b994f2fb30e6ee75af23ec28ebc3786dd1d52aef303a389bd79d27e79ec96555

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Size 8.3MB
Sample260425-yscecsbs9m
SHA256 b994f2fb30e6ee75af23ec28ebc3786dd1d52aef303a389bd79d27e79ec96555
MD5 9a03f4cbda2e44bd524a3af2f453ec8e
SHA1 716d53aedb38e3dd6ff0390e04d2922df271c1cc
SHA512 fbd8a7db49f1eeceba58b5924696fae8c24724428d13c7956d430afae5f7b2e510d0596bfa81481355fc04c3f266265085d674c55c7f600ab66c98f3d9f74934
SSDEEP 98304:7YOrRn+os45gaHrh/w3D7nTsReRR9ot2sEE5:J1/w4ReRR9ot
TLSH
T10A963A4677F455E5E1B7C2B489B696B1FAB2B8951C34E70F1061821F2F33AB09D2D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3188	alg.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
1448	fxssvc.exe
2516	elevation_service.exe
404	elevation_service.exe
4120	maintenanceservice.exe
220	msdtc.exe
1184	OSE.EXE
4856	PerceptionSimulationService.exe
3820	perfhost.exe
784	locator.exe
4864	SensorDataService.exe
3512	snmptrap.exe
1524	spectrum.exe
1628	ssh-agent.exe
2876	TieringEngineService.exe
1604	AgentService.exe
1664	vds.exe
3748	vssvc.exe
1884	wbengine.exe
1688	WmiApSrv.exe
3504	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9a8af63989fac755.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000974cb2a6eed4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6961da7eed4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063298ca6eed4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4352	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Token: SeAuditPrivilege	3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Token: SeAuditPrivilege	1448	fxssvc.exe
Token: SeRestorePrivilege	2876	TieringEngineService.exe
Token: SeManageVolumePrivilege	2876	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1604	AgentService.exe
Token: SeBackupPrivilege	3748	vssvc.exe
Token: SeRestorePrivilege	3748	vssvc.exe
Token: SeAuditPrivilege	3748	vssvc.exe
Token: SeBackupPrivilege	1884	wbengine.exe
Token: SeRestorePrivilege	1884	wbengine.exe
Token: SeSecurityPrivilege	1884	wbengine.exe
Token: 33	3504	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3504	SearchIndexer.exe
Token: SeDebugPrivilege	3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Token: SeDebugPrivilege	3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Token: SeDebugPrivilege	3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Token: SeDebugPrivilege	3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Token: SeDebugPrivilege	3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
Token: SeDebugPrivilege	3188	alg.exe
Token: SeDebugPrivilege	3188	alg.exe
Token: SeDebugPrivilege	3188	alg.exe
Token: SeDebugPrivilege	4352	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
3768	2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 3180	3504	SearchIndexer.exe	106
PID 3504 wrote to memory of 2984	3504	SearchIndexer.exe	107
PID 3504 wrote to memory of 4572	3504	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_9a03f4cbda2e44bd524a3af2f453ec8e_glassworm_mespinoza.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3768

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3188

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3984

