27ef2dc57aeb6e2baef89e2cb9e054b6ecefa9a740a43f39cada48d488aa63b7

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
Size 8.3MB
Sample260420-pc8cesdw6x
SHA256 27ef2dc57aeb6e2baef89e2cb9e054b6ecefa9a740a43f39cada48d488aa63b7
MD5 1d051bd4fa554cad5011b1da7431b3e7
SHA1 53a7218065ec2601462e364c97984e435d739912
SHA512 e485e9dba0962b536297ac351001412ccd148e2780632f4dd2ffb1c2bcbff202f695310d6e89f9b018193cd3411f9794f6d737197c863557311c7188eb59e171
SSDEEP 98304:5YOrRn+os45gaHrh3w3D7nTsReRR9669CEN6rV:L13w4ReRR96Im
TLSH
T11C963A4677F455E5E1B7C2B489B696B1FAB2B8951C34E70F1061821F2F33AB09D2D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
692	alg.exe
2812	DiagnosticsHub.StandardCollector.Service.exe
2808	fxssvc.exe
2172	elevation_service.exe
4424	elevation_service.exe
1108	maintenanceservice.exe
3212	msdtc.exe
3916	OSE.EXE
1424	PerceptionSimulationService.exe
936	perfhost.exe
4796	locator.exe
1900	SensorDataService.exe
2184	snmptrap.exe
1236	spectrum.exe
2924	ssh-agent.exe
1096	TieringEngineService.exe
4108	AgentService.exe
4448	vds.exe
3160	vssvc.exe
3560	wbengine.exe
3544	WmiApSrv.exe
4372	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2ce057647932a944.bin	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031e07afbbed0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006afe3bfcbed0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f3994fcbed0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000910c06fbbed0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b24c4afcbed0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f87851fcbed0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2812	DiagnosticsHub.StandardCollector.Service.exe
2812	DiagnosticsHub.StandardCollector.Service.exe
2812	DiagnosticsHub.StandardCollector.Service.exe
2812	DiagnosticsHub.StandardCollector.Service.exe
2812	DiagnosticsHub.StandardCollector.Service.exe
2812	DiagnosticsHub.StandardCollector.Service.exe
2812	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3860	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
Token: SeAuditPrivilege	3860	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
Token: SeAuditPrivilege	2808	fxssvc.exe
Token: SeRestorePrivilege	1096	TieringEngineService.exe
Token: SeManageVolumePrivilege	1096	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4108	AgentService.exe
Token: SeBackupPrivilege	3160	vssvc.exe
Token: SeRestorePrivilege	3160	vssvc.exe
Token: SeAuditPrivilege	3160	vssvc.exe
Token: SeBackupPrivilege	3560	wbengine.exe
Token: SeRestorePrivilege	3560	wbengine.exe
Token: SeSecurityPrivilege	3560	wbengine.exe
Token: 33	4372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4372	SearchIndexer.exe
Token: SeDebugPrivilege	692	alg.exe
Token: SeDebugPrivilege	692	alg.exe
Token: SeDebugPrivilege	692	alg.exe
Token: SeDebugPrivilege	2812	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3860	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
3860	2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4348	4372	SearchIndexer.exe	105
PID 4372 wrote to memory of 3552	4372	SearchIndexer.exe	106
PID 4372 wrote to memory of 1296	4372	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_1d051bd4fa554cad5011b1da7431b3e7_glassworm_mespinoza.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3860

