c0022
MD5 9247098ce56d896954ded529a49e7895
SHA1 9152a2c5377297626cb434a97d74e1dcf72dabeb
SHA512 7bae9bf03ecd792f91d4900e081d25d0a3eecae0bb4dc22dc59621d44ad7f48b3971a05d736ce38b64f6dd959d5534b290717bd0ebc9e776f420367f40d46417
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0+PiQnDJGaz9:g68Qg55nhceWu7PNU3/lnDJJh
TLSH
T133B55A33B2F600A9C44DE1769F4A872196E17C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 57745bf194537d430e205b9d82674d8dbecd7cb2c4a535b9d6f70a5c1b43f430
MD5 d3f76487a236e1aa8e7ff5d6c1b729f9
SHA1 d809a28d68122f97e5aa8a744f404d5e08247a70
SHA512 eddfc61f2aae1ed1fa982ebcd100b41462344fb87e77d3c578c5f1976af84b236af14ac74d0f2bd7e011cfc2d94e1a91115cba2f211156e2c9632bc4e9af243c
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99n:xy5112gYy5azzVvt69nLKnhZgDT
TLSH
T131167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 260f7a64191ad4c34c572cef0a78029855dc843a4c7762edea3ecd8b2cf95608
MD5 367726ea4f19fbd7975d39487d750a8a
SHA1 2ea011fa7f1382bd5ee5b663c5034112f6c6ad4d
SHA512 8c94c95212e7e91d7bdb0a14ed95cbebeb669f0b12f94dc2f36a691ae61e2a4f60659217d0cff675a63c268699f2bf0986c1d6acebc99843b0f052ae4b953fb7
SSDEEP 49152:wB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glRnDJJh:qu6Jmdxd2dRDT
TLSH
T11CD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b6a8a51e176d05c9a98a7b62b1c7ac8fb5f4a4d1161a2cb7de60ad53fa959b70
MD5 0b8195852c999f3204262bef1607f024
SHA1 e7b2e3e8da317596486019cde6ce970ec50e895a
SHA512 194df1a63f682edf02a7e98437c2a9b41f50abc53ff5b5b25407525b46d08b4d389bf6d3cba50b995a00a642b81b58f34081c2bf5022160e92bb1a7779dac0d6
SSDEEP 24576:Chv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx3vPiQnDJGaz9:q1hpsNoJpF1A63U44CwH7R4xLnDJJh
TLSH
T15BB5BE13F2D900E8D05ED17887569232EA72BC460B34B6DF0A90B7962F7BAE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3e552af9c8baad956a4eb11de867aa11223aeeee9e28a560f53ab9e3959b935b
MD5 93c0cf88dc44a60bc8e09fa318886f5d
SHA1 58e63299ac6f9c3f169fd5ce83ad59e6c6d0363a
SHA512 15a020f72aa14a0477991dd85be3368a71de3c7f3f878be9ecaac67304a03b7a2e643b740b8c18018075a297427503fca52deb55ecc4ee2808d6c5a8342a8628
SSDEEP 24576:s4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6vR04FxGgVG2Onks6xt4bSMHnqOPiQnDJn:sSuZQIY0Be2KcRVtOnks6NMHqMnDJJh
TLSH
T195C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 182527d713869660c960e62898a77e52c702b9bd927cfd05b597009bce17afcf
MD5 4b8af028db2845f01b5d7e5faf93ee7c
SHA1 2a0550ee6f8f24a7f668c12bda2c90f85ee43f9a
SHA512 ffaae9143f53c89514e32e8ea6aa8ce0a52e102993350d0d9b66635f28ea62314c10909fc72fc2c37a269011aca5ad6949db8ae4632c3b2d7a6862e4f8d9e49d
SSDEEP 24576:MhiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QLvPiQnDJGaz9:MhtSn8EApI0fig3giDn0AP5wnnDJJh
TLSH
T15A95BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 5f57062b690d2c51c9328285828edb0f2fce09f95d37f255eb11bded3505e0e9
MD5 c69ff45aa1fe3b80a30faf2e59335a10
SHA1 619ac760fe97cf723c5b10956593d772731ad9b2
SHA512 9629dadf21425e2eef2adf58d631d11406ecfe81c6d4b6344380622757510202b764523c4a14431160afa3a472c0b24dcfb48dae19f9a4193d60bee87127d832