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4120

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:220

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1184

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3820

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:784

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4864

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1524

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4504

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1664

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3180
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2852 2848 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2984
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2892 2888 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4e07b6f9401d9719eb06684c8101617981a0de7ddb8b0a3b84768fc04dc2e0e3
MD5 c3bff35477831feae88e4b1d31049c3a
SHA1 6933e3498b7b74face2035c86a710b68c6f32e2d
SHA512 8fa1ec031ed561cc26ad27614371d1c26b7445d81dfc8434375f1ee25cb0ba2cccaaeb945a112a1d8711c07f62840256063b3847dc458a0d1d6366a29c3e0ca5
SSDEEP 49152:Ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxn0t2r4PRSEk1ul:Q3q6sjBzt2sEE5
TLSH
T1E2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 9d49eed161bba3e2b876a1ac5750da6fd7e584fe8775aae1aee0f0dbd3ec2a5e
MD5 5f99063006d746534136f27c0056bdf0
SHA1 53cb0e602bfe6a44417192187fce7d88e86f05db
SHA512 b283be945e7b2fb7bb0773345a5fcbde555937c57d78811d17f50cb8f1b5c5f072fedfa34fbe3951f2ae7fc1885ee318023fd7ff2baab44b4910c63da8d3cbdd
SSDEEP 12288:f1XLsswWkxy2lRq2czAvUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7a:dXYfDtczAvt2rR8FfBhRJUEbDk1ulUZ
TLSH
T1D305F129B3E408F9ED67827CC8A2C511E6337C4547A0E78B07A499391F336D85E7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 53b49af41553fce1519da3e31f852149d1ced3271a17a0a29856ce28a278a5a2
MD5 6fb7dbca493cff017308c61e81267d1b
SHA1 0b34a8d136ff99dee9855c37bfa6f7cfdd12d9dd
SHA512 1c166c4a0ef461c74686499832582daffd410034f50819d924098b7cb93707c267c2cbd812d3bb3a22a89164b8e5491cc7e7b64692a6e558ae441e58e1dfd269
SSDEEP 24576:60Le5ji0hmxxrMst2rR8FfBhRJUEbDk1ulU3:6Pji0Ajxt2r4PRSEk1ul
TLSH
T14C359F16F6748731D073C0B9C5D2A69AE97230865B308ACB4286D77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f4031329eb7a5c46794f88ca962ec8b30c27715164f60ddf486d7ca52ba39278
MD5 24ac842a9cb1fac97889a4a8aaf7faef
SHA1 c5bc0ad388341093ad8ae876bb47169c20413836
SHA512 844918dc3fcc0c44a0de2ff377adbd603518e27bd10bb241871e862d8debde721d6d3b1ce3a1afab8601288e0363b1a077414d84a501ad3dcaa6e5dc87e81298
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWn6q8wyuit2rR8FfBhRJUEbDk1ulUu:e/ezSC6vUzPveHjyNt2r4PRSEk1ul
TLSH
T16A755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 17f70e8801aa5428ae8ba40a7c26df61a5d4228ff971abe48c7c42218b1643f1
MD5 8602de14535c944be1cd6be0cba8cd0f
SHA1 715396517fc35f118f1d02796e047b8c5d17ce68
SHA512 d209ee3ce43536278002f3f863a6e53c7fd5ad0d7cc5ae368de32859eb4f79415c1a84641b9a47f5a3b3e4c980ac6c195ff2fe8b84775dcf503462353eda9c09
SSDEEP 24576:pVbqPb88hv/l+YDt2rR8FfBhRJUEbDk1ulUe:pVO88hXl+Kt2r4PRSEk1ul
TLSH