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2020

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4424

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1108

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3212

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3916

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1424

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:936

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4796

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1900

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1236

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1720

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3544

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4348
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2816 2608 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3552
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 724 2812 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 892bba5c2e859aa05769f3dad8c7e794f7919d58baa0780800ca082af4f00e61
MD5 b97e802f9199816a099705470a70f027
SHA1 83c55fef0953e651fd32d463b6844a1b8823430d
SHA512 7ac5f0a7ee307cdfcb0698954f6c06e649f910966b46da28d9dc4dae48610a31d125777441c82f26c0159b125dbb7394ffab5abf1b7dc09ca004266ca360deb3
SSDEEP 49152:hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn46ZU6CENlc7dpJLrQWd:n3q6HjBz69CEN6rV
TLSH
T1FDD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ce7f16be34d0f3baf72275d51a8998a371f46315aa3e33ad02a85d1ef70dad77
MD5 5d1a728a685b725fd81796785de0ce2c
SHA1 f28d32066b46beb75f17d3b4f7b588c653eb332e
SHA512 3698cdc83ac5cb8b82981635860eb516e63871fe0ca317023037ee4ea849b86f93ec983e937bf14f0b21ccb9e55b09d48a2ddeed4ea1d99c168f7aa340b6d0c2
SSDEEP 24576:QXYfDtczAo+L6VMRCPU6CENltmVVdpx7fLrQWd:ntcC6ZU6CENlc7dpJLrQWd
TLSH
T18365F12867E409F5EDA7427CC8A2C511EA33BC954760EB9F03B4992A0F336D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 87ac6e2b807d820d73383883a854fc8f5611564b78a56aa7269307035ab691b8
MD5 f13324db228edd2bc121415cd40da593
SHA1 1aa4289bf9e6c01de3cf077849d5a6668b9b5b03
SHA512 52c75062566e30f41f017b61a3ef29f53720d6693bd16aecb78d16ea016f5e542569dce456468d1cceedc827a8dfe7b611bda39f5720afca41abb46c82ef83ad
SSDEEP 24576:B0Le5ji0hmxirMz+L6VMRCPU6CENltmVVdpx7fLrQWd:BPji0AcF6ZU6CENlc7dpJLrQWd
TLSH
T14485AE26F6744731D073C0B9C5D2A69EED7230865B308ACB4286D77C2F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 971e0d521eda89df83285b9933a04cca289ee6a207397eb563400dc862c341e6
MD5 7c32ef37a1db30ecc6f073ae05321daf
SHA1 863aff3066f86f541a42d7c0f4b8f3b77ecb1c9e
SHA512 72ce72d50cd1a351ec96b0f0154f4d3ec2ae80301d67e70e24c3229850cb32effbe36b89b089e272f825fee813e38e702545f633c03696e00227758465b24610
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWE6q8wyu1+L6VMRCPU6CENltmVVdpx7fLrQWd:Y/ezSC6vUzPvxHjyZ6ZU6CENlc7dpJLL
TLSH
T10D755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 28a489bc1b15bdfccc9e3a1fee752660ab32b00491cd33213349a8a619cdb7e3
MD5 c5f9689903ecc327be0381210ef3eccd
SHA1 9a9356a54f484e59109cefe4535b02121d192122
SHA512 48987c9676e9aef3dd8202b7603883b02af6a67b278b84da2f97b3c1715d1c6e76eb1ba3c29383a53a1aa3c905fafe503c8baa1a69b91a1bffd2f28faba3dca4
SSDEEP 24576:CVbqPb88hv/l+68+L6VMRCPU6CENltmVVdpx7fLrQWd:CVO88hXl+k6ZU6CENlc7dpJLrQWd
TLSH
T19655AE66F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0bf8f0411c831c681ac72e39a81748e853dec1a9404d75f090289ffba2945fb0
MD5 2ce72b7185928e149818832bcf9f0840
SHA1 9ca6671942203c5f0becc6e92b2e9dc1e3511dbc
SHA512 85613d57ab40ade07afb268b4e89e8f504f9da7b2d8425edab198c923e029a21cc9000441098a17c4f67c44a1357bc5c56375a32702745fe0439346cebf06762
SSDEEP 12288:zR88+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:zRX+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1DC45233187642D62DBF40238E1E694F1AD2AACC55B406E1FE3767C0F0D398B89C5B22D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 475d83aaed91bf5948c405346d3159c0554f686221af586346f68b91a8c67434
MD5 280705911576dcb581de89ecd9cbbbd7
SHA1 1f4b7095926f0ba086bc98aacde36bc8a907d346
SHA512 0af86cfb2533ef3bc87afe47cb81d16ceb505241f5cca0f34a93f277777f4267186d2457a36b8076a440f10131ce66c4a1dc5ab35739d363e84ef8b8db53dcb2
SSDEEP 24576:hJIUE+L6VMRCPU6CENltmVVdpx7fLrQWd:hJIU76ZU6CENlc7dpJLrQWd
TLSH
T1CB65CF3BEE28FCE2C27A4DB85A91C640E77278704F51A7CBD175820E8E235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 403a706f3ed78c8595cbce1ad76febf01a62de9a3e0a95e269605181f3a061ce
MD5 e9be443e4ed5cd4af956e7133a6c0a1a
SHA1 a2b3cf3f6dba63d841e79541bb904e8a17089bc6
SHA512 c19804d9786a4447e8daa7909f8fef92c02206ed9e32dd97705019e1687092d5a44d757edf913a1e9132876d7c82f55af1fc00b520baa1c29cf54714f2806c72
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:3QvGAdlCEL8c/yRNw5Ci69CEN6rV
TLSH
T12B266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 abc565fa65d35bd0adc8d737c5e0b6f894a798bf255f0b59334d40203b491955
MD5 7fbde195982e1afb9f13931bc36fd999
SHA1 b42cda3f295c2e57366021850a589b02365b2399
SHA512 842ee3e232cdf5ece09df2fd03facd89346c76ffe4a2922c18b9947847657150bfc1b89947e57c9342c1f6c5593b93762edc7c92fde4d10114dea58d662069c2
SSDEEP 24576:+dewsAjm+L6VMRCPU6CENltmVVdpx7fLrQWd:2ljV6ZU6CENlc7dpJLrQWd
TLSH
T16775E031FF74E432C3BB0DB61B36C716582DB9604B511AC3E3A89E9E49342D12776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3c2989269652481a2f1a9b725ae86618255cb432a2ec3263728eb053970e5234