SSDEEP 12288:K6PAXruYyVHHaf4HJ1jwssawsUoN9PqIW:K6PiQnDJGaz9
TLSH
T12F552367DEEF4051F3099776D288E0076038BFAAFCD5A057396E79373A74A302D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 5870b022f5cb08662a4d0d3d33a500d49911a57ca7fc520fbc5967dbf95e17d8
MD5 9aa8655ee0c2712b45782457915aa9b6
SHA1 60925e4f40c8fa67cdc358374851b7e88fa57430
SHA512 b8c4094f935bacef5c13d29374b354acaa36cfbb0b215ffd0a858fe3fa08c4454e61566d70197b00ed2354d21be7405050f4f2e29c63eec11d4224716f044189
SSDEEP 12288:CxPAXruYyVHHaf4HJ1jwssawsUoN9PqIW:CxPiQnDJGaz9
TLSH
T18F552367DEEF4051F30D9776D688E0066038BFAABCD1A057396D79373A74A302D92863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 d29bdb26fa37af443b06b519c8467f33daed91e599ecc5f5f6261bfe0d044f45
MD5 b06fd512c4c1e3ee3e34f47ef69e7a70
SHA1 557c4dcf30f2d3ec926fb5494df7ed269eccea79
SHA512 b6b29d4f371bdc209408fd48ac33cbba91826f5a2bfaf0c9a3232cb8d02dded0f298ffb34a284474da2923d71504e7ca0ce39c800779dc922991a996914ef922
SSDEEP 12288:gnPAXruYyVHHaf4HJ1jwssawsUoN9PqI7:gnPiQnDJGaz9
TLSH
T1DB552367DEEF4051F30D9776D288E0066038BFAAFCD5A057396E79373A74A302D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f597088a2c1cf1c36434cc133c4f95b6a28fa7f377723d046d68d2c8190c9d23
MD5 43a3744ab05a7d9448abda7ac94b73e0
SHA1 38c2470461120eed84c9d56b88b66e3c5571a417
SHA512 e1f1a23b25f6ee39c7f2a07761674893af87eb94e15d2b30b765e1000cc3bb47bec3e5123db903ae7649c2a139c10763c87d3b0e3b63c87d53c9e335067f688a
SSDEEP 12288:4VIPAXruYyVHHaf4HJ1jwssawsUoN9PqIi:3PiQnDJGaz9
TLSH
T1C05523675BEF00C1F30AD37AC684E006B174BEE5BD71A29F2915296B2E707302D71E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 0c5ac7e4334a0db322e3f1b1c5909f8b12c10e6b82463bfc171b32a8318e088e
MD5 631d062062b55b2639a94d0490fdb696
SHA1 ce52c6ad55ab0c1773c32d20cfaf9211f18ec5a2
SHA512 2168f098f17fe05593c06568f9bf27214b791edc134164ab852496557560456499dc968b7584065211f6c18d79cc8b7afd4e62e4ddaa8b0d1c11837a6181cf5f
SSDEEP 12288:XgPAXruYyVHHaf4HJ1jwssawsUoN9PqIV:XgPiQnDJGaz9
TLSH
T15F552367DEEF4051F30D9776D688E0066038BFEABCD1A057395E79373A74A302D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 4b03437a141815582da222bff9814e35e14f845c0a7d857bba99c4b806d9cba2
MD5 544656177d1dd63da252a320c2dead6b
SHA1 0c8b27ab7c70b7fae3b2296f2b9abbc5960c8c2e
SHA512 be84097185065b6c899302b474567e837aaed51be263eaf8008e4f36bfc44787769404a09273bc7b4a2285ba1e87552e743c274606234f229e92b81a9bfcba63
SSDEEP 12288:mNPAXruYyVHHaf4HJ1jwssawsUoN9PqI3:mNPiQnDJGaz9
TLSH
T164552367DEEF4052F30DA776D684E0066038BFAABCD1A057395D79373A74A302D92863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 7b5496c42dc3902a101984972450ae24de2469b3409152957d6745a0140cbf39
MD5 13b94483f02ce11545f7f4d0a6a7ac44
SHA1 2d1ae4ea3e0c6d5d10ba04d6bdfc0a2034e30a9d
SHA512 351004c418d53827ccac313048e1a6956522533702cecbf403b8aca416d5e5ea2f230f07f7a64a7bdab4830bd1942ea49934ff20eaddeb567934a49948fbf911
SSDEEP 12288:VpPAXruYyVHHaf4HJ1jwssawsUoN9PqIP:VpPiQnDJGaz9
TLSH