T16C559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e0633254bfa742193269c943d9196325803e71b6664058b57e50da15b4e4455a
MD5 fb4f9910f4d28042938645237d23ec61
SHA1 1a19ead4c2d1f5c2afdf14375486d60376a9ff4a
SHA512 a2b5d4d480ac29eb7aa8a6e8ee338d60af2e52fefddedcc5eeb3f97baf8251a41523aac4aa10663950d90fff55ad56c5ec7432baaf77f0a33364484c0bd3a6e0
SSDEEP 12288:CLAUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3F:CLAt2rR8FfBhRJUEbDk1ulUV
TLSH
T1D4C42312F3A848A2F3A74A7478F6D72114122C893FF5AF031D60693E25389E5F5F96D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 eade339ed7b5673c04383c089dd0828224c8b6d5f2ae382715c1963af7a48799
MD5 80a703ded9090d93392c89710eb24cd8
SHA1 b6388cee7f0ffe8caaf4b5ec8d2e2503d63f184a
SHA512 f04bee580150d8b87764ef055070098cac800672fc2f26e02659be58619f13e83f4a9b225f861d4ee01a5f4c735f4542da52cef2ad50d2a53abacd48b55f1dc5
SSDEEP 12288:KeBNUbTVO86U7UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3u:KJIU7t2rR8FfBhRJUEbDk1ulU+
TLSH
T16505CF3BEE28FCE2C27A8D785A91C700D77278704F62A3CBD165821E9E235E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1a2f562cfb3ffb031c513cd9ca3264a2d84b451f24e650c0851a2603399b47e6
MD5 7e36c5e9431b25077da21a148253e4c9
SHA1 c0032d03b03d644670ef256c9dacac4eccf72ab3
SHA512 b838e34aa6da1648413ef3682209d91b2b99704fdca5bf07b32091df940173d1638316ee313a0e7497225679b4c55e17705fac55038f95d015450d0354dd8dc5
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH/:2QvGAdlCEL8c/DRNw5Cyt2sEE5
TLSH
T14F267C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 ec8ddf25628141dfe3f17e2caeb5f9cd023ed9eeeb89f5a415fd5ac37e604e8a
MD5 e7681310bd416f531946226d156462b8
SHA1 18e966d4a5f6e2e8ae8970c6b5f60a3596c0f0c9
SHA512 2166ab821092d6020b064ef13e51d35f3943048702d6b4c8c5fdbb9224317389b73279a997279cea8c5279434d7f9e06f0b04097bb101237a006023ed8d424c9
SSDEEP 12288:aAwSfxL/2Dc3RDLLmt0LDQewsAjBUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH71:v0ewsAjBt2rR8FfBhRJUEbDk1ulUW
TLSH
T1DF15E031FA74E432D3BB0DB62B76C716142D79204FA11AC3E3E88D9E59302D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7ad56503b7d5d7f7dbbfa4974233a303e12d2bd987397fb9c1e05909cfcf5148
MD5 12c8a92e5a87226a0a3184ba646b2210
SHA1 fec844068c1df027bd87c3f379430cc79d6a53a2
SHA512 3dea0757c063b8307da5e1bc09974f8caf4de7af5353b2ad85377e337726824fc3fe38fa3f775e14013572d0c243170e9665ae0901242b9be36fbef7be208619
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHpt:NUEtQevvqc2W1cpV2tI32
TLSH
T11A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8857861cc9d7cd70fc006adcf29134e82c6c72175d9bfa0cc17218ec85526106
MD5 f5d6b8c020246332911859652ce74e0d
SHA1 7d222814789e0edf3a0912ade63655f9a042bd37
SHA512 16fb8adc8a2841ae4e40074203c586f59afff6e9a45ed6a453b1679e0883f3b3737dae86d5b778f1c6dbf00e2118781321796681db4f14b7791446c956e1b093
SSDEEP 49152:YCbRquA/m2yL5zifFiV+XenmE3/zht2r4PRSEk1ul:RoqHVjnmOt2sEE5
TLSH
T1C0D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5658d57a0591cd8985426e478c83af28cf7a9dc1178df7b8ecc1b212ee5a49d5
MD5 8bd6c297741a53f73893e1212569b82a
SHA1 e302a39485795e83a364035bf0f41ad3e01f37f6
SHA512 7d6396ba299bd9f9380bce61a06f9583a37f5aa4b755fbef8b77e8925993afafc8d70b3a08f4697cb62bc05c82d44d127a536667de69e3f829404fc6de1a815e
