e9a8cb3db59f48cfd0ccc3a8766ceb727523747a3d0ae30ba500d1c7f86afd98

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 15:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Size 8.3MB
Sample260417-s4bdjset8x
SHA256 e9a8cb3db59f48cfd0ccc3a8766ceb727523747a3d0ae30ba500d1c7f86afd98
MD5 7108f622a46eb10907e02022658c30d4
SHA1 77ccc32561b9fb04d4cd511186572383302e27b0
SHA512 81351b62abb577b3d6e65d1b5f9c35a1bbe5e465ab792277f057ba98d859f544085c2df3abb229659c0833cc1ee305d99805c19f1db73cea8283c004426989aa
SSDEEP 98304:oYOrRn+os45gaHrh3w3D7nTsReRR9CQbwONh:O13w4ReRR9CMwQ
TLSH
T1C1963A4677F455E5E1B7C2B489B696B1FAB2B8951C34E70F1061821F2F33AB09D2D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5716	alg.exe
4656	DiagnosticsHub.StandardCollector.Service.exe
5032	fxssvc.exe
3856	elevation_service.exe
4588	elevation_service.exe
3184	maintenanceservice.exe
5040	msdtc.exe
2328	OSE.EXE
4312	PerceptionSimulationService.exe
2812	perfhost.exe
1584	locator.exe
6024	SensorDataService.exe
384	snmptrap.exe
2464	spectrum.exe
3828	ssh-agent.exe
6112	TieringEngineService.exe
2308	AgentService.exe
5372	vds.exe
3596	vssvc.exe
5564	wbengine.exe
5740	WmiApSrv.exe
1820	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\63940865b955e89e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a310db98acedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3cc48b98acedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c0382b98acedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031bc35b98acedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af6665b98acedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d03556ba8acedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f29a8b98acedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d5290b98acedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
4656	DiagnosticsHub.StandardCollector.Service.exe
4656	DiagnosticsHub.StandardCollector.Service.exe
4656	DiagnosticsHub.StandardCollector.Service.exe
4656	DiagnosticsHub.StandardCollector.Service.exe
4656	DiagnosticsHub.StandardCollector.Service.exe
4656	DiagnosticsHub.StandardCollector.Service.exe
4656	DiagnosticsHub.StandardCollector.Service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Token: SeAuditPrivilege	2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Token: SeAuditPrivilege	5032	fxssvc.exe
Token: SeRestorePrivilege	6112	TieringEngineService.exe
Token: SeManageVolumePrivilege	6112	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2308	AgentService.exe
Token: SeBackupPrivilege	3596	vssvc.exe
Token: SeRestorePrivilege	3596	vssvc.exe
Token: SeAuditPrivilege	3596	vssvc.exe
Token: SeBackupPrivilege	5564	wbengine.exe
Token: SeRestorePrivilege	5564	wbengine.exe
Token: SeSecurityPrivilege	5564	wbengine.exe
Token: 33	1820	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeDebugPrivilege	2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Token: SeDebugPrivilege	2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Token: SeDebugPrivilege	2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Token: SeDebugPrivilege	2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Token: SeDebugPrivilege	2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
Token: SeDebugPrivilege	4656	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3856	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
2660	2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 4424	1820	SearchIndexer.exe	105
PID 1820 wrote to memory of 4516	1820	SearchIndexer.exe	106
PID 1820 wrote to memory of 3416	1820	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_7108f622a46eb10907e02022658c30d4_glassworm_mespinoza.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2660