T1F1552367DEEF4051F3099776D288E0066038BFAAFCD5A057396D79373A74A302D92863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 e9420d86684c2c42c2ac121012d3a66777886623af057ce5daae578ac6baab88
MD5 55c2dab9aa0325aa353046614e52535c
SHA1 c7b55770f180891c29862a08672b6d4c450d8d29
SHA512 9a730ad1ad463704d9ded3f1b30054f23ff1e7aba298d7c19fb6a41928d340ac266e587c7c75d3019d874f2ef51a9f86388e43f3a9f05540b634cae746fd8ff9
SSDEEP 12288:riZwbpzzFEoS2cPvyRPAXruYyVHHaf4HJ1jwssawsUoN9PqIv:WZMtzFVSORPiQnDJGaz9
TLSH
T1507502A5B3A518F4ED67823EC9559906D2B17C690AB0C61F13B836271F333611C3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 a87784d2efecaf8c3a3f513aef50dafccb4a9d9262c06882bed20e51537d517a
MD5 22bb75908abfe0a437297ca4faf65d29
SHA1 e5ab1082a6c48976ac975824a780f4008e13766b
SHA512 2f1dfc682a8cb6270b2e1be51a77322e771a46d132be839fe236030084acf7f29685138e77704f0626189472b7a9386c91b33dcf8f825951fc153cd6537a9ea7
SSDEEP 12288:QePAXruYyVHHaf4HJ1jwssawsUoN9PqIm:QePiQnDJGaz9
TLSH
T19755236BDEEF4051F30D577AD288E1066038BFEABCD1B057295E79373A74A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 3d14b27705aedcc5bdc7e2269666be445ab018c607118de33306803888c99128
MD5 5793f5bc75cc29b2b78c330d9a317f4b
SHA1 46f8f3ef79cab5f4b9009ccc308da9fdac721460
SHA512 b34f4f40706afcf52974994f543f7456332b08d0183dab2aadb0f52b654e75daab0069a67ac58ed0b890542a7766625f4cc4f2cbf86d7192ab482a1ec4f77228
SSDEEP 12288:/iPAXruYyVHHaf4HJ1jwssawsUoN9PqIn:/iPiQnDJGaz9
TLSH
T15B552367DEEF4051F3099776D788E0066038BFAABCD1B057296E79373A74A301D92863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 de9c80fb75c9a8f4b66b96bd54040929eebeeb4531c9711abee61ab69bcc9172
MD5 46d2fa43b6b609a42b89d18a20e2e667
SHA1 14ae71722b8ed5af6c3c712ea110d244941b6069
SHA512 5966cda6bfeafd1d028d24715eae63a16560eed271b29db815fe888ad736db13987f33124845d621e5a1b5e4a1ed9faaeece045d233cf87a2557229631e0602a
SSDEEP 12288:0yPz5L8VPAXruYyVHHaf4HJ1jwssawsUoN9PqIz:tzyVPiQnDJGaz9
TLSH
T1BE65121777A630F9E2279239C9915902F370BC325B609AAF17A417772F336A05D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 18f8431c0b01f02b7a756b25fb7621d7ae52a78cbb004c2363fd9bdd39529cd7
MD5 9bc2f35c1ddca1e657f0182bf1df0215
SHA1 ccb84188152c45ce402d2cbb90cf119d079582c2
SHA512 a79e621085ea8af27a7bd75be3985cbc651c7477d6c00913d35a031f0477182420618ebef525b28ca2fb8fd3f1c3e245de28a690040b65a77a8f35b0d43a73a7
SSDEEP 12288:SePAXruYyVHHaf4HJ1jwssawsUoN9PqIW:SePiQnDJGaz9
TLSH
T1A655236BDEEF4051F309577AD788E0066038BFAABCD1B057395E79373A74A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 4c945b5bbc9d2f1d7df0db05690a3384ecae30713c421d06b88d09a6cb636800
MD5 c77750bb55fe037c270015d7095b114d
SHA1 3a8757509dd3960987a8edfed49b522b977426a2
SHA512 34890594ce8da70cfc4f031d053748cb8b01a75086acbb8becc390b222890661a9e388aa988c47ec7aa41102ca0b52bdf1b475dcb53817489ab60ecdf6a6e814
SSDEEP 12288:fePAXruYyVHHaf4HJ1jwssawsUoN9PqIS:fePiQnDJGaz9
TLSH
T19855236BDEEF4051F30D577AD688E0066038BFEABCD1B057295E79373A74A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 5ff0a36747f6e9e3d31cd52405b5771b6a97264f4991360a6de40bf641658cc8
MD5 70011972a91281577ea02fd5ccc61104