SSDEEP 24576:0AhGL3IFoiwtA5l7S53ut2rR8FfBhRJUEbDk1ulUy:0AMUFoiq5et2r4PRSEk1ul
TLSH
T1FF35AD81E7F945D4F5B3AA7899B68170EA76BCAA5E31C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 51abd0aa229d76279ebef4edb3af9e280869b0d10ed441ffada8ccfaebc93aa4
MD5 ab57c63608e311a26b9a8300b44691ea
SHA1 4814d50690250d82f8b8332c8c1ebdb68bbd4b90
SHA512 014b265f4a75d93aa57b48f6845bf60c682bbb8f5c731d671334acb43ff52276e7133ac17edfe7e2c9dfe49c29544bf0dcb0acb7d7514c05fe4a098a17663c77
SSDEEP 12288:7mw5HEjsChNVBFgl0WDm+CCUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1ra:awu4OWtt2rR8FfBhRJUEbDk1ulU6
TLSH
T1E905F14673A40CF9E56786388597C136E7B2BC062B61DB1F1760C62B2F37261BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 68aaa05f903e43a79204a89aa03ab9aa32ffc88abe72f0db008bd98674722936
MD5 ae61c398753633afaecf354880364d43
SHA1 fd7dd2ad8919455d060de5cd72b286f1b1b4f20c
SHA512 62044380729408bd267759ea4b36ad72708b7f009c4b880a7988fbfdc5baf6d29593171b0aa64ea1cca97a4b889ff176aba7bfec2d09dea78db7e524ebb02ec9
SSDEEP 12288:JeZ1IyRUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3G:sZuEt2rR8FfBhRJUEbDk1ulU2
TLSH
T143E4125633E820F6E2A34638D8F58705D7327C462B7287CF1A60463A2F32ED56D79762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dc6c1ca4f02c7f08fbc8f740bfee3eb8cdb32216d3de9d9a425b698eef1cba7e
MD5 3f4c594d3e9b9a94290b117509f8f98c
SHA1 f09a206caf5fa53fbdca1f164508858044d9a94b
SHA512 383c8bf34b8ad970cb003af3cee608a6289528ea4e1e2011d0dc5b673758202a61c17101c279a8dc212583c37cccfe0c057e4fcdd4207543af4614aa557c8a10
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U7:nQRQyi36YOcPbLvw2gAf+PN3nt2sEE5
TLSH
T19A666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ed2f555ae443e7be44587e1851c05abb2883ef4500ddd2e109ff68709482179e
MD5 ad41c39bf802eab971f500645972cf67
SHA1 28e1f373752239dbaa304a19f7e9bf0d2dc372f4
SHA512 130175035f68400367614a6aa84a3a88dc32b63b3271df2d7bba46d2f98bb00c786f5544841fed614bb1e5f5252cbff136c7db2f8a6af2789a8c4899633f082e
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U7:RQRQyi36YOcPbLvw2gAf+PN3nt2sEE5
TLSH
T158666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f61c48b8d57ca26af11299f7ab2f680382d6553abdfbe6bf721c764f7b6f130d
MD5 2408c903f7d1daa983d68834ae45be77
SHA1 6e78427eb0ea77c514d87c6daa08ae069490a17c
SHA512 578e26d96b71853721e6a6e459e96f0e079f92d25a5eb6d611773d223644d4ad0472a883f2dc6e434a2c502073626e56dc724c7ff46d65033dd7d61e85fd9fa7
SSDEEP 49152:Z68Qg55nhceWu7PNU3/xt2r4PRSEk1ul:nthLRc/xt2sEE5
TLSH
T1B0B55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b915632d4511698a3df4d2b52ddb148c8ced8883689fcfa87ded0494f6871902
MD5 089b7d40205591ea314b10a6c4612b57
SHA1 660265105a2b696f775a1c4d6f6c19f2f9ebf6a6
SHA512 b39eb4a93aa536607c8fb036b804c55e79762c0f5028df995dc42443029c8374a86c928655c758976d008aa6875e598c9551af61d4924d291157165d3234e57c
SSDEEP 49152:03aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99h:hy5112gYy5azzVvt69nLKnhZAt2sEE5
TLSH
T191167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5d3e01ed63f9e52fbf31a57f3995916686cc3dcca8f28039f4be24cfb0272d11
MD5 823cbf5f61298cfd5c8989c429b7e480
SHA1 737774d4eea398733042bfb683f69d9a78c8514d