MD5 fe67090aeed23bb9b0734696480091b3
SHA1 930517fa975fe55f8c354b4d598ba6cd5e7bdcbe
SHA512 ea35cef3d08bb65cb1d71574a93c6f426cc630f17882ca575e53da0f31d96996f6c303af9d3732729f1b3a58a0c3aba380c7f85e99e689d42226c72294e38988
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHdIm:1UEtQevvqc2W1cpV2EI32O
TLSH
T1D1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e3c444cd26ee6cba3d4582d5042c37e27ea72741ec492d9277f698ec33438b97
MD5 c5aece69b847335c664b6e9aee671272
SHA1 0fca3860103bbc0f1449c6f90c964e07114c03f0
SHA512 7092a5e586bb3a92e8546bbce5442a8932b69c501eabcf53b42f072b9769182a01e259e872f05963d185fc9cae0cb7988c66aaded17f99f073462c4b83a88b22
SSDEEP 49152:1CbRquA/m2yL5zifFiV+XenmE3/z16ZU6CENlc7dpJLrQWd:ioqHVjnmm69CEN6rV
TLSH
T109D58E1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4266461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 73b482024753646d106308a6ba2d010cac4c94af670b0b595f1981130d81de8e
MD5 91eb5b59d45d10780e171c2d3b328874
SHA1 ffa1df710d1a1977ac2d56902e2b74e4e9328bfc
SHA512 864d512af00a6917c71f404d522053bf78d116b4f080cdb2168d9525600d08e9df732768fb72ed323f4c8929ed17f329a8e9f73b58a3057227e5db28c669e878
SSDEEP 24576:gAhGLJIFoiwtA5l7S53x+L6VMRCPU6CENltmVVdpx7fLrQWd:gAMyFoiq526ZU6CENlc7dpJLrQWd
TLSH
T1C7359D81E7F955D4F5B3AA7899B68171EA76BCAA5E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d5d312575ac82e9fb7b56e0e46b0729e1f5ac601c529db21f8b2f3fd50fd81a2
MD5 f6bc25f369db9b5676cb1cda98c18f67
SHA1 0c6f25904fa89d1fbe3bf12a554f9e273c89f130
SHA512 75ddc1815acedb2f40eb514a0b4464ebccd3923cc5a0ca453ae25412670b362593b769635125152d48580f63a438dc806a313e2ea07c8150fd51d6d3dc14ba5e
SSDEEP 24576:2wuoOWC+L6VMRCPU6CENltmVVdpx7fLrQWd:2wDOq6ZU6CENlc7dpJLrQWd
TLSH
T1B365F15667A41CF9EAA64238C597C136F7F2BC422A21DB1F5370C61B5F37260AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 32e33186cea768c5b64af9ff9a6ff2e1f97aea9cc98d45b9887b67d4c7edfa19
MD5 5bd1677256556760409d4b88cf103660
SHA1 5afc9da91c6f0e777d43c62f26d63cfaefc0c5bb
SHA512 cd3cc4a3311f95a2421587fbe631f5a029fcccb46880553d8a859ca38f7af21cc50917eb0ca5dc2515dd4c0a0370fb913952613d11defd7513e8d22c758d477a
SSDEEP 24576:sZu7+L6VMRCPU6CENltmVVdpx7fLrQWd:e6ZU6CENlc7dpJLrQWd
TLSH
T19955126A13E434F2E2E2023CD9E29655EB72BC96273147CF5235565E0F37AE45C3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1b59a0d727962df9661db9a3054ee5eb7c4f42cd270a801cab736079be5d6873
MD5 3c3ceb902f90a94840d15068cf887c97
SHA1 4940232fb24d749caee71025d2c1e9197b28018f
SHA512 7a0e2a5499676db46fd9709c10c63939b48c6956c5d3a4dafa2aca3845b5579e1e67cc57612baad608201c9dcd107d73ba3248b7fa4f0ae6a85bcd792c6e0199
SSDEEP 98304:eQRQyi36YOcPQLvw2gAf+PN3v69CEN6rV:FQyiKayX+PNfIm
TLSH
T17F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 37ac2df1a6dfe092396d450a5b18dcf3a6398211f8b3cb77474d663c090ada69
MD5 fa3f069da478ce43b342ed855b50eea9
SHA1 19da371c3049abe09f17fe568fc8192b5e079693
SHA512 769d9a3c466284174e0822c4f6c0634ef4f9999381285b7a80ac677b2e4385ae44cf4ec89db13ce0bd8a2a6651df5ebff8aefb350e98ed6e9ff55a52fa0c77ed
SSDEEP 98304:IQRQyi36YOcPQLvw2gAf+PN3v69CEN6rV:fQyiKayX+PNfIm
TLSH
T1EE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 91483fdb160b42940ebfb9d3b5809b501b707628699a886dffec743b860a6cc1
MD5 5646a544df23945242d238ddce0a40c9
SHA1 6508763d41d2a94f17bc29d8f4802d04e1146605
SHA512 8ad6b70cfb70d328795ff588556fa0f201ecc391b9b534b642fbc98f1c7d12c95073c5235b06b066ef70975c6e82c2d5aa78b2fbc776e61fc0409f893ccac82d
SSDEEP 49152:w68Qg55nhheWu7PNU3/F6ZU6CENlc7dpJLrQWd:qthWRc/F69CEN6rV
TLSH
T1F2B54933B2F600A9C44DE1769F46872196D27C758FE0E7DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 afd2dc524bf8cf3ea4097159254689ceec2a3818d087a449f9153b453eb76d22
MD5 6cd82e8be909681edd5c8e1f46c63e37
SHA1 aae19cdeae8c3c5b6574feef9def6acd027e7df8
SHA512 493a5dbc8e93b11f26576678e1701ef046293259f86a6d87312abc2ddee9af7ddb905027c6d39304ac6f00dd258602244b51a8b977c3164e8d7928ac1d1a7afb
SSDEEP 98304:oy5112gYy5azzVvL69nLKnhZM69CEN6rV:BLIHmWhOIm
TLSH
T1DE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1e8cad0be6cf19bd512b92c6aa788fb680b716d716e4dccbf9b2c66a9260a984
MD5 7c7aca2d95848529d3146eedeaae1e56
SHA1 893718259a303f0687eae9894fcd4de64c685638
SHA512 2fb515d789de8520d81f411b553a44ad3f3bc6a9877a46e7ec0188115175c0f732d253ec19e997ba0abc015616a052177a99e285a7c089a80a4b2cabf4e3c1b4
SSDEEP 49152:0B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glH6ZU6CENlc7dpJLrQWdx:uu6JmVxd2dH69CEN6rVZ
TLSH
T124D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cd2c65cb22fb4ae3cbee8a7c3f58c4aae5ad56bde33a118f67d1e3810aa51d33
MD5 e90456865acfea45361d0632d6562876
SHA1 4dca3cda950add562ad124b1c80dce86be16772f
SHA512 3f9fc31d5bb33325c90f5b676b3e9c7755a1c19c95316666cb3b622a1c126126815311547bfa8c7d7e4ca0f0f9f23fc64e058bf55b412e8fcd0aece9a08283ab
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xb6ZU6CENlc7dpJLrQWd:nmifPbRm69CEN6rV
TLSH
T151B5AE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fbc3664e920b2a6c8371f18faf7241a6bc84fc20dca4d509fa4579aac3f9ed87
MD5 e3a9a4ac87c3907b848c4733ae0ef6f0
SHA1 3166bcaf596b99717c0773d61c46c71c059ed21e
SHA512 20acdf351e271d15036f36e841430c8904562924ae2a516d1b22b3a5c7da6e64a81cac91599e91eb719f315f972e344d5cee1c90ac21a7e65a466c0c884d5817
SSDEEP 49152:ESuZQIY0Be2KRRVtOnks6NMHqI6ZU6CENlc7dpJLrQWd:W5dKTi61I69CEN6rV
TLSH
T104C5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 464f54937aced1893d41734853fc1f30bacb7ea8c1a5ff7481035da03b122bee