SHA1 f2fa1e9280bc12d386c823ea01dc118e295109ce
SHA512 f8a59a9da33223a1f3ad8e3525440a02cb3a61614581d2d904d7ba463071fec337e21fbeb20aafe31b02d8ff2546ab52003d54e12c4cad25da6e092e010aa2c1
SSDEEP 12288:uyPz5L8VPAXruYyVHHaf4HJ1jwssawsUoN9PqIi:zzyVPiQnDJGaz9
TLSH
T1E265121777A630F9E2279239C9915902F370BC325B609AAF176417772F336A05E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 b507b9da5a0afa2d498fcb4eb49e2270385ced45746911a905f220bcbf2be3b9
MD5 05d0b52f9613b8a5042fd1ffad63acc9
SHA1 74c9ca9a7e7cf52f62263cc98b46cacaf9807c4d
SHA512 a5f632981473704883f52a24d9c4c2be8c9e349473413541ab473720addf1d65c36fd4c5ddd1c7b1c990ca0d780f3e9368344efe8eb29b96331d98a8e27f2e8c
SSDEEP 12288:RCd9GWYoaLHF3z0z04PDvhXPAXruYyVHHaf4HJ1jwssawsUoN9PqI+:sTPaLl3z0zDXPiQnDJGaz9
TLSH
T1947502A5B3A518F4ED67823EC9558906D2B17C6A0B70C61F13A8366B1F333611C3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 1980d6612a352e06008f79ed55b17680092a698f9af4519e86a5374afb1bf1b4
MD5 2993294a6ed26fa8fb697b813c393482
SHA1 afb1a5ed795c6f91444c1c0d103cc3761c5f6c65
SHA512 9b42b3d31c441736b19007952b396d8c37bdfcf3386b4d609a1b71ac496460a723f29cd83e4e5b7d0161399edee929f6c115804c643dafbfd4601f78cfbeae7f
SSDEEP 12288:Fi4e7GRdTfgwCHKy7GLbbdIvMPAXruYyVHHaf4HJ1jwssawsUoN9PqId:F37d9CHKy7GZzPiQnDJGaz9
TLSH
T1B685CF90F3E810E4F1B79A35C9769502DA767C591B71DA8F03A4261A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 c1e12d72d01da57af886d0b668bd53b798f65c1544cb06fbed25c1ce6e4c570a
MD5 e4d79b390750e09257c276bce93e9acb
SHA1 2ebd1587b0994f7f086d30c82f0aabbc4b4b285d
SHA512 c5ce2fcbc601a95f900f40d412170394cfeef399b2fb78d30ad1121a95c89471578a2cda1bbbb978ec6da16e8534edda15467dd1a11e7bbd7f125a78cc1b5e43
SSDEEP 12288:pHPAXruYyVHHaf4HJ1jwssawsUoN9PqIo:pHPiQnDJGaz9
TLSH
T19A552367DEEF4051F30D9776D688E0066038BFEABCD1A057395E79373A74A302D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 8f426f45704682fbe357c568c7ff216c9c5eb0ae4a2f9fdfbc065b7b01250e3c
MD5 14ea826309fc83a19e85cb270c4cb1a6
SHA1 224682221ecd8b623ed28e38b69189ddc3b7fd4f
SHA512 697c9863e7b177bbf5b9e08f91e379eee64fb379f251cd71282f0b4374fa1c84aebd18deb96f2f0a103e9c2738c17f0c9cb89d71a75c3d809e9cff0ee80576c0
SSDEEP 12288:P1PAXruYyVHHaf4HJ1jwssawsUoN9PqIQ:P1PiQnDJGaz9
TLSH
T1555523679FEF4051F30D9776D6C8E1062038BFA9BCA1A057396E79373A74A301D92863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 c22989eca6199860f71e7f7642c47ef1cf3146f923b8a6a4cca3d50906c02a7c
MD5 408598b47de5536fee6393a03d906537
SHA1 6a8a806a097dd6cf2c25e6cdf8daabcd4ada4e66
SHA512 f5ae08a3c33a6fa88161e8f8f9b21e9944667d19c46aa76428327d0567c17902f28b18a33b4e6f80dd31f607dc0758db3803c6400be9cc76e094338491e06563
SSDEEP 12288:GMPAXruYyVHHaf4HJ1jwssawsUoN9PqIb:GMPiQnDJGaz9
TLSH
T19C552367DEEF4051F30D9776D388E0066038BFEABCD1A057395E79373A74A301992862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 5f54968353cadc6ab87bbec9fd3a6e44063a67accff0ad25f318e290e9fcf3f0
MD5 63f1c760bcdf8f7da6fa3209df5d4d39
SHA1 4dd3249fd73bf1b0ae74771749c0d315f960771c