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5716

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:648

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4588

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3184

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5040

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2328

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4312

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2812

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1584

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6024

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:384

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3636

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3828

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6112

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5740

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4424
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1652 1684 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4516
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1648 1644 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e781f3be54906ca60ad9ce36a530a85d22e5344d15e462c517829166116231b8
MD5 18aed634de6f230dd3ab3f4b80a4027b
SHA1 2a865ee9c00da265845a5ed4f71fd855b26e8e72
SHA512 65d8964d3863d8570a57ff789ed662ca1961f52d0f213c764c79c86f466f3a074db8d807f7ef09de30162254ee200f6f6d594f88f789b3b585df4d2af413f131
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn0QqowOHbD1h5:e3q6HjBvQbwONh
TLSH
T164D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 c4a7fe97791921ff88a9632fbf7416a58ffeb00e080356767f8566ad63fe5df0
MD5 e85d7d9b26135ce68e6490ab3a2ea244
SHA1 3addbdbc8e0e9f792c30cd342b6864264d233139
SHA512 b8065ea125e026ae2fb62704d4e340f71263beea0372cd9d595d663037517215f354afc4ff6f5a91561929cf64f8ae32adacf371ba625fd386b85ccf9a00bca1
SSDEEP 12288:v1XLsswWkxy2lRq2czADITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:NXYfDtczADIT+nowOHbDVGnqh5f
TLSH
T1A9850128B3D508F9EC67823DC9A1C511EA73789147A0F69B03A4993A1F333D85E7DB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 4f2d2b05094a55a48f3b6356a00a4fc9375cef05237861c119e8548c591c5c38
MD5 970da150706c11f2a38c465a8a673bc4
SHA1 f6d2ac356a4faa7b1336dcfdb3e5a3c76b3deb47
SHA512 838cd01141bf098fa641071690b3fa44c89ff074892d54265469e5dce22d2d5d413f661fe6938bc3ecd7a52fb94e2a5e07685cfc1ea4ea63e92921cf61255163
SSDEEP 24576:k0Le5ji0hmxYrMsIT+nowOHbDVGnqh5f:kPji0A2dQqowOHbD1h5
TLSH
T1C3959E55F6788331D073C0B9C5D2A69AED7230865B3089CB4286D77C2F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 78f0297ce680581876b6a95b80b5c989f00301fbd0da0b3c7b91eed9cc66becd
MD5 1bcdc9d2829699f570ce10582e43e3b8
SHA1 1b2485c010def0f9cf9cacf82a4a1f7c2ddb4785
SHA512 56c11b03478fd41b0e2e1cbfbe1c6cafd29f5b45577cfcb76e4229145bc5c672d05df880599627487c64603a5bcd252ad684a32eb363a80548ea21d50620f438
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWE6q8wyuCIT+nowOHbDVGnqh5f:i/ezSC6vUzPvxHjyhQqowOHbD1h5
TLSH
T151756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5a6ff70e8219145d1bba112f389f3efc1945f8c2d0ba6487940074e069887860
MD5 705f5e54070c7da9d1c25f23a7fae482
SHA1 8f215fb44dc5aa0b5f58185c581c97d8c85abed5
SHA512 384d229cc8db208a2fde11ddf9426a4b306405a82d129489bdfce5be0067ccd949f468c27de5558ea1f6a310cf5f495f5d532a8148445ae4e5968b19cabdc288
SSDEEP 24576:BVbqPb88hv/l+6fIT+nowOHbDVGnqh5f:BVO88hXl+gQqowOHbD1h5
TLSH
T1FC559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2F677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c3ea4fa1f876d6d9b7c1dcb646afddc2378f19a32385f1f92bdb7f6ea26e707c
MD5 f0f146a0845a7b6d350ea0dde02ee161
SHA1 f3a827530647d077c5da4e92526651054716ee02
SHA512 a7cce19fd26d6f0cd3fd0c796d1681cb6e22adf99fc3c6812e74630255ccdd14f63ed9a00788102170b2bf137ed8430c513dc3fdf23364ac597a46128b5b52f5
SSDEEP 12288:zHoITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:zHoIT+nowOHbDVGnqh5f
TLSH
T19D652390C75E80F3FAB7463593A8C065F96BBC90A5E06832C529A93F0BBD74195D0BC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 9fa4ba582ff46569ce483c2be7d2ae67015a235324b7f90b14553da6c2bbfde3
MD5 0a2743efe5d843c9df9ba7e8cc24a499
SHA1 865f1f008a6d7781334c876faef74f9e06bd2a7a
SHA512 35fb322f17c11eaf6db819b2d3550c82e23b4ec738010c5f94dcd5416f0621a92e4b0bf8c5363b24f1d74702c361b276716a244fb00bf9ea1f62a9ba3cdd48ef
SSDEEP 12288:eeBNUbTVO86UXITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:eJIUXIT+nowOHbDVGnqh5f
TLSH
T15885CF7BEE28FCE2C27A8D795791C200E77278704B61A3CBD175820E9E236D05E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e0d03238e2a70121506a30f058495e8624594ca131f4f6d9a6035477873edebd
MD5 213289e812db11bccc82dde984eda5e0
SHA1 59eaa3f29cdd1a94bb10c45d146dfaa4924d4a6d
SHA512 513b1ee5de8c77e424adc8f048e32be940cb76eac18e0935363402cf459f4f538cd536660d293cdd4252dfc9519ab0160e56459edc7c92ef2e0633c7439973d2
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THs:tQvGAdlCEL8c/yRNw5CyQbwONh
TLSH
T133266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 8d06969aadb1f8fdd14ceb885d636f39e794116a573a74a4f48ad76883f99e2c
MD5 6b9359a47b409d87cabad826b9dfb486
SHA1 158f5956f904ab037539492c75b9ac374db9fc90