SHA512 e75e65e3aede81f315d9a23ae926cfdf19ec94a56ad8cd13f565c3aba6e1424e0b70890c1b9f6f474fbb2568de2f5cf7e9a6f0dd03eab244809c4916e2687577
SSDEEP 49152:6B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glft2r4PRSEk1ul:ou6Jmdxd2dft2sEE5
TLSH
T17ED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 90dd0c60f6b00cda144c944ded8ec68d8444cf8f3a184b7585cc7b8b3f063e6d
MD5 92b2c609558aed66fb7efc190a09db61
SHA1 19b53f44b85ec8fb1761c95a85ff76b2399efe99
SHA512 e2fd8e258a7d4003cd8d5f58dde4ffcc52fddc2f7b18f5952b803c49d0d122bdae9d4ed746ceab22b1dbddd1e75ce6c292a9092d3c29415ec9308dc54c4be554
SSDEEP 49152:Q1hpsNoJpF1A63U44CwH7R4xbt2r4PRSEk1ul:QmifPWROt2sEE5
TLSH
T1EFB5BE13F2D801E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7b4784ebce998e8160089c9cd18c833ad5632948159148f07e0792e5e40a8477
MD5 ac3905588ec9e8edb4df9907392da304
SHA1 4361b0e2bc1316aeaad1861f7cca684e937f9a5d
SHA512 842f85a747a1ecd6a0cd0bf2cab605fb0ea87055147a920d97c7f874f423b6edfe04b87e702d2e5248f4d86a47ca9856b86c737a22d579ed5deb9fe3d692d404
SSDEEP 49152:BSuZQIY0Be2KcRVtOnks6NMHqEt2r4PRSEk1ul:P5dKii61Et2sEE5
TLSH
T1F3C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 014eb36e76dd66277e7cc90b7d7c98eceaa4a2bace70af0c1f24940fd0f579ec
MD5 e95211a009ce74064736082cf3cbba8e
SHA1 e4e7b03bb7b9dd43b0d624710096fd13d4c5ef41
SHA512 4dddbfbae8b9447ea6917a319c97d06398dc484c9841680c19840ae72c5b4442946bd19c2beaede83d9de5151ef3bb628faf730d57a80f11cde6370b38e55db6
SSDEEP 49152:VhtSn8EApI0fig3giDn0AP5wvt2r4PRSEk1ul:kX2imphat2sEE5
TLSH
T18A95BE13F2D900E8D05ED178C7568632E962BC060B35BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 7dc51f0fadda27c6b39c2f1c63406212f6bf881305080b68402155ea7aa4dc7e
MD5 19b9bebe68f1dadd714cae5ec50a1815
SHA1 a790a42f7b4081b42d89ea263320dd19ee668a28
SHA512 cd34e6e9576c3163035bed247420574df02a637dc23faaf59e87e16c923bbf48e8c5bb434f050ac7575412464054a856334017641720cbd456d2bee6ae06aa3c
SSDEEP 12288:gYUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U39:gYt2rR8FfBhRJUEbDk1ulUt
TLSH
T114C42312F3A849A3F2578A74B8F6C31154122C8E7FF6AB032E64143A3635DE575F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 15075143c3aedc9a364316df57c33a3a40dc64be3d6a93eef80619a44fc0b203
MD5 dd50874cbfc73401069806b3c7d0fee0
SHA1 86adc3736c5431e1895788204ca3f8663fb55565
SHA512 a8834b584ddb2509fee7116518a27f84326ccc0677e1a9e78ca6d659e0bd7cad2ade3ed55c793f2534161062290e24353a94f822db24d8452732eae2edfa37a6
SSDEEP 12288:PVUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U39:PVt2rR8FfBhRJUEbDk1ulUt
TLSH
T13CC42312F3A848A3F2578A74B8F5C31154122C8E7FF2AB432E64583A3635DE575F9AD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 603fba37fc67e14b76ca869e030bc8cefb79e6d5d8c9447987105ba248deb46e
MD5 65d3521aa5694df198c726a4e45f360a
SHA1 09b38278713d12169534e25d460389ce80deaa7a
SHA512 4df3371b9f666296e8af4122c4c5ce7e326795e959c377cceef803745e7431c09b13dedc2455df2a52f50e66edd2304b01a991aa225ab9e986334051fde47ffe
SSDEEP 12288:EzUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3h:Ezt2rR8FfBhRJUEbDk1ulUR
TLSH
T1B7C42312F3A848A3F2578A74B8F6C32154122C8E7FF2AB032E5558393635DE575F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 07f2a1ea817e8098142dbc2d9331c6d2d09b143e6ac741cf9f3d66f5db7d9f93