MD5 c18d01daf40021bfb7b156a560315764
SHA1 9c9ae9b282937cad350b5b9527c00ab896ad8a45
SHA512 06ae9e407612ff09c32e09f383d3ea69b84d4d520a7d277cdc7306d098c4efa741e1db560882b0737bf5388ad164109f4af4ccddd5e13ef851a7bd92190c687c
SSDEEP 49152:nhtSn8EApI0figngiDn0AP5wX6ZU6CENlc7dpJLrQWd:2X2iyphK69CEN6rV
TLSH
T18C95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 75aadf52baaa3b7eeb68a51e607fde1f47ff099a6ddb3968e1dfa97d0cb7c9b1
MD5 23ef82e3aa078bb57835f3c775b01d9f
SHA1 6c977d908148de0f5d7f31ef226a6adb82be45e3
SHA512 c685c7efea7c2115536a4528aff4c13d2d985ac294578cfd359b68d4fdf35fad7b3b2ccd58cd586c5e9803dc2b3fe7b0cda2bfc83ad4d69d6ed90eb679455913
SSDEEP 12288:fk8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:ff+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1314523358B6A1D53D7E00278D1A291F5A95ABDDB7B001D1FB37B780F0E398B8185B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e02b201987e7d2b5c6a17356894d36887c0eaa33a4feb51ebd7c0177537ea2bf
MD5 cd431a1e2ff8badde4d26b8b8bac1055
SHA1 770e0fca4a0da2f64845337e94868d6eabe07ba7
SHA512 14067f57c6df70dc1ce55e1913bcfa384190bef25faace0b90ef0be362b4a8549bb904a35ac1db850c86760c8e0070d3d5bb2db8049a57c68ea3345258f2f98b
SSDEEP 12288:/p8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7X:/6+L6VMRCPU6CENltmVVdpx7fLrQWdX
TLSH
T1C64523358B661D52D7E00278D1A291F5A95ABDDB7B005D1FB37BB80F0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 223dc94c298b5d48af8b6b4b831e0ff0166b6f7cb3da8060cf6b356aab1e0253
MD5 fd21d1b0e5483e77a2f36ce03dde3772
SHA1 ddfbbee14a450d9896e1e65bb39916157a774fd0
SHA512 024a612dc08dc47c24e2262258208be0b3d1ada1e987899b4139a752755df41235a55e374b3ecc43fcab1899b2b9d0754c4bbc0f9a28e4f107ccc5af60670e5a
SSDEEP 12288:h38+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7X:hs+L6VMRCPU6CENltmVVdpx7fLrQWdX
TLSH
T1A24523358B6A1D52D7E00278D1A291F5A95ABDDB7B401D1FF37B780E0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 5aa8189a32fb4d20ed3412a56263018877ef7710c13b398fcb68b2c97ed071b6
MD5 33e2a26a7fb493bce744c5591d1c693d
SHA1 3df9d3bb1fc12ea992486875c7701ba7e4f53cca
SHA512 7f687a8f0df3657df44dc606a91aae4d308f5cf1147b180da30d1136a45a03b4ecc532ddd4d60434a0a56ba178d53c6df3775d7ebda95e67636efcbccb37571a
SSDEEP 12288:3VK8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:f+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17945233547B919D2D7F04278C5A291B1EAB6BCD6AB105F5FA3222C0F0E356B45C3B728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 095772227c8cd8c8735cb5b4ae7d793a559a8e8bf71a4065396af25c6e33b264
MD5 e907c81427f4ab3a40225ebff2a6626a
SHA1 4b1813744a6fa3067574aa1837bc93df0290a4dc
SHA512 b497c1ce6957f76d18be46e2bb5811c83521c5cb3028c03eaa2dfeee7e4c86dfe28d4253fd87af63b3ee10cd3e3a6189c6d7b0ff9b99e37f0cbece6b30d8e62f
SSDEEP 12288:MC8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:MJ+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1F14523358B6A1D52D7E00278D1A291F5A95ABDDB7B401D1FB37B780E0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 81259617226a6479071e3512f2e54bcc5a26bee84d5b6f33ff5662659c07027f
MD5 9d800ed4fc4c889608d565718ce979cf
SHA1 630dadc6b9f1c83ffdab89d3ae5eb8d7205b46c6
SHA512 f91aede786458e651baf0f65728d9bdd26a857d17c627a1484da2ef91cbcec87f86a36da40bcd757bacd829df0d6efd92df3b583b527041d7559526e601b317f
SSDEEP 12288:9V8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:9u+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1384523358B6A1D53D7E00278D1A291F5A95ABDDB7B005D1FB37B780F0E398B8181B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 baebeeff42fe3cdf51e70730b4045a1274e88ca495590be017c64042eab87a13
MD5 2c2c6b6872fa07109e5209c542cd4692
SHA1 752ebce851b69a5597af3f4f80b61000a96734af
SHA512 2f05304e48a24eccba9a65098d357127f996f1d776fc2e58da418f7a072387dfa158b72a739e719882c7d82338389e03d32bc38684c7069e3a07e066d7e094b8
SSDEEP 12288:nh8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:ny+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1A74523358B661D53D7E00278D19291F5A95ABDDBAB405D1FB33BB80F0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ab4552e6ace15aa9cc5cb03b3213388b018a3b8263852dc28b54500681618c52
MD5 96b1188794bd840b3549f83fd308e872
SHA1 64e9494ec6aeaff9bd11b490f3c80421c079ec89
SHA512 5a082a2844f1a3b97dfb415360b8cef8e7231f261d75104d4c273016cc6b5217668f236227851b96598feff195b32a7bdc2292e43730f6416908ace302ff27b9
SSDEEP 24576:WZMSzFVSOa+L6VMRCPU6CENltmVVdpx7fLrQWd:WZMSzf96ZU6CENlc7dpJLrQWd
TLSH
T15E650265B3A01CF5EDA7423DC9658956D6B27C5A1B60CA1F13B4362B0F333A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 981c8142b6ee259f0d580288ec64e1cde9f72f91c8ee4cab19a0bcefaf63e7b4
MD5 1c60b2b83f1ce65305cc4cc8bf87e260
SHA1 f24c332b35c0a473cee4b772014eeaaa7ac45f55
SHA512 638424790c07d5abac2e554363a8221c5dfc37ad41fd6582283e5b3698e5871fd638710b68360f9ffa332ff977eeffc4fc33c7f95f0471b078016a5579d125f6
SSDEEP 12288:uI8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:uL+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1194523358B6A1D52D7E00278D19291F5AD5ABDDB7B406D1FE37B780E0E398B81C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 19487daa7c98cc9bbf7155ab2ed59a4fee852868fe82ec18aa06348ed3a97694
MD5 9305b6e2506b3157efdab748577d517b
SHA1 5274c03a919d0908ef30204537d2bb166e129ba2
SHA512 3ba17d3f4f379ce901287f7f162865678fd3cf6e8ee9df398ef2889ba823390c698c910d9d9fc6adc76fe7be3b88cadd38c03f58dabd1485109a8e6542668b3c