SHA512 2ce0145f31fa3539838c46bb1aa744e5d16a9c957efe7456630ee4b3d92944d544b8b0541e790b006e39c5212a19605bf1b873c45550ddf5d158a1bac12b78f6
SSDEEP 12288:jAwSfxL/2Dc3SDLLmt0LDQewsAjNITvGRhou2+uUibZylrODldDRdDi+F3lJi6/d:c7ewsAjNIT+nowOHbDVGnqh5f
TLSH
T16885E030FA75D032C6BB0DB61B35C316687D79604BA129C3E3A88D9E5A742D22376F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7a836765a1fa63253bc0817ff1c85142219f6af0e470a230e769bda5e624d8cb
MD5 3b4ff685857a595d4a4506369f88b05e
SHA1 d3c7031e2191c8fd21f84bbff1a0ea29f3862b4e
SHA512 05771a182a193ae040febbdcf7504d3b5ab650c842318ed6b23f38982cf148f438d8220c3e67abfd849a58be7f14e17bbcb1e1f8bd7bbc7b081a7c59ffaf01e6
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVMwQ:gUEtQevvqc2W1cpV2EI326
TLSH
T1FE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2eff1119641554d81a1dadd3c0460279f037e9966414e9cf43f43f9767a1ead0
MD5 736c47374906dafdac79039f74a3f14d
SHA1 0ca9a57248a3ebab887f502f9aeed187d2a34189
SHA512 835716f5afda9c4078f20b1f9ece21f52061755bf4129a6c70595295e17c51cb54532527c97641e0820b51ec5b5260c45f9bb8c3e1d85356f9fd7fde42dee726
SSDEEP 49152:lCbRquA/m2yL5zLfFiV+XenmE3/ztQqowOHbD1h5:yoq2VjnmWQbwONh
TLSH
T126D57D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4266461E2E33BD58A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c6fdeae6dfd3a2692d33489c750085bad45e14e33592af83355c4f48b7e28e0c
MD5 37453837331cc156fe1f3bc91a67ca6a
SHA1 bdf1cb562830e25c745f842d1ea4ce57a3526afe
SHA512 d63c86bc66d7dcbc349802041f47cd9566cadf8c7c22f9fe4bc12f4a29e2b530f01ae9e9770be8548ea23482e16ffe5396289bec9d9590ecee9af7915de0bf13
SSDEEP 24576:yAhGLJIFoiwtA5l7S532IT+nowOHbDVGnqh5f:yAMyFoiq5GQqowOHbD1h5
TLSH
T1D7359D80E7F955D4F5B3AA7899B68171EA76BCAA5E30D21F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c08629c722eeb95f478a0e94be8a651bda6bac833cedc0130397c421e837c949
MD5 b119335a69c80e2b5dc1527fa05bb702
SHA1 406e21f3f494f43779e1ce89edac51dbfcfa7105
SHA512 b9195a373c02ef12f5476f0de9c6eb1a1755658e234dd56a514b60d066e85ae9a8ce16bb3133de3ebbd142032d7bf7966698a079f57bbaa5f82bb6d65ebf33b3
SSDEEP 12288:xmw5HEjsChNzBFgl0WDm+CiITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTh:swuSOWBIT+nowOHbDVGnqh5f
TLSH
T1C885F14577A90CF9E9A78239C697C136F7F3B8012A60DB2B4760C62B1F373516D29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 6d167c256175c27d7bf3262422bb12923ce193f1797343fd61d15de9253ec618
MD5 9bb2b21524eb4ac436497164d21cccd1
SHA1 69327bf909e5e95a02fbdbcf1123068a7f0cd0bf
SHA512 53e1c876d8c3593c25db82fb10a12c157fa08bec353ddd4e5e39a59bba216832f9011b9f5783efabfb9cee8f7c504271bc9015085d0b22d59982a72c08d85314
SSDEEP 12288:pjZ1Iy9ITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:VZukIT+nowOHbDVGnqh5f
TLSH
T16675129563E860F2E5B3823CCAE48115FBB2789267B053DF4628462B1F77BC11D74B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1606aebd90e1fa7e97103eee4bd008c877aea130c296a56b3781136ba4b02c4a
MD5 aa4648fe38f428dfebc26a4c968e5e2e
SHA1 abc1c8ef6bd00c4874ab1363ca2f27ec8b19cf03
SHA512 cf77244268d2b761034f63b86e4a6359a74494b80538cb53c63d20495747bc61f2f2cf264ecbf82954c88cc8c4390782262bd26a32595ec5aa099d99308b83e1
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:uQRQyi36YOcPQLvw2gAf+PN37QbwONh
TLSH
T11D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0ce2a505314fc1b64d5d8ced19753b52a1c049f2a59eec86c3ed3fe89cef9614
MD5 64fa9d7d9be0ab19cb0219ca61841e8f
SHA1 fe2c70a27eddc787aab82bbaa7b2344e1c97fafa
SHA512 ff0f715ff084608a6a6390b253a6487fad2449c4f88c9f4ebfbdf130d0983157dbce68bc66349a1a43e66425f27e8bc347f754dffe4dd7adee6217169a6fdfb0
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:cQRQyi36YOcPQLvw2gAf+PN37QbwONh
TLSH
T102667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ff5aba8e769a38b85d0cfc099f53d5a7ec1f1ff9d6b3f0d3ad8d7d7808e3fb85
MD5 f4c4296dab44739171e4b9ebcbae4890
SHA1 67a3d61d48cf9e50f15c34a254d71c2abb4d3427
SHA512 6daf2cb0471f14b703a65a2def22633979d8d5049d50188f5d5068dac44fedb2a2bd3dc0b30d9bf5ede2eab6a2f886bb12903c120eebc12aa018fb17ff1fe225
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL00IT+nowOHbDVGnO:S68Qg55nhheWu7PNU3/dQqowOHbD1h5
TLSH
T1E2B55A33B2F600A9C44DE1769F4A873196D27C718FE0E3DB851572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0969a549c066ff5c411b427b74005886783194d47b24fec260cc50b19182b535
MD5 cab54015dae363bbb6495e94dcbfbd2d
SHA1 85cf38011615e664d4be56ddcbede5b52d9ed5f3
SHA512 6fd295e2bcfb61ce49081e12c62fd021e0faf1cbaa6b8a5a4a5d58a804d23f6f23becdbc29444685e311f0c202a453965df9c3ea09c84fa8d45785b3d901c1a6
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:Sy5112gYy5azzVvL69nLKnhZoQbwONh
TLSH
T109167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1e965e6897e5b10772af2739fa1b8f0ace7ad78b950ad102ad495955b775b248
MD5 ea34a7fa69be30b6a2b7aa566d8d22c2
SHA1 e6b0d71cbb9aa429b166677ff929a135d1ab5865
SHA512 2e4167fef65c993df966a9e9872e3ea24dfea4fe66a497b42a6f0cd67840e90acc115e572cb30aff63d472262fe97ed60bef39c59378c337d6139cd853cbb18f
SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glTQqowOHbD1h5:4u6JmVxd2dTQbwONh
TLSH
T12DD59D13F1DA01E8D06ED578974A9233F962BC490B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8806c7fe4fb53a201ab0e21ce1350e37a8f55bbdfe0c6d6cdf8390a53b4ca749
MD5 30f34b4fa984994be0f368e58407079d