MD5 01f3c75b565c54322ad71ed825da7142
SHA1 d49c500103e1a06e590e0fc350319425fc80cfeb
SHA512 51e01514e4161c0a05a73896a9e05b6a2073e9e578b772b20847d0edaf0bbd8c19affb8179d848015d00c207121ff944c5b1dda93ebeaf373565ec3c3b03d95a
SSDEEP 12288:4VOUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3S:Dt2rR8FfBhRJUEbDk1ulUi
TLSH
T193D42312B3A844E3F567D674E8F6C31191227C8A7F729B4B1E50083E2E31AE479B5BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 33e88f4b634c856db83abdb38d32351196caa81ea88cda00eaf3f9282c7c4cfe
MD5 c705be0d86c34f1cd045b8b3b733ed90
SHA1 6019562f59b7b2c8acc69bcb2215df419085bee4
SHA512 11f2136de46d7073685c072a3925aef20393a0d0f7e8ff0ceb24031420784f786e927fd5c141f3a891ddccbd93b99b007d2ef6cd2d1543056f93b6e37e534ced
SSDEEP 12288:4WUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3/:4Wt2rR8FfBhRJUEbDk1ulUv
TLSH
T1A9C42312F2A848A3F2578A74B8F6C32154122C8F7FF2AB432E5454393635DE575F9AD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c329a68ed36e54b8f2debff11262216683e3a7ab22c24f9e38d0d4c0e07fef94
MD5 5e9599637608bcc21e67ff13a5bb3d61
SHA1 8fcd8deb95c2ce1ee6abc4a69cffbdd1f4bef39a
SHA512 958d83580b66dc9714a26152953762142bdc3072e90d3fa17dde104992d178ebfdd36a918d002dca7a5180960316e3b9db8b7061635af962a5bdb51b38c90836
SSDEEP 12288:J5UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3/:J5t2rR8FfBhRJUEbDk1ulUv
TLSH
T10FC42312F3A848A3F2578A74B8F5C32154122C8E7FF2AB032E64543A3635DE575F9AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 7be582ca0ae49a3dbca5d2878350b1241e2c45c7920fbee6834ccd2bd2645cfd
MD5 92f413a18b3d67831c2f129d91315a21
SHA1 90ad2405ce47562f0bc0f1b24864628c0354846f
SHA512 eeefa69dadfc9bf16c7f90f8b5e5daf91043fc61ff9628c59c9067b4fa53bd0ec34bc774ba349828170a387fb88402131dd9956c2f660f777ad0aa2c933dae99
SSDEEP 12288:edUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U33:edt2rR8FfBhRJUEbDk1ulUH
TLSH
T1DDC42312F3A849A3F2578A74B8F5C32044122C8E7FF6AB032E6454393635DE575F9AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 959ad33f11d27113eccf8ae0e5c5354315b726c9241f5a446badd22427d992a4
MD5 e616c313f0304f35024a3a9efc5c921a
SHA1 7f742e35ec731dcf7abed41051dc30df004f3bd0
SHA512 759dcaea3a0ba498d1dd19a3e86bd6868b48e5590d712e3c4953c177720ae5273a91e844a8186f1ac7e56acb93355a846cd55e68772620927831b94b34e40824
SSDEEP 12288:8iZwbVzzFEoS2cPvy1UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3j:fZMRzFVSO1t2rR8FfBhRJUEbDk1ulUz
TLSH
T1E5050195B39008F5ED67823DC8658916D6B27C5A1BB0CB0F17A4362B1F337A11C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 171a6844c4ca7c8338011412f5b77464f6210053aaf8508d99cdd1efca84c34f
MD5 158ef9c1f360e84929cb15c8becf25f1
SHA1 a92728752b23b06bb40cbe1a24fae8afa9f1f116
SHA512 c4d17b8ed34f5eb1d7cd0b00f2761e277d95fe14a9c25cc6084f9a32d700c281244d5206ddb03fef5034ebe0a00810c03a0b479b4e5d1418fcd4684ceba46e44
SSDEEP 12288:VUUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U39:VUt2rR8FfBhRJUEbDk1ulUN
TLSH
T165C42312F3A848A3F2578A74B8F6C32144122C8E7FF2AB432E6558393635DE575F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a32a4171917e37e91e56b78c236d995fbb84bdd57eeeb8a85f0e4c11c9bb6f79
MD5 2a93879226fe4a12b5cf77df9d02c105
SHA1 a9e8bde753b13d361912ca5a313391f83e897b2e