SHA512 25bdc738df9846dec06e34ec9ca1716cfaf2bfa5b47a37935474ddaf1710adfd48e4375300d940b713caee751343615324b962d232bd8b6cc6bc3a2d0406b13f
SSDEEP 12288:MePAXruYyVHHaf4HJ1jwssawsUoN9PqIe:MePiQnDJGaz9
TLSH
T10F55236BDEEF4051F30D577AD288E1066038BFAABCD1B057395E79373A74A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 43ee150fb6ce3be3978b4846fd59342762961e35d116e0bc9688786f040591ea
MD5 1cc0ce67af0cd64e2ed819e12ea4bd73
SHA1 1cfb23417f13eb6ede620d52d3d4c808cb3c6810
SHA512 252fae7912631d148c0d34e7091d60b2ccea2421242af24e131dfc84da03f78e9cd82301da898c9ad7d55402530db55ec9fcb5ff1d64f9f20c84aaf912b8c373
SSDEEP 12288:tHPAXruYyVHHaf4HJ1jwssawsUoN9PqIi:tHPiQnDJGaz9
TLSH
T10E552367DEEF4051F30D9776D288E0066038BFAABCD5A05B395E79373A74A302D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 0d747a6d6cc267ebec356066952c9961b2b220ad003827409b98af4e0990b1b6
MD5 d8ad5939bbc24c3f8f821a5703c52151
SHA1 58cffe3373209c008d62d80e9b9c14baed4ceedd
SHA512 7998edbf4a91106b818896b43f2f3256373bab35288de9e8a57020dea5335a7bdecbb0ad24620eeea9832194bb77e54dccc49c1b39db5edeb9099ddb9abb6010
SSDEEP 12288:Z2PAXruYyVHHaf4HJ1jwssawsUoN9PqII:Z2PiQnDJGaz9
TLSH
T18E552367DEEF4051F3099776D3C8E0062038BFE9BCD2A057295E7A373B74A311992862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 6aaf1a58a027a8c9df0251f8123d4438dc9e46fbbc1ef246e685995d08c243e8
MD5 55b8bdf28d7b69546e1bddb9ccc29470
SHA1 eaa2e9496799f4931e52e3dc81e12b20f622a5bb
SHA512 e78d016d9f2ba03da2987fecc6976d6f78a00c86d273d309cca8f71196f804e9466cc494b8f1f508684480a9b9e466fea04aa32ddf26a018940249c820c68aac
SSDEEP 12288:XfwvD5u664Lk3tRX69qkyAI5kPAXruYyVHHaf4HJ1jwssawsUoN9PqIo:XfwvBk9RX6wkyAIyPiQnDJGaz9
TLSH
T19685D029EBDC44E5E177923C99A7860AF2B17C691B31C2CF125A536E0E33EE05D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6cd8c622be1ec4f9e3f00a4220fb104c265df380cae4f632ab7b6a0d4177f689
MD5 04dc36a5d3f48a5260119ac779862f84
SHA1 d54f2997d6aa224901db4abab7250093d31eeb31
SHA512 14f55638a70a2d003fe5e7805e0b39d658d2e8ad4e0867d54d33358aa63af62b06e44c4a355e1b55828e808dd40d9dc0811de49365d1fa19e9142620e10800b0
SSDEEP 49152:dYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HnDJJh:wySzPPDT
TLSH
T113066C97A1A801D5C1B9C1B98B0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 da19f1ea8f2ddf229eac145d70668b8f0c74bf3ea21568dd1821c22c29592751
MD5 466f7e3d6e4ee12fdd3313293709c67d
SHA1 dde7a5decfd410122bf74094469dd28e968de821
SHA512 71ade11355637bbbe96c9f4b737cedd1e6d02caa7f120c6650c902cc877c4aa79af47c4d3ef1dff9b27f5b0a1e529ba7e371ff36d5a44403e97ab322fcbb30c1
SSDEEP 24576:g47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYhPiQnDJGaz9:g47JUQjTirIhCnDHUPfF/XnDJJh
TLSH
T11E65AE1EA3EC01E5E1BA927885158A1AEA71782D1F31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5c9bb2991aa35a4092cebac8cdda4b13caa3aec0ad9149ad097c10d777c43941
MD5 a7735d5239b24460f77b586200b81ebe
SHA1 bc2e81ee50aadca20ac67ceea4104e060bb99990
SHA512 076ac8d7f201712dbdd2ff49e30f5d58be1ee15ca44e8f64dd5e75e64e231564a429ae3933370fbaee68125f229bdabd48292890bf8ebfe1e8ba9edc6213ee97