SHA1 6bea29af3173ea7f9e69d2514690613ba3c03a79
SHA512 f55037ef4cf9901688551318c269a5b4a3a56e23e8f7bc86e837cf1e7b5a217fc42575f3efda08832ca20a18eda5f16e106bdbc815bfed8c130a3ff8b06f8401
SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4x3QqowOHbD1h5:SmifPbRWQbwONh
TLSH
T150B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 91b2116f689238e3df7484bb40150bfead3333f88624c188a109e31e3074c7c7
MD5 db862005166d6e6ad40baf519499804f
SHA1 628d7d9f027b1c79502bc14bed89765bdfd903df
SHA512 d7a690a96dd8be924925f54c59842f43960dd42b53df2c2bc0b607f3658a1ee0e1c8cf90c1ad824f12dc908dba63e4c67b9df1e3b69733d4502389c6b31ea8e5
SSDEEP 49152:KSuZQIY0Be2KRRVtOnks6NMHqkQqowOHbD1h5:U5dKTi61kQbwONh
TLSH
T1ACC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 24fe3e44b49d984923e16622d0a28adb84ab494dc781f3d57accb1ef015df2cd
MD5 55f0a7260061bbf805ccfaa9b26e5542
SHA1 2efd7c16046aa6dffb00c6e51ef14033b822d8f5
SHA512 0e451d648dcef4409d08859009c3e258c174cde3250c2d1ce253aabf106251af07c555215f4003bb4e68ad61a7eeeb38f8a38c99c586ce527b85318f9468c691
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5wDQqowOHbD1h5:oX2iyphaQbwONh
TLSH
T1DB95BE13F2D900E8D06ED178C7568632E962BC160B34BAEF0A90B6561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 34fbbac22dba5984e01498860e2cb9df824b60b25d8125cd0d9483cd40e0ea3c
MD5 89e866a37cfec15a4dcc6ce529d17da6
SHA1 9fefd5e0590e661625f2716cf1243f6fc4a1aaf6
SHA512 6a4d212e5dc5008f97ad8f35f72d2738eddf09f353ab25fbd2e4b1dbac0e3fdb25f9b1336dc3cede120baf53c9224cd0d3d3cc27941c6896a24cf940104c901b
SSDEEP 12288:bgITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:bgIT+nowOHbDVGnqh5f
TLSH
T16F652390D69F81F3E9A686359398C0A5FD6A78D6F6E024338A2D943B0FB974111D0BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 f37ba90f839d4629eb39630c285da24fb6f1a1a219da0a75e9cd9f375a3a47c6
MD5 e1c669b772889407ed331938acc8893f
SHA1 3536907ca75518edeaef30cdb67dde19e94f368a
SHA512 e99b91ad777b048a6e2c5aeb982adc0eaf0761eec3455c36a3b3ce90e1e4bd04b541f67f69b22d9c349f2661a62bd7890d55900bc8ef959281cd47a31f19de56
SSDEEP 12288:MJITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:MJIT+nowOHbDVGnqh5f
TLSH
T1C1652390D69F81F3E97686359398C0A4FD6AB8D6F6E064338A2D943B0BF974111D0FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d7103e7ebb802a9aba76966d74f29697734bffcd0d659a361d7d4552138b7cef
MD5 6ae88924b5488de921dbc0b9956faac4
SHA1 a9b0b2eb8f3fb20f8c6f65d78da1d49dc43abf74
SHA512 7b8d77b09dd528c1848870093d63dc16baf99ef6bb47c2a442f38c426e7944409fe1d74ff98819ce281f25f3b3a249e6d0e3b186ff8edfb15a92b8954de5f814
SSDEEP 12288:4vITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:4vIT+nowOHbDVGnqh5f
TLSH
T166652390D69F81F3E9A686359398C0A5FD6A78D6FAE06433CA1D943B0FB974011D0BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 9abeecdc3748df57b20d1bea26e92c58b997c6947463e80ab0e0ff5fcc4f6bb7
MD5 2ba6c36e5cc196c77a2500c4a72db347
SHA1 47c5817b4105a3c34c3aadad454d98f6f1659ef8
SHA512 6e6a6633530ef526097592d5cb21eff762779a75eeee89f2ab906c8c11bcbb42eb92290b422b711f5a8e57bd26c431b1daf09e8c1ad7e469327da339ac2c0d75
SSDEEP 12288:TVWITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:8IT+nowOHbDVGnqh5f
TLSH
T137652390D79E41E2E8B7C639C3A9C065FABABCD5F7B065778A14482B0FB538014A0FD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 4320cc31a1b55060d1824e3a3a4fa2c7f0deb2de74b7b02b304db5d562d50738
MD5 0d7d0244ff665340e3ee971911b4c5a0
SHA1 bf553a45869e0ad147166bd0ae8c8c71ad5b076a
SHA512 bb0cf3b30adc40116b64136d74198f65df24ecb7a9fcda30ff66268eb19d39c59292cdb85a7780a76a1c4ff3d30dce9b383824fac6adb3c0fc6e7e74fbed38a6
SSDEEP 12288:u+ITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:u+IT+nowOHbDVGnqh5f
TLSH
T134652390D69F81F3E9A686359398C0A5FD6A78D6FAE06433CA1D943B0FB974011D0FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 af119f4196be2c0f4dc374bc876aa00a65c5d2032d2b2eb50b81f55d90ea6500
MD5 bc72701079dea77df3dce98b4835cbf4
SHA1 71752c1570f484d7a67cd22785718bb3037383ef
SHA512 19af85ae08e0227db767e4b1c9bddbda57f61f550a5373736db4b37281c6366a6a6705c19fdfc89d28a7ea2375bc7de2e9962601255d03bd70689a40f5e865c3
SSDEEP 12288:PFITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:PFIT+nowOHbDVGnqh5f
TLSH
T19F652390D69F81F3E97686359398C0A5FD6A78D6FAE064338A2D943B0BF974011D0FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9506f7cae738ec59d7f0c3dc71e19b0fd3c74bcf0040f3c8ef9984b289bbc8b8
MD5 7f290a427735d75bc748b074d95f8c08
SHA1 acdf3ecd61e7e10de52f0c5f8ecdfc1b441348d0
SHA512 0ef64ffb5985c244dec6b7b7bea6d179adbcf031796629307a3133ac0a8cad85112badbbe4408508fe731d5fb969bac4ea8c9b4e0b8f306d881540b9f5424b0b
SSDEEP 12288:RRITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:RRIT+nowOHbDVGnqh5f
TLSH
T12D652390D69F81F3E97686359398C0A4F96A78D6FAE06433CA2D943B0BF974011D0FD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 77f281688d19ddf5157041b55b0dad056afda243cbea2a1d911db852382d7647
MD5 e3f4c7fae50cd27a09250314e7f36730
SHA1 fb0ff19f1d1d6f8619f3bc1bbef2dc7903439bcb
SHA512 a5d44b2a8afdc92192b851b93056129f9e1b0a711fee131fb83976460e3c24d7046a6b91497e16752d593db72b33e027bd45ae57d75867fa5df273b436ec5cc2
SSDEEP 12288:qiZwb0zzFEoS2cPvypITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:NZMEzFVSOpIT+nowOHbDVGnqh5f
TLSH