SSDEEP 12288:rs8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:rn+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1094523358B661D52D7E00278D19291F5AD5ABDDB7B005D1FA37BB80F0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b3c63fb6f0ea22c5aa06516d0902a8bec72293d7c193f3158bd4f76ba3f782d0
MD5 31fbae0ac4942a424274731663872d5d
SHA1 e151bb282b47433c81da60cb45ba5d8b0728ab22
SHA512 ea9235fdd9a2f99e06303c43e4c4f67171894fce1d3a3bafc91de2e9bfc400562ea3b42209cc403ce77fd265e70e53171d395a6f9c0421e61c2d098f0a755ae8
SSDEEP 24576:hzy2+L6VMRCPU6CENltmVVdpx7fLrQWd:hK6ZU6CENlc7dpJLrQWd
TLSH
T16E55021763A530F5D2B64238C8A21A52F776BC761B208EAF5364563A1F376E05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6936fb8f2eb8544142338cf99264a1c6ed40a10aded6df3480c04d98851ea9ab
MD5 a30a1b44a84c8dd1d65476183f0616d7
SHA1 4829046578e17b39ce174a3f67487f840cf6c710
SHA512 35982b18b8a39156fea14dacbd23492b977e67bea6ed6fb076185c1579d170214e43ea33a87f4a7d9ff69dad73220f6454d740c15382d76d3115adb06cc61d51
SSDEEP 12288:hI8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:hL+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1BF4523358B662D52D7E00278D19291F5AD5ABDDB7B406D1FE37B780E0E398B81C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4b301b1d33ba151b769bfa5fdcd5a9a221d8d9ac28011f02db2987d199736b2b
MD5 664f34d1fc275dbc8ed2a45dd09eaf10
SHA1 2f4abc6738bd6289bdb455ac582b0db8e1094e66
SHA512 e03e20f63129ae9cd1120a1ba955c730c623ce98f1cfccb9e1df3a73a2dfaa948161e1ae023f252c1ec5bf40978bec7bbd8b86a7f5566bd9d58b51f0bc79dbbb
SSDEEP 12288:DI8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:DL+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1404523358B662D52D7E00278D19291F5AD5ABDDB7B406D1FE37B780E0E398B8181B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 fa9eac7449e9d57745a34072277eb6f5d3e7ca8677ba48e6a577cf670fb16589
MD5 2007615312830aba6e2a5e757ff8d2bf
SHA1 0a44fc54a169a5ad183e4336033d1de86cd333ca
SHA512 a9d877ba90d3863dd1042b66e4556be0e6cecf8f7112ae48353c4388deac76e1f79584c9a5be53859f3273088900754dd64b287cde646245ee9394993f7a97bd
SSDEEP 24576:Azy2+L6VMRCPU6CENltmVVdpx7fLrQWd:AK6ZU6CENlc7dpJLrQWd
TLSH
T1A755021763A530F5D2B64238C8A21A52F776BC761B208EAF5364563A1F376E05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 11bbf9531f4147d06f058381046a91ed7611521c2ee032b2eaf1a2a050ba2f9c
MD5 01b74e11994d26305e3673c00046692a
SHA1 aeeff5d1df708fec74a5de0598d5a07a5da62486
SHA512 8d732aa37ea0e88b63c53fcd6084a5d1b6f7cf24959b3806a33ff4b0c7b289c4a3989f9b75a70cbed2634694064d9535138bd487f71d17a4a2331c70df053920
SSDEEP 24576:QCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAA+L6VMRCPU6CENltmVVdpx7/:QCUxPTY+8Wg2lIL8lrIUJLWwu6ZU6CE
TLSH
T14565AE1DA3EC0896D4BB81358A518A16EB72782E1B21D6CF2170C73D2F27EE55E39F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 392ae9c94b0abd659a238293cc551ccfdbb720ccb55f6a7785c0379c5bb0c769
MD5 19c7fe719bcc87e0739540baba7afaac
SHA1 bac31227ffd7f695c2f9bbd0dd9b3a81c6ff194e
SHA512 d24d3086aafaf348f562181ab3e8462aa77e757ecb4951fb38730e8001e164b63cc6274aedd04689057c452a06043d5f6014e95c43924671ff963cf8cc9302e5
SSDEEP 12288:kNsfY8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:17+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12955F019C3A812E5C1AE2278C7528651B7337CA597E197CB63D0F93E0F366A05DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 196c77a86b95e7a8e63a4f7fb412218b1e87cefae5c1ff674f7c6a33d3c6db97
MD5 fb4e85bcf8c3c418ed97e16bfd155703
SHA1 446fc4b0c99bf69f67f083baa1f2a420de873f1c
SHA512 4538f1ce9419c9bd535f3342d6aa42bd3a1436d907db05f07d04d3986f863906f7a643a2c498cf24214b4fa8460e81efca7bca62c648754283a93ad198dac707
SSDEEP 12288:oX8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:oM+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1C845233187A92D52E7F4127890A6D170692EBDE96F009DCBF226790E0E398F45C3B71D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e8a2c0a734c9a7115fe3c814e4dcee1ebaf863fcac4bbf74258252beca6a1c3c
MD5 ea6f3f40a11b45810309b8df96854c46
SHA1 8ace163a763e971b7b308d0fbdce57b92fba3718
SHA512 7551447acc11635fb8d407a38c6ce62acf23ecbf01baf671f174c4ccf58f9660cc8f2adab051f388ff3a146bfdc7bfed48aa86e9936b888717f048de481fb63c
SSDEEP 49152:DRZwQCyiHiQEaiPnMw6ZU6CENlc7dpJLrQWd:l9xPPx69CEN6rV
TLSH
T15485AF1E63DC06A5E0BAD278CDA74407E6B27816573197CF0291C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 6a778083220036cef8f96924a324ce9e9297438d7417c06067718a1244697311
MD5 24c57d72b4283886faf9f34dd4cdc91a
SHA1 823c65e73ed856b3feb846a25ab10bddafb00f57
SHA512 d33750ec38c3eace97d0abc1649757f7e9e996396915d02c8d64fd483b8aaa39d12054bf7b374703c3ec1c95e920a31090f89cee83c158487e544398d048adcd
SSDEEP 24576:MbxA1UGc+L6VMRCPU6CENltmVVdpx7fLrQWd:MbxA1Uk6ZU6CENlc7dpJLrQWd
TLSH
T11555023E57AC28E1E2B5913C89D28105D732BC56272097DF61A5923E0F3BEF45C3AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9689b2531ad1a801880d924dde5e03a10c893e6ac269feff37dfb787a50ee998
MD5 40dbaa367193f846052cef7cb4aa42b9
SHA1 d86afa200b479080778238a58db06af28637155f
SHA512 46a836eecde306a8bb3c1e72fb236a45d7de10958f4fac31fa28794bf146bf74ed6ff3675ad39877e29273491367cc24f8e78d92c935f8428e0245aa7374ba76
SSDEEP 24576:jjsmP0yHaqrVqHra44KDzMsrnh+L6VMRCPU6CENltmVVdpx7fLrQWd:jjRP0yHfVqzlAsrn26ZU6CENlc7dpJLL
TLSH
T1E645AF2EF2B910B9D4AAD136454107B5FB71B82D1F209ACB0170C635AF0AEE89E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 d7e2ee50589ab5a3d98c7ebb91417ffa19fd63b392e397ff015e5339469f43db
