S1-mp64-ship.exe - -

Some older or custom deployments of the SentinelOne EDR (Endpoint Detection and Response) product have been observed using a similarly named shim or wrapper. However, official SentinelOne executables are normally signed and named SentinelAgent.exe or SentinelOne.exe. If S1-mp64-ship.exe is found in C:\Program Files\SentinelOne\, it may be a renamed or third-party component — verify digital signatures.

S1-mp64-ship.exe is a malicious executable file identified by cybersecurity researchers and antivirus engines as a Trojan Horse malware. It is primarily associated with information-stealing capabilities, designed to covertly extract sensitive data from an infected Windows system. The file name appears to be procedurally generated or randomized (common with malware samples to evade signature detection) and does not correspond to any legitimate software application. S1-mp64-ship.exe -

(Get-Item "C:\path\to\S1-mp64-ship.exe").VersionInfo | Format-List * Some older or custom deployments of the SentinelOne

If you're tasked with reporting on this file due to an issue: (Get-Item "C:\path\to\S1-mp64-ship

This is the most critical differentiator for modern shooters and RPGs.

No – persistence mechanisms will reload it. Safe Mode is required to prevent auto-start.