SSDEEP 12288:7vsfOPAXruYyVHHaf4HJ1jwssawsUoN9PqIc:COPiQnDJGaz9
TLSH
T15865011AD39902E8D15E6239C7859601B3337C659BE1E3CB26D0F93E1F356A05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 ed954984bb801bdcbb5768029eb9ff2cbec72c1dee077c5e5a475e89aab38b26
MD5 b568491bc99f5f408509276bbb364c8d
SHA1 b81717378d2e2b048a1f563f9127fbb846f4c348
SHA512 5479d6e10c07bb717eeb72224b2061bb936443fc7a95c3c6f72879c08c9d5efe8453aea8dca4dae0123544f348c39407ad2a936e495a927d5792fe1536243504
SSDEEP 6144:78XsBC2namQ9n4uad6bykOotMxANgGFjJ2gPAoPK8uIr4kNfpokBbwWQDNSiSgSl:ZZbo9jJZAoyFfkBE1DNSBBJZqjpu0pt
TLSH
T1AB2506107666DB8FC66984321E33D1CCAB707D11EE05AB0772C9873FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 3d3e5f4e6ae5c23249659330ba1eb7f1a8f94a13feed7e9be71bff68913ad7bb
MD5 f5eef7e33293a46e4451b9a4c2649b67
SHA1 89f63961b5f8a66bb99c8a8880cda9e0d053fd9f
SHA512 b7070ce54884b6801c946332ad5240c3b9eaa4ae208952243e04b1b7ce134cd4967979e5923c2a3be95a20afd20d6226db5538d873e0c6faf286d072a78636a2
SSDEEP 6144:XBWcrDx9nxnSDDDlCZwCcOCosocVQVkVldX9ztMxAXztMxAXkckD8b/43lycp5hz:8CBZ9cOC7oSrdXGlyyhXDH
TLSH
T19465E6419133A6CFC5BB6032072A9F4C6B64EC07B7059F26B3C5453AD86AB52A1FD3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 49a338a7ca088fd27bd670a661eb12aaeb0454c02d1354a00c489bd1797d65e5
MD5 76325bcf792540260fb33414544ef273
SHA1 e044ec4a34d2e1eca63e76b06b7ad6635235c036
SHA512 4537bd8d4cde859f6d06f25aac0ae8cc78ab5531d63da9091dabea54dd04db8c042f0016b27f2b21b3f593a5d6cc69d2366b9e8bdd70122137d2a8cf3b885579
SSDEEP 12288:SI7mPAXruYyVHHaf4HJ1jwssawsUoN9PqI:nmPiQnDJGaz9
TLSH
T146552367CBAF4401F32D67759689E006313CBEB4AF90E0D778597A6B2A70A701DB2913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 49379d00dff1b35a2e61c7339890600a28bac66744c53561380dbdc008e6fad4
MD5 8bcf180e5e7ef2bda8c5c73c1f19a03c
SHA1 ad22df067481abdbb767cfa895b51d3125ea91ab
SHA512 6b167be6b59a5741c5d25d0f902e993b75ff76bb8fa49c3099fe437305735323b3729ef1e8b3f8b57247d9f881040b4ecfc92f48a555ef0d26fa0e20f0bf100e
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bYUPiQnDJGaz9:2gb4mBIBhGFxnDJJh
TLSH
T13565AE1E22EC02F5E1F9E2B8DDAA4417D6B278160731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 17a5b601b75ae77c7621f320e8288c2329fcc8bb6bdbd89fcadc45bd56dc5eb8
MD5 5440029c2bfc13a6a9ff25f43a2f6c27
SHA1 906ff44aa7a0f72eb55888f1ca9ca25d29b33572
SHA512 20d935a1de184807f9cbc5439fffd301a11f983b4e046a86ff8721019f16da6f8d0f64c61b3eac83b5c1723cb77fc6285eee635f19d934c199afc3281e378df8
SSDEEP 12288:VGn88u8FpJqH1CmqQyizr9wA5hUo7WCmRPAXruYyVHHaf4HJ1jwssawsUoN9PqIR:VG88u8FpJqH1nzria7/mRPiQnDJGaz9
TLSH
T1FF95F16567E501F0D47BD1388A868653F6B1B8251364EBDF06AC8B521F33AE10B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3647cdd9abc5dc1d9561cf2531bc5f0b121aaf93ac9398d4498b0345e9179b73
MD5 9540f235784f1f0609f7536a538e9b43
SHA1 33bacf15d6bbbd5cc8d7f0a18e4d8de14d2c70b6
SHA512 c0a899202fd2c6f51f0d4a51e95e9cfcc7e2ac36d9247cacdcdf08b2f73497dfe1a48bf87a86f27b7c229a7ffc689ef3c7a8e42e1eaf05fdcdab99345b9a8d38
SSDEEP 12288:CHvUrBFrEjwaQdPAXruYyVHHaf4HJ1jwssawsUoN9PqICl:CPUr+NQdPiQnDJGaz9