MD5 1ccbbc5fb68be4f6d5bad528bb941072
SHA1 2015886a7e8b3d8ea94b106a1ca7e86de60eb5cb
SHA512 b8f349516f4aa89c68f9210090ee50e374403843624da6d7974d775992d0833bf30fec595914bd4dce733930a3fd6609544581c71720e49c627b58c3538059d5
SSDEEP 12288:m18+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:mO+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1FC45233487692D52D7F40278D1A291B5A91ABDD66B001EDFB277B81F0E398F85C3B21C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 4a1439cb5e04b54ca2f6941834fc16379e4ea52819be6ec2a3b2228542e6b547
MD5 ea33c6baa2db984ccaad64650572bde7
SHA1 9afcd7fb05f6d15fd305b074c0eb4687dc1ae285
SHA512 dd025cb0c8b7f0d16819542d23c1533e9bcca0df540f8f4c5b1ca77a2c5e3bafa28d86eadd97f1d87b8e6f0d7a657d13cdf90661adb01c20fef0aa770cc47dbe
SSDEEP 24576:FpLBUTo+L6VMRCPU6CENltmVVdpx7fLrQWd:FpLBU76ZU6CENlc7dpJLrQWd
TLSH
T15D750215E7A404F5E977913CC9A28526E672B89D0760EBDF03A94A6A0F237F14E3F710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7e3bb1ce2ea7c6326c47dbd87033a9721a92d1a0d9549ec7346eb6a7129ad33c
MD5 7a176fcc0ffc4bcd2e4fb80b7f6fe013
SHA1 e0b2bd3fc5a35e6990a4955d67d6c79ec0aad27e
SHA512 ce02b73e01fd4086af9d737e8fcff5c9cf19202b17c0390db0ab18f4e78a7333182e5caea8ffe9a8d3f448bbab59c7fad3740cc526bd56f7aa803de7cf987726
SSDEEP 24576:hrYNHN+L6VMRCPU6CENltmVVdpx7fLrQWd:hrYta6ZU6CENlc7dpJLrQWd
TLSH
T11565E12E52AD1CE5D67B917DCAC38259F67278A6171196CF01B0827E0E27EE87C3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d3ab3db529c477b5004be23f02d4d559265d2d77c42bdc9535253d7bd6ce9426
MD5 4ae86cbb2e743d560223305afc5f0665
SHA1 ea60313084f9211b7a98bc376485939018e016b8
SHA512 ba99139c7f32e9e0995ece6c3361a9058c7cd77f23d8a57c942dd392b4643d9ffbb01c17f7c4d1db4d2ebbb9cec0b2faec2feb8b18704e5a0667284a46f7c637
SSDEEP 24576:znXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKd:znXoJJYH84VVS6AmEcJas+cHBjSSKHPt
TLSH
T1D665BF6DA2BC04E8D5BBD17DC5C24506F5B278621331CACF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 60192135b4250f1115d49216ffddca9b6a2b1e05dbb565bd1f0457de1491cefe
MD5 f61e9edc36bd2d9e081512761cc84c45
SHA1 c82ceb627bd33223ae4fa988190c664f1a0f428a
SHA512 40abf7b6cdf7f87dbadd01055eb10b5af777d64fccad22be6eebb52e22c5030abe694c6a43407760327ab6bc7b2aef729600eba4925fcf92f7a29caeeccb7668
SSDEEP 49152:MDLL9TuJ0M/TYj2Pt6ZU6CENlc7dpJLrQWd:Px69CEN6rV
TLSH
T1BE858C5EA3EC42D4E0BBD6BD85A79146FAB2B895173081CF1251856E0F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 bf4e61506b456276c657bd2adb8549bde0485f131166806c05020ae7ec6f3ee0
MD5 809cf1b037ec8de8c14a2d031102df20
SHA1 28ce0e63886e14d81938b6e0e366653c8e2dac4f
SHA512 d6044c785bfd6cc9279a50b60628bd8d6d5773259825515fd786e3f82498cb85dafd05325d3c647e2933a6dbbb02222b0da3fec4cf49d326640078c2e84937d8
SSDEEP 24576:BegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wo+L6VMRCPU6CENltmVVdpx7fLrQWd:BngOJOmPOHhX6ZU6CENlc7dpJLrQWd
TLSH
T19455BF3FA7BC15D5D07EC17D8A928916F6B1782613255ACF0160827E5F2BEF42E3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 ab3834383b2a0cfbf537faf320d857c9f23ad634afc6a6642b17bc0ce428470e
MD5 ecf322ca4c949a0e261482c03abaafe2
SHA1 94f486ac7643c9f82ddf4559b9b896d7172edba4
SHA512 996953fa40f83ff8997e726923324605e4663dcdaefe9b573c0f6d403ec39ad437681a3852ea592752108698484af1bab8c642e266839bc1e97a3863656bb6a2
SSDEEP 24576:vLJnJiTk3R3waE4JrOu+L6VMRCPU6CENltmVVdpx7fLrQWd:vLJnJK8R304lm6ZU6CENlc7dpJLrQWd
TLSH
T1E775D03CC2A810E8D4B7C2B4815A5796FF32386D2B2169CB65B4D5353F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 977280585bd7c4506d182733ceba729f067778427ffbccd38510956660a970e7
MD5 e07b0284e4ef99f99a0cb462abb55397
SHA1 f068d908d306957aeec65ae14e09d9964e3c5538
SHA512 d367aa538463799fb548c8fab1cb1838a82df7d868daf1079e5f1b66122b43b1d40b581dbfa010bd4f73d6380204f00d463c885388676f2d0719bdf13a5f396b
SSDEEP 49152:R9mqCzDScAZmlvTcFg8Ph6p6ZU6CENlc7dpJLrQWd:V669CEN6rV
TLSH
T179955C15F7EB5294E8B3CAF1C96294159B327C409B34F7EF0A80C96A1E32BD1D939B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 d5d663b3f0b8fe31b6c7df06d9b5c078b6dfc724724ecca65616211aed77ba35
MD5 5d887896baa55674edeee60e89936216
SHA1 568f47cbb4507a31d5377bd92ca42f7ba17d9377
SHA512 f687af2a2deba2550feb0d4749ea6a117adbdf4509e60751c0a329c0887593bfe9cccb8a03e6a1d6e3129724d25cc620949e901abf04ff8314d3790e23eb7826
SSDEEP 24576:4lYJeXm5jUuE4+L6VMRCPU6CENltmVVdpx7fLrQWd:4lYJeXmRUuEn6ZU6CENlc7dpJLrQWd
TLSH
T1B755122D67AC34E1E2A94178D5A28554E372F8A627016BEF52F0D53E4F379F42D3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 0305b1ff7ecc6f39c2ff4d379315cf04e745566308c9ebb3c9db2161e046273f
MD5 75ef1e8730add2c8d25536dad69d92de
SHA1 bc6dc2e958260336b1c685c443b74d05eb251653
SHA512 7afe0e54ac7078d54a6d6501ace3ee79c4d78d88c266e9c6039522d2d1c2a53ffe7936023cb3639f7106ea9ce205ac9299f7b95028ec092710af15746ff346cd
SSDEEP 24576:o7tyB+L6VMRCPU6CENltmVVdpx7fLrQWd:o7tx6ZU6CENlc7dpJLrQWd
TLSH
T11C55121453A429A1EBF50238D9A381A0DE39BC615F105BDF61E1FA3F0F36AE46C36B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 840988727e51e5d816c70f761ba5ed060e88b8fc0aa56beb0695ed74af89ce06
MD5 302a91eca56c7fed2e0643b54cb78b93
SHA1 6da1e89f633c88b86947a20219c703d734b258e9
SHA512 ccefa88c228d3e2a82ab42dcbcf0d64d8918af2aec6fb8bde20067fca16e2ac657149c51fc2b50a720254202037a58d559a57311438469fb9a253a8dc2d0505b