SHA512 a3ce97c72cacb2fb2489a9daf3afa60ced50977765176c373374a58b564577582c542f31aef7c6ef37f5a1a37c66c5a31d09774166dc57521730b03c72bed6a2
SSDEEP 12288:JQUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U39:JQt2rR8FfBhRJUEbDk1ulUN
TLSH
T177C42312F3A848A3F2578A74B8F5C32144122C8F7FF2AB432E6458393635DA575F96E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5b8d5cbe263f1deaba214c02819fa837a0a184d6c1ac7975f92f01fa1d157257
MD5 f324707897b97619ad151738e694d33c
SHA1 84793236faccfd6dbeac0392e367552c0ea28a90
SHA512 15c80658be7b8399c1e36d6b1905fe92a6a4b7a382b0b968b9fff5f3251b4f3aa736fe0ffd4b5b1e5f928b22d36611d46f043f48d3134c930cd190f4aebcd9b0
SSDEEP 12288:GyPz5L8RUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3a:7zyRt2rR8FfBhRJUEbDk1ulUq
TLSH
T1CCF4021773A420F5E1678238C8A25A11F7727C761B709F9F1764063A2F376E0AD7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 23f49f2676c7c05de1a7e94ba3c1a234ab38ea2f35b3c216fcc6309d3348ea65
MD5 0bd1ccf252c6a69d101eabe178c8571b
SHA1 dd5228f57a6754f8423e8731ba5b6d3ecea9b93c
SHA512 3b5fae61f288a6df67dd5d80b4df5ee3222d3b0fee092a04918e138d328c83ea7114e478798d1e2f0570a57eb8645842766de087a4c0d83889f6a99d305991d8
SSDEEP 12288:4UUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3X:4Ut2rR8FfBhRJUEbDk1ulUH
TLSH
T143C42312F2A848A3F2578A74B8F6C32054122C8F3FF2AB432E6558393635DE575F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 3569958c7db890c1afe25a51d94c2d7d897422c68460273d8b8ab28b4c85c03f
MD5 396d7952b49968ad0afcf3bfcdaa9dd9
SHA1 84aff575f6db563185df2e3dbe89087fd1a6a814
SHA512 e4b675c28bd9c6635ce6eb36470b20303e8c3a44d9fa8b75144be0b8967e7fa935a1aa226cebfe7c46dbb6ba9a89780de009e7878669d98f11b742d72873ab6b
SSDEEP 12288:+UUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3X:+Ut2rR8FfBhRJUEbDk1ulUH
TLSH
T138C42312F2A848A3F2578A74B8F6C32154122C8F3FF2AB432E6518393635DE575F96D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9b18e87d4162117425b1d670e7415ff232e0adb5089d2eae7617c9ef5670869c
MD5 bad2f28c832f9171187737420e8c15dd
SHA1 23b4f2d9bdcebed4c5a6ced9887405f99a822217
SHA512 9ee1d8357038ade4b9605c2de94dfed0d50d9ed016e24ddc078bee88a81821bf2784638f5ade838927206441edfd80f36a0b8dacc17240353760239583ff5121
SSDEEP 24576:vCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAXt2rR8FfBhRJUEbDk1ulUf:vCUZPTY+8Wg2lIL8lrIUJLWwWt2r4PRz
TLSH
T12D65AE1EA3EC0896D4BB813589518A16EB32782E1B32D6CF2160C73D2F27ED55E75F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 d0cec10d2c89f9be2f29611e0ca1cba1b9080168d15579a7a54f7981b9adf69f
MD5 3baacf58534ec1f19072faa5208e39b9
SHA1 c0f396849e25982c9d4636ca38e893ca0da769b0
SHA512 f1efadf8f7566d5142265a6c527d292998f9baddb0422fe33609e6f7100656c4fb419fa321e6502aa740afc50dfdb32289a7db8094048f82ccefaaf1e69be278
SSDEEP 12288:RbsfEUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3o:sEt2rR8FfBhRJUEbDk1ulU4
TLSH
T1F8E4F11AE29801E9D06E5274DBA68601B3233C5957F1D7CB16D0F43E1F36A90ADFAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3112fb8d1d4d2986d357d43665e609cc47d913c5281799672136c60c87262f5e
MD5 1c3eba45fbebc5fa95af5c513cd92556
SHA1 b0133f087e2c94d5f7e3a499689e42afedac581e