T16A850194B39408F5EC67823EC9558916E6B27C5A5BB0C61F03A8362B1F733911C3DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 92febd62a3264a2de6bafbda557cae94e6a1c58e4397aa8cc157c88d3e5a8526
MD5 4e6ea6f7c7727fd8655b2a8d8fa7ff57
SHA1 3f72e7abc4cca7bc110f12e8fb6c2441dde41ed4
SHA512 0bb2cec0818d3f46360dd331bb2a06866332daeb863bc1bf5b1b5a70cf47189b064845fe10e75026a66994d6bbb7c6f5f4c1535be9efd142b00be66a754e5b68
SSDEEP 12288:TUITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:TUIT+nowOHbDVGnqh5f
TLSH
T121652390D69F81F3E9B686399398C0A4FD6AB8D6F6E06433C91D943B0FB974111D0BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 cecf91942d2504a5cb1cad0a899bd6a4d1765ec72c2c31158ac16e779f2722b9
MD5 a53dd7c0235ec316a8123ba0bf2316a1
SHA1 5cede070fe86308390e750d03a932aec8cf6f662
SHA512 620ab8f905a5ef2892d3f8aed54734f350a44965c9b86c27c36063014d854a7820faf51391d645ad6fd245c5e0d3e12a94a5a9ce13025d169ac651a54a62201c
SSDEEP 12288:+YITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:+YIT+nowOHbDVGnqh5f
TLSH
T182652390D69F81F3E97686359398C0A4FD6AB8D6F6E06433CA2D943B0BB974011C0FD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 5a0ac1a145e769f4b33a64ce820c263df2429775a8ac72121949c9204c3ce59e
MD5 e4cf02b9df5b80cc2fe1d4669c9ffbb9
SHA1 21e6bf11234264c8a8fac66c143a9b4c38076b9d
SHA512 ed47a0c09f3b34c12029427bcf5c8c310dfab132a9a556da1c9dd587c713c3ac43782d641dd3af718b81ce030bef83f5442c623ef6050697500d008f7dc257ce
SSDEEP 12288:WyPz5L89ITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:rzy9IT+nowOHbDVGnqh5f
TLSH
T1F3751243B3A620F9E0778238C9A14611F776B87257709AAF4764063B1F773D05E7ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 34384e1e6ca6c98275b5704b7a532c0e61fb0340d0c7c72baaa249d5ced22b4a
MD5 322f3c1ffd47bc497a7598932889e096
SHA1 d3aa38aea34c9a8882dfc44dd6a633f514514d0a
SHA512 390c3a866be2c9da2d81c64b411830f5494b250090fb5015e994c187442b21a9b2a2e9e5d8454e4dd32b5b84aab04950c865df629a49558813cfb79ad0ee6629
SSDEEP 12288:/UITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:/UIT+nowOHbDVGnqh5f
TLSH
T148652390D69F81F3E9B686399398C0A4FD6AB8D6F6E06433C91D943B0FB974111D0BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 bd901e94359bc7389d12d193e84421e194ad76b61e2df578f0ee1937e36ee77b
MD5 5f75f0de7fab59ee05d3b192f8a7273a
SHA1 7ff9b05631debc2c2ef70fd990f41a3c77965cdd
SHA512 1dd7bba8e54e927b092de2df417d0659d90c5d6ed093c5a19928ef2e9a6c1713659ef3dbf5d533f958ae1b6b6cc1429018b64f647a339abd66bbba6c9c7b7875
SSDEEP 12288:DUITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:DUIT+nowOHbDVGnqh5f
TLSH
T114652390D69F81F3E9B686399398C0A4FD6AB8D6F6E06433C91D943B0FB974111D0BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ebe244fc17c9e947b4de54308f67664ec4160664464d7170007de333d35ae5a6
MD5 36d5418cfb5fed3ae02233f93ceac0d9
SHA1 3e3fea0bbf06c0e571524f44374773f1e74e4ed9
SHA512 67d7bc04c0e9f34de5012bed5982ba883173819d08d57bba582213f2c19047e88b0b3f5d37d6278b90da54d33fcac0804c3b604851fb055eb14aa7d83d3f1cdb
SSDEEP 24576:3CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvALIT+nowOHbDVGnqh5f:3CUxPTY+8Wg2lIL8lrIUJLWw+QqowOHh
TLSH
T14265AE1DA3EC0896D4BB81358A518A16FB72782E1B32D6CF2160C33D2F67AD55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 a19d40ea1c4bea726313cf3faceb1fcd19146158b698eb3d9eae337310d3e1c8
MD5 eef42adcafde9e683412d08df1c75743
SHA1 93f303c99c172db3513a613fd2afd597ec2b5e24
SHA512 d015776b234e6d29e77eaad53d5cca3a460ad64e246996bd3f88c1c6272155c0d4bc21a862d4f1f0ff3443ee1b0be71d711f4d22d0faa3355f0c4e07f7a3d070
SSDEEP 12288:EzsfkITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:jkIT+nowOHbDVGnqh5f
TLSH
T1A3750159D29802E5D0AEA239C7958640F7377C6597E0E3CB92D0F83E0F7A6805DE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 72f21338e159248736e3ee5a5345b5adf13eee40930a889f4235144cf2e22fef
MD5 4e9817154d7734600cd778e445e93171
SHA1 aabeb21422938406c8ef5e80abfe9f83e57dcb20
SHA512 3b1741f23c7ca9e32a781e346d8425d4d6c636663b6750b388068da0b57842e5131596ce989a4df7a51d6683d7d0b801e5a1132402a94fe15e33d80db5cebac4
SSDEEP 12288:4PITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:4PIT+nowOHbDVGnqh5f
TLSH
T1CB652390C39E85B3F8B78634536DC034F92FB894ABA064A3D519553B1BB97C059F0F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ad5369ea0b713e86f4c65649aded9abaf4dabf519943c5ff5d5ee4a68d9025cf
MD5 ecffaf3422d41b3f726e3e86c1b54c2c
SHA1 4efcc79007ebe712cd083d2f9e86fa79b44a5fdc
SHA512 9729883b1da5c833ad5ddc97af300120c2bacabf5e5ec1fd7436da6f10c31715b28c23394134be1c2c39abddfaecca625cd675cf47199103b3cc3fb20fd34641
SSDEEP 24576:v8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCtIT+nowOHbDVGnqh5f:0RZwQCyiHiQEaaPnMMQqowOHbD1h5
TLSH
T1AE85B01D63DC46A5E0BAD278CDA74407E6B278165731A7CF0190C27E1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 6ebad3e4815f4c7f04a1324d5e80c86a8610d65dc954987fd15122c6d0c333fb
MD5 6a6f1fd4519a5d87bb7a8153818a88d4
SHA1 9129c4c7b6be1c5bba523000a646371824b25bb4
SHA512 5ff14849127f525be2d568e5803b76706f7a95cdef36f6727ff751e0cd462ea7b8b4c64a48df6a27e9c373c3aefcf415b042e50e0837cf220bcd86f54571373d
SSDEEP 12288:obxA1U7K/ITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:obxA1UG/IT+nowOHbDVGnqh5f
TLSH