SSDEEP 12288:vP78+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:no+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1D645233847653D52DBF00178D16291B1A56ABDE56B002DAFA2B6F83E4F398F45C37A0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4c63dc1a34989cb3034f85ef2b5e3e96522764d6e263abe9e17d2ee60d362e37
MD5 5ac8724e6c4b7981ea3f5ab60d4a37cd
SHA1 79a59649232b6f3642580df65cc772f559d6eeee
SHA512 67090bc0d37512b74f2a0e7cedd39df28a99e57be183715efe234be0a8a3fd236496da41f351949e8cfac29547ca9ca2d159f58467a0b2437734a38a98065b29
SSDEEP 24576:SC+TyQIu93VAumZr7jmb+L6VMRCPU6CENltmVVdpx7fLrQWd:S/TfIq+Yo6ZU6CENlc7dpJLrQWd
TLSH
T1BE558D1DA7F91DCAE2B6C575C8A34493E633B872136196CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 3b5bf916cd92d82439182510cbc7bdaf9e2b8cfaf2241535b5ef154880ba0beb
MD5 4ce04f2e555d482979a60e13c31ea6d8
SHA1 51699db1d0b59b53fb5689e5b56d30f6b53c85da
SHA512 4643f573c1888b560eb7d7240b8283ad544617731fa7c9bd8d9eea9f002b749fbb4bdf41549cac29d97346a4e336d94772b2dfe20efe76056c2185d90be29b62
SSDEEP 24576:QLQikZ0+L6VMRCPU6CENltmVVdpx7fLrQWd:2QikV6ZU6CENlc7dpJLrQWd
TLSH
T10A65F11EB3AA10A2D1A7823CC8864152FAB3B875571267DF42A1C73E0F775E97D38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 971495e05f86df0b6cf17eb08d9695dbba26ea91f243e506b3fb1aafe8be0043
MD5 879dba2ad35f4e964de99b4ac57e57ab
SHA1 244fc3773749e24004d5567d8a829ffbc227d51f
SHA512 a5d6f62202f0fdafe2cac49a51df18e529647738d71f62cda714b35802975c14c2a44433a415bf8fdd47a7b10d58955fa3e42c5f366ad635c98ed0ccca8fa4b9
SSDEEP 49152:gpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPW6ZU6CENl0:RpC7b4+80GTkR69CEN6rV
TLSH
T1C1A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 021e54675166ce345bc69832761b5219eddfd22707d6c19f9e43396239501c56
MD5 cc6e991dd8d1be2be3681f1d7e8dcebc
SHA1 46eda21fb1c131a66107c1752eebc40002033206
SHA512 bf2e9e0bd38d6b190c287c46ef8d0d4b99f5b7de96cbfc2a9712faed6c5b5414adce80dc2d58f4f214e5b3bb6ea67325df830ef83bec8f63b870f81520d57668
SSDEEP 24576:LSAwJPE1IDAo+4Kt+l44135UQp+L6VMRCPU6CENltmVVdpx7fLrQWd:LqPCIo4Kol4/QO6ZU6CENlc7dpJLrQWd
TLSH
T12C55B02AA7F956E5E1BAC7B4D663C511FB727823133163CF5290813E0E169E85E3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 2f50cabef8d5d47e52026e583de920e0adeb7752e7b612028f4f3ba33afd55ab
MD5 92707575dd350c4e771bc568ca8f6c61
SHA1 aef45fb414ef8f243c69a64f3eb3b2ecf5f8f49f
SHA512 3dc382bcd86a794b0c9b8c123c527c6d8d3efd417fe8aeb402b8225b326cedea1ccb1c313d1ce0c1c7b4857bfc333e129c46c473dfcb8952bcbd3084b4029f81
SSDEEP 24576:gyLXPLcM94t5+L6VMRCPU6CENltmVVdpx7fLrQWd:gy7PoLte6ZU6CENlc7dpJLrQWd
TLSH
T12275E13ED76D08E1E57AC27CD6A38506F6723CAD033166CB15A094791F6BEF4693AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 be9f8d9a3cccb0507abf343f2fe71cacb50719ca1509250dd066215d9f87c436
MD5 49d8f8016be6a46c0dab48f53d0d203b
SHA1 96a7a048a9852d891919ca507d3a2ae4120de434
SHA512 643a8e50c8c5ede66ae050fcea5eb85a15fe4296c502d277c1c4578dc77fa78c69d8c9351d72720a43407ee4fc1e7bcfb75de0082784a7014a84bcff6148c53e
SSDEEP 24576:YWv8qjpk+L6VMRCPU6CENltmVVdpx7fLrQWd:YWv8G6ZU6CENlc7dpJLrQWd
TLSH
T1F965122E47A428D1E1B80238D56281659472BCB627606EFF71D9E97F0F35AE0983FF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-23-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/692-24-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/692-440-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/692-15-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/936-286-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/936-144-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/936-139-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/1096-325-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1096-207-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1096-201-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1108-87-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1108-98-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1108-100-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1108-95-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1108-93-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1236-290-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1236-179-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1236-185-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1424-132-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/1424-282-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1900-529-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1900-158-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1900-164-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1900-531-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1900-288-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2172-63-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/2172-69-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/2172-71-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2172-532-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2184-289-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2184-175-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2808-110-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/2808-112-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2808-57-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/2808-51-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/2808-60-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2812-38-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2812-528-0x00007FFD46B60000-0x00007FFD46D69000-memory.dmp