TLSH
T1B675E12F66ED18E5F67AA17D85828609F371B8621711D2CF02A0817E1F73EE87D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c06f3f68c9eaf4f0b25f1a16be39c3a2879e39bd72ec30465e7db3fb43c83f93
MD5 b21acf2c7442a907c80003389b555206
SHA1 413139fd054711cd13ae6f050f7bd9cf8f1b5475
SHA512 fd06274a001cf34c1bcf16fb7121737e7ec5703b92632fdbe0651d97c693be35ddedc6fe3c822ad2429a05692d1cd0fc596573801c35f49e2d702e345cafb03b
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9nDJJh:WG05lO43bYDT
TLSH
T185D5CF6A62EC11F5D1BBC17CDAC6860BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 31987b32dc1edbea204b5fc21e7550f9b163e05fe9b72640194fec90d572337b
MD5 36839a2a25803600d7081e2484f5c65c
SHA1 899bdc528f315cb40f666b1b1e0540ed2809b156
SHA512 551122d34ea52979d69230b8edf493d88411c912fec5a50adfd7d60837f96bad184e289dc3a0588b916c830edf0414acf867eacab97560f675211a18c6bbc383
SSDEEP 24576:Mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnLPiQnDJGaz9:Ua5POZ3BJt2pasx2+mlnDJJh
TLSH
T1C965AF5EA6FD01D5E179D17DC583860AF5B1382153319ACB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fd06c9d6373a7b2ed966797d6c037290dab7ffa0e7134be726b02c0f25eeba3a
MD5 3810d16784f9331bf8e10ca0bbb4c4b9
SHA1 2a9960942b019cbd358ecf114244571fc55372ad
SHA512 1b9486370d12cf607e7e36cc15cf295af4685c15c7ffce81c204928e2791317a072fa6a7372ff7e07ef6ba54146d3bd47fa326f7c4dace5052d7c8b475a6be30
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkZPiQnDJGaz9:uNc/zEOVHFOnDJJh
TLSH
T1D9858B2623E901E4F1BBE1BE89679546FA717869173086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a7f17cfcc72050c2184371added31d17b0f23f9ea6b751d1078423ad1431ed67
MD5 ff5b7ef92f896be70faebfd93333ce7c
SHA1 f90e541025dde8ff2cac8f789b0c895237333d50
SHA512 db33282d9c20cf4b48da24bc323401b51852b96e420e41416a4d0c33be1a3b766847415b01bf8530fcfddeeed4514d5d7d986bedfaa1ed6e35cc717a6915ace5
SSDEEP 12288:IQFSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTsh/m17rPAXruYyVHHaf45:ITkNvNnaFeYhJNtmZBmVPiQnDJGaz9
TLSH
T1E655AF2EBAF806E4E1FEC6B5CD238512E6727861173292CB5290C13F0E679D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 dc97dadaf64bceac7cfd4b2c2d5de95373d11b59205c67903823e83528a0c5b5
MD5 a3e2a88a1f8b6604d61e363123c80698
SHA1 c824b3fcde6a87e19a16a1219e062f5889288e9a
SHA512 0ea4ce14383f25a7f6c8c208c5a98b9cfeb0f6f049bac75dd45c434538ae888876279a41b121bc7885df4bfe0b0ad13da25aa283157e9d9947ee6ab54ee5b739
SSDEEP 12288:6QcMxWDXN1Dp/fshBItT1IQgAaPAXruYyVHHaf4HJ1jwssawsUoN9PqI7:oD3FHshBIYQgAaPiQnDJGaz9
TLSH
T1C685E17EEB9D04E4E57BD2BCD6538506E2713CA9072265CB02D481BA1F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-71-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/432-306-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/432-79-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/432-73-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1132-56-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1132-63-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/1132-57-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/1132-291-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1980-52-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1980-69-0x0000000140000000-0x0000000140224000-memory.dmp

Download

memory/1980-44-0x0000000140000000-0x0000000140224000-memory.dmp

Download

memory/1980-67-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1980-51-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1980-45-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2320-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2320-131-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2320-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2320-125-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2320-134-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2600-8-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/2600-1-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/2600-39-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2600-7-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/2600-0-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3324-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3324-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3324-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3324-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3324-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3796-307-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/3796-83-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/4860-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4860-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4860-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4860-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4928-21-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4928-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4928-15-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4928-22-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4928-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5284-327-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5284-93-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5284-87-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5284-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5284-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5284-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5512-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5512-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5512-106-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5512-100-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5512-311-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5512-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5808-118-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/5808-119-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5808-112-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5808-310-0x0000000140000000-0x0000000140200000-memory.dmp

Download