T11275116D92AD10F1F5B6923D8A95C105E732B8666720A3EF5095823F0F3BBE45C74F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 53bf49e2f5d86f77cd88b027f1d5100228ecf564772788eae1a9189c8b949747
MD5 c8a1b79b3cfd9cfdb7fc1c882bc64b71
SHA1 e61b027fb0734dbf122ba1ea12e32787a7a2c755
SHA512 8d58b7a603e2b6f600461057fb4776b35683e4c87a8859a8a48d4005fc9230fd8626b65fa0ac7296e2013c55208b5928fbef8d934370c325e53f16952dbee56a
SSDEEP 24576:YjsmP0yHaqrVqHra44KDzMsrnGIT+nowOHbDVGnqh5f:YjRP0yHfVqzlAsrnGQqowOHbD1h5
TLSH
T11D45AF2EF2B910F9D8AAC136454507B5FB71B42D1F209AC70170C635AF0AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 29fec2dfde57e864c3a29467017636c5f783a087225ddccf4d365314ac1e6628
MD5 2b490b0a8549bd0f9ab4b1039ccfb351
SHA1 d34939592bdb8fa23fa9325514f9eb0467f92118
SHA512 248dd1c9b951283d34ae2f6cfcedd4d30822e61016c5f4f7d9e12ec3d3e4a2557f64955302138acf8c9cc6ec1b8be9e31a5cdb859bbb04b0b9f82ca3a0c8b05b
SSDEEP 12288:jlITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:jlIT+nowOHbDVGnqh5f
TLSH
T1726523D0D38F81F3E9B68A399398C064F96A7995B7A064B3842D943B0BBD7C115F0BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 6d48b6b320761d18b8fe67561c90af422233d781b036af11a831ac6f3fb6ee1f
MD5 68082cf2ea2fd6f4750cb4c6a1f8fec1
SHA1 e5c5367100293c749ad1f2fb06ce6b15aec36fcb
SHA512 a75714d7fac76f71e03ed4e95c2a55d5f36d88f015678407439ecc85c5faa137c2bb1e0368620f4a3da80654387f8c12e6b207ab3e192d25b677b627943d1f0c
SSDEEP 12288:xObrA4LWO+vAYFTDITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:mfLBUTDIT+nowOHbDVGnqh5f
TLSH
T16E950154E79900F5EC7BC13CC9A6C516E672B89D0360E7EB03684A6A1F637E14E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 cf570b2a9f1fd23c99e8fc249c22e3c3d39f09b1ff699a793c3bcae8805cc837
MD5 119f6af157445c8f19ec411614487279
SHA1 956208750f3490465869a48d05f49c55e76177de
SHA512 bddaaac74642fa5288e44a2ad6ba2c3914217e9c68c155528ada1770cf14a33f5afff759d55911693a5ac251002ff3b1af17493f00ba03b4fdf61f13fc55f771
SSDEEP 12288:M70VmVIYNvUyBpwITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:ZlYNHKIT+nowOHbDVGnqh5f
TLSH
T1D985F12E92AD08E5E57B917D8AC2C119F27378A6175192DF05B0827E0F27FE87C39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9f543ef23d6f26b6ef83a832951906bec802372e7cf320e6cbd983f3be0596b8
MD5 f4a91df196691ba8da9d2f15d13c946d
SHA1 c206831724badeba5a5d869d066c5badcdf57314
SHA512 a9e01496ca8a8c9382362b434199a773d0ab5092ea05a49ba4cfb1c7dc6f5ac2da3db7659644fd4a45faaddd2488adf13821c8e2eaf9d4911e53762e42aad934
SSDEEP 24576:KnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKe:KnXoJJYH84VVS6AmEcJas+cHBjSSKHPa
TLSH
T19D65BFADA2BC04E9D5BBD17DC5C28506F5B278621331C6CF026182BA3F27AF55E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 286dc4b180e5a044b360b2a335de2c17f4df40dfa2a7853be6aaa31f78c42e4e
MD5 638dfc9e59b6193730dc0a9f61218572
SHA1 7c86dda18512c7de5ddce1dba843bc4d4817f903
SHA512 d367bf9dc7fe12d8fbf1e5eb8cc82ba756e07c44f661bc6b8a4e708d4c9cfd3f9fbda1835e055205e2c8342728fb4f094552c8b2b8311ce9cc83256ecd241399
SSDEEP 24576:mv7Xbxd9Tuycf8M/TYlSuxwr2PCIIT+nowOHbDVGnqh5f:mDLL9TuJ0M/TYW2PFQqowOHbD1h5
TLSH
T129858D5EA3EC42D4E4BBD6BD85B79046FAB2B855273081CF0251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 289f90d988b1eb2e00b97d14a2215c2cad551ac0248abcebcd24ae9ad076a4a7
MD5 cd67dac73a27c42b45671d87025945ff
SHA1 b378f076d40dc845efbd08efd22c06544ed98952
SHA512 e1920b286e99978c591047e1ee7bbdbaed8d9a7b79d76f868652237b30d5f77e4bb447dc94fdc47fad3e78362c0673dc125ed3c93985e792516bb1e330999dc8
SSDEEP 24576:LegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wDIT+nowOHbDVGnqh5f:LngOJOmPOHhDQqowOHbD1h5
TLSH
T1A055CF3FA7BC05D5E07EC17DCA968816F6B1782613355ACB0560827E5F2BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 37c862e220530aeb18acc9501232bf7b6bd4c8ae2e3ef0146ed480042651e319
MD5 12b6cb8c7e01f523907b7a66dbc2f39a
SHA1 a798f15236ebea7e496f010cacc56cf6a2c9af4f
SHA512 291778f66009b3dcc344c71f860a942bc0538b4bd2037a9f12db13de833979efc7c33829e68ce9cc014663a156733c9d62598a8a4e9a4288170f4b3c224fe61c
SSDEEP 24576:8LJnJiTk3R3waE4JrOFIT+nowOHbDVGnqh5f:8LJnJK8R304lWQqowOHbD1h5
TLSH
T14085D07CD2A810E8E4B7C2B4825A5656FF32347C2B2169CB59B4D4353F12FD0AA79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d271e69eaff9703728d9d05e6cbf57e6c15e463dcecfd951bf7be53384d7bf49
MD5 0bbd7124f4aecc61206eeabc95cd8e2b
SHA1 fe8bed19c4cb388e73a4eae8006d6bc339fc1c97
SHA512 7e11c846f8127917a79124f09a6715efdc5a7e53f959648e42a4b2eb947f8cad13fee6f5973d8e20e47272f858195c3a636d847ecf566526e52a20efe54a47d6
SSDEEP 49152:T9GqCzDScAZmlvTcFg8Ph6RQqowOHbD1h5:XqQbwONh
TLSH
T17E955C05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 23f604be17028abb82c39b4fcf8d673ea9c6f9c81b31eda07d8653b5b0d9dcb6
MD5 e127c8b7ba4fe36fe5aed228a7b09348
SHA1 b8ca1ad2b7b19c5d35a855c53c996314f035d801
SHA512 5247e7caeaa7abbcf14fc1f04ae271eaa3c245a3b3375b38807dee6c23215c5a28901c51224aee102ed0f4b953eda834d2cfc21bf0453d0533db35ba27a04c78
SSDEEP 12288:flYJeXm5nkEUuEzITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:flYJeXm5jUuEzIT+nowOHbDVGnqh5f
TLSH
T1A975129CA69D60F1E17A813986A58154F772F0A1635067FF81A4C13F4FABBD12E78F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 0e4b3b3f1667e34f938ee54ffd8639e163174a3245e0035e88c7be914f566112
MD5 573d6dafdb278e9236f18840eddc4c4e
SHA1 8e30a1c643d50ef61012e61806c1d3e38b906288