Download

memory/2812-48-0x00007FFD46B60000-0x00007FFD46D69000-memory.dmp

Download

memory/2812-47-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2812-32-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2924-191-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2924-197-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2924-324-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3160-242-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3160-419-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3212-108-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3212-102-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3212-285-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/3544-429-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3544-256-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3544-262-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3552-537-0x00000254BF480000-0x00000254BF490000-memory.dmp

Download

memory/3552-538-0x00000254BF480000-0x00000254BF490000-memory.dmp

Download

memory/3552-539-0x00000254BF480000-0x00000254BF490000-memory.dmp

Download

memory/3552-540-0x00000254BF480000-0x00000254BF490000-memory.dmp

Download

memory/3560-252-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3560-246-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3560-428-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3860-29-0x00007FFD06BF0000-0x00007FFD06C00000-memory.dmp

Download

memory/3860-44-0x00007FFD06BF0000-0x00007FFD06C00000-memory.dmp

Download

memory/3860-477-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/3860-472-0x00007FFD46B60000-0x00007FFD46D69000-memory.dmp

Download

memory/3860-453-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3860-454-0x00007FFD06BF0000-0x00007FFD06C00000-memory.dmp

Download

memory/3860-455-0x00007FFD06BF0000-0x00007FFD06C00000-memory.dmp

Download

memory/3860-456-0x00007FFD06BF0000-0x00007FFD06C00000-memory.dmp

Download

memory/3860-457-0x00007FFD06BF0000-0x00007FFD06C00000-memory.dmp

Download

memory/3860-281-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/3860-1-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3860-9-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3860-30-0x00007FFD06BF0000-0x00007FFD06C00000-memory.dmp

Download

memory/3860-14-0x00007FFD042A0000-0x00007FFD042B0000-memory.dmp

Download

memory/3860-28-0x00007FFD06BF0000-0x00007FFD06C00000-memory.dmp

Download

memory/3860-0-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/3860-40-0x00007FFD46C04000-0x00007FFD46C05000-memory.dmp

Download

memory/3860-42-0x00007FFD46B60000-0x00007FFD46D69000-memory.dmp

Download

memory/3860-46-0x00007FFD46B60000-0x00007FFD46D69000-memory.dmp

Download

memory/3860-50-0x00007FFD04050000-0x00007FFD04060000-memory.dmp

Download

memory/3860-41-0x00007FFD06BF0000-0x00007FFD06C00000-memory.dmp

Download

memory/3860-45-0x00007FFD46B60000-0x00007FFD46D69000-memory.dmp

Download

memory/3916-438-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3916-122-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3916-116-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4108-212-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4108-224-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4108-218-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4108-221-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4108-223-0x00000000004D0000-0x0000000000526000-memory.dmp

Download

memory/4372-267-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4372-308-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/4372-534-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4372-341-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/4372-292-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/4372-430-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4372-273-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4424-533-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4424-85-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4424-80-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4424-74-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4448-226-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4448-232-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4448-326-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4796-154-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4796-287-0x0000000140000000-0x00000001401D5000-memory.dmp

Download