SHA512 162dbae584fdc2b67abe25afaf92a4085eb776061dd38cd97dafd5f1cec26c2141b7ca5e1b1faa19ed03d0542226334f1e0dbc9929f71ca6152af4f247599cee
SSDEEP 12288:uSu6kymITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:uXtymIT+nowOHbDVGnqh5f
TLSH
T119752340A3D951F1E9B64638D7A2C1A0EE3ABC60AF6056EF4490E63F1F767C06870F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 05cde6c8cfb2ea6a094ffc65bdcaeeb49535692afbc4d2c96c18bfc0d5e2ec26
MD5 da544e5ce083cb302eb6b7f5c8e29d74
SHA1 3fb4295e860d503ca2099f5954faa99d5f3f34d4
SHA512 69b03a5f8b775bd8b11d1272698f73f904018cc3ea3e12b0d9fc77ab66de4ae695094f2cea660cb803bc6f6eaba0e6f2736fbeab8900580890d84a94e3e14a55
SSDEEP 12288:dPDITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:BDIT+nowOHbDVGnqh5f
TLSH
T1DC652398D35E81F2EC7686399369C064F97A78A4B7A074B38468D43B0FB978115F0FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 42a8613c84051e4c12d257bdaaf6daae933307037e3f804ae205b9c8b34fee79
MD5 59efef555307bdaa1df7b1201b01dd55
SHA1 cb2cc701d0f2b3d1363072466e9b6cd7e86bca11
SHA512 ed9332ed51b4a21869a87dda05391e57e15444221870691cf206ea4fcde6976391e70bddf78ae06d2139db18e4a82ca49645d86a7a1e2a2c089beb5d47ca1efc
SSDEEP 24576:NC+TyQIu93VAumZr7jmEIT+nowOHbDVGnqh5f:N/TfIq+YEQqowOHbD1h5
TLSH
T176558D1DA7E919CAE176C675C8A34493EA33B472137196CF2044C07D4A9EFE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 ee5a2e5ec3fd859abf63d6c09c52ea84c8bd7e352da95660f1c4023dacd67141
MD5 8e797072c0035551d0f2d3148590455a
SHA1 3ff5575bbd547948035ce6c12bb4a49b9e33349b
SHA512 c3fee795a01d515155e9245efbf2355f748481b4b6ecb2a8a0236b7ee18202d5d0e1da870820d67821963cac8d595dfa9a60c7e9f17c9471a2490a5d4e432b21
SSDEEP 12288:ccyrWOstaa3kcsnITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:ZLQikZnIT+nowOHbDVGnqh5f
TLSH
T10475F10EB3AF00A2E4A7C23C89858151FAB37471575167EB42A0C77E0FA76E57D78B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5a95ab3aaf611b45eff57d5ff643b88e439aa6cc21db0f67d1d09b7d04fdae21
MD5 a5313711dbd2843696775cd9c6cd110f
SHA1 8e08ef14648cd42e844236b3a1a1c88dfb9c3ddc
SHA512 07d56b2eaaed92836e42b3eaeee79f72241ee51b37e356eb407961f7856338344fdbf108ece58e0cdbbca976093f491ca18bf9d3cd259792c0ced015f8eeb561
SSDEEP 49152:UpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPmQqowOHbDp:VpC7b4+80GTk5QbwONh
TLSH
T14CA57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a8f95a1872e7416a15c78de677f13ce1ef6b0afdcacfc41a2baed4603f907d17
MD5 880a6909cfb0c42bfb94193b212b0f7a
SHA1 59ce6d1e9e947870fcfec6c1be93d2a0388e068e
SHA512 efd08f1043452e5ec9a66bc99510388fb4914d2a5d403c8a16dee82881c375e33025be41dae536755dfbca832ae7614e057aab20baca3a67eaa50c352421c359
SSDEEP 24576:MSAwJPE1IDAo+4Kt+l44135UQeIT+nowOHbDVGnqh5f:MqPCIo4Kol4/QeQqowOHbD1h5
TLSH
T1E755AF29A7F946E5E17ACBB4D663C511FB727822133163CF8290813E0F16AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 eb93ad18fd6d83345398d138ff2e8ac3134cdbd7c0923f807faeb6a3076adfdd
MD5 f2bb1143373bdbf8912bde11a53bdcc0
SHA1 511aa81806ec066c8611093df35a302f665e8ba9
SHA512 65025d329f95aef2c14235389c54c46fc3a08e0654de0b229dc2c4eadb5bcca0814225a282a5fcbed16368feda538829a9b8345ada0d81b85d47b43c9396e02f
SSDEEP 12288:jSsyLCFBoPLCRyF6NQ4tOITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:nyLXPLcG94tOIT+nowOHbDVGnqh5f
TLSH
T11195D03ED66D04F5E47AC27CD2A38506F67238AD037166CB09A4907A1F6BFE46939F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 b92c6e5b4c99baeba7cd2c485a851baa4548cb5ee45e2df5a99b6346de639b46
MD5 5a358a22e310d04db18efda06506d5ac
SHA1 9618cb9eff9a8c62f7d71763602902a7a393b379
SHA512 e5b7af19aae7fec2b947b2106916373d7a5ac87b28f452c4edb54861eed8ed884cee77a98e6c8636475ac461a25350f73dcf0a7f28e2b7245979eea62823b5a9
SSDEEP 12288:e9lyvj3IkxjbBz3ITvGRhou2+uUibZylrODldDRdDi+F3lJi6/gqEOTlf:eWv8qjp3IT+nowOHbDVGnqh5f
TLSH
T17775129D93D850E5F47A8234D266C125E4B2BCB227A0A9FF60D8D83B0F79BC09479F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/384-354-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/384-135-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/1584-129-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1820-186-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1820-192-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1820-202-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1820-391-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1820-222-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1820-206-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1820-238-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2308-170-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2308-169-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2328-94-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/2328-96-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2328-173-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2328-88-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/2464-371-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2464-138-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2464-147-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2464-144-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2660-131-0x00007FFF7F780000-0x00007FFF7F989000-memory.dmp

Download

memory/2660-35-0x00007FFF3F810000-0x00007FFF3F820000-memory.dmp

Download

memory/2660-6-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/2660-561-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/2660-562-0x00007FFF7F780000-0x00007FFF7F989000-memory.dmp

Download

memory/2660-525-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2660-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2660-13-0x00007FFF3D2E0000-0x00007FFF3D2F0000-memory.dmp

Download

memory/2660-74-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/2660-29-0x00007FFF3F810000-0x00007FFF3F820000-memory.dmp

Download

memory/2660-7-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2660-128-0x00007FFF7F780000-0x00007FFF7F989000-memory.dmp

Download

memory/2660-31-0x00007FFF7F824000-0x00007FFF7F825000-memory.dmp

Download

memory/2660-51-0x00007FFF3CC70000-0x00007FFF3CC80000-memory.dmp

Download

memory/2660-32-0x00007FFF3F810000-0x00007FFF3F820000-memory.dmp

Download

memory/2660-38-0x00007FFF7F780000-0x00007FFF7F989000-memory.dmp

Download

memory/2660-27-0x00007FFF3F810000-0x00007FFF3F820000-memory.dmp

Download

memory/2660-34-0x00007FFF7F780000-0x00007FFF7F989000-memory.dmp

Download

memory/2660-36-0x00007FFF7F780000-0x00007FFF7F989000-memory.dmp

Download

memory/2660-30-0x00007FFF3F810000-0x00007FFF3F820000-memory.dmp

Download

memory/2812-122-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/2812-118-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/2812-194-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2812-116-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3184-72-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3184-75-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3184-112-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3184-79-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3184-66-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3596-389-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3596-178-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3828-160-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/3828-151-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3828-157-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3828-386-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/3856-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3856-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3856-42-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3856-146-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4312-113-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/4312-99-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4312-177-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/4312-105-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4516-416-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-420-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-425-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-424-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-423-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-422-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-421-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-398-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-419-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-418-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-417-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-405-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-415-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-414-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-413-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-412-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-404-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-406-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-407-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-403-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-408-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-409-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-410-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-397-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-395-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-401-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-411-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-396-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-402-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-400-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4516-399-0x000002D2FD180000-0x000002D2FD190000-memory.dmp

Download

memory/4588-55-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/4588-159-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4588-61-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/4588-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4656-24-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4656-26-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4656-18-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4656-111-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/5032-40-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5032-78-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5040-84-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/5040-168-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/5372-174-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5372-388-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5564-201-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5716-14-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/5716-110-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/5740-392-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5740-205-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/6024-133-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/6024-254-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/6024-390-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/6112-387-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/6112-164-0x0000000140000000-0x00000001401C3000-memory.dmp

Download