SHA512 c87a8a410a0114503dbdda9f582a65df15f2ff3d3e91f0c4d967ff759ad3bc95d6e33ca86b23abdb863b2968381ff6a1dab69fb1a2d13f99ec9dc2cdd00649bf
SSDEEP 12288:STUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3b:STt2rR8FfBhRJUEbDk1ulUr
TLSH
T1D1D42312F3AC88A2F2B79A7468FAC33011167C8D7FB19BC32D5015393534DE5ADB5A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 aaf2697ba1b62457dba35dfd0724b31b325bfbff443bac1c979035411121e150
MD5 cce30ed1dfaaa662709dd8f3129dec68
SHA1 c28d9c16d7a92215f3a53e3dcbb540d67a576c15
SHA512 089ac797e44ad4ac1d1a4cc4e92f804908bc7a50c0f560e78414759087748e47308009deeeef9e2530ec0d1b00c37abc5f753678f0b7d8434a6c7aa0aff396e7
SSDEEP 24576:V8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCht2rR8FfBhRJUEbDk1ulU3:KRZwQCyiHiQEaiPnMMt2r4PRSEk1ul
TLSH
T19785AF1E63DC46A5E0BAD278CDA74407E6B278165731A7CF0190C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 59fd26b5a6d6b0a825a3ef2eb1521c727365f796d84cc704cef2787ca2cef8c2
MD5 d04a08ef356d56e4fc0c7bed54abb8a4
SHA1 eebacdcfb550d3351331cc666de61375442284fd
SHA512 30b7dbc9bed7489034c68fabe52faba8e74f6c1dcee0ef169e77fef2d83ced9e036238ef32176db41d28e7a1d81dbe7a58ed3d6426845a17a41b1ff02121d22e
SSDEEP 12288:/bxA1U7KjUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3c:/bxA1UGjt2rR8FfBhRJUEbDk1ulUM
TLSH
T11DE4022E62AC18E1F176963C98E68205D3327C1A2B7197DF2590823E1F37EE46C75F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a8160b82c0ad5b5339ec072c17cc5470c8b72a1eed8d17d2d71c99bdef0b6127
MD5 783602e734660fb7de03713f45e4fb3e
SHA1 6a8713ce850fb774ce2a728a7fe53e8c39381ce0
SHA512 7fa6d6f00f286ad20b9ecb9e91a26aa0993f89314801ba14f18675fa340bba036ed6fc18e40e8cd1265627a63bd6ebe48f3746ff0ab4d53f51eeb21e1da8ea55
SSDEEP 24576:tjsmP0yHaqrVqHra44KDzMsrnet2rR8FfBhRJUEbDk1ulUk:tjRP0yHfVqzlAsrnet2r4PRSEk1ul
TLSH
T1BA45AF2EF2B910F9D4AAD136454107B5BB71782D1F209BC70170C635AF0AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 2a40868adeccc6638af7f02e5ce61852f74d8ee7cf696a31f21d7c310e022b0f
MD5 22918fc69b60207b70fa447ad6abd7b0
SHA1 52e4e2adb38bad2c9fa808979ab0baa441ba452d
SHA512 55b2ea17d82f16e625178d6c2384796de67f34af44208ff184b0b1896d1030be4316d681c6c7d5a3bf624d1aead83bee570d74e601540c8c81af05001fe47011
SSDEEP 12288:+ZUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3s:+Zt2rR8FfBhRJUEbDk1ulU8
TLSH
T1EBD42356F39848A3F2678A7478F5C32110122C4E3FF6ABC32C64543A2639DE9B9F56D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 732078c54cd228af8167dbae76d54829b8291fb89ea1b128d26f1144c48b9f5e
MD5 7fe3719b7be3810bc4572a504542939a
SHA1 03a9b12fbafee2fcd6c3376023e813dee557a9f8
SHA512 eac2b5b20ae8bbf08167daa856d2c6d278b06cb4a8c4db532b19487a408e6ab0ca34e5d1669805b595baff42c59f749a3fd768771370b78ad860783a72230206
SSDEEP 12288:5ObfA4LWO+vAYFTvUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3Z:ubLBUTvt2rR8FfBhRJUEbDk1ulUJ
TLSH
T11225F155F3A400F5E96BC23CC8B68612D272789D1764EBDF07A84A691F237E14E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 e579fd86c4d015ae85d0e864ee2169fc5b50dc9f960ca9a1a5355654eee961a8
MD5 1c4da4812e0e2c944cf4e286b5249511
SHA1 950d4e94e4e546080efffdb4cf8b17380945937d
SHA512 91d3d1ed5338ad3ea1be508e090cab17174b493f57e542124938b59738bf5ef8e6510864c73e065afe44e1aaae1e6dfe99c7ece9f6ed2e9143986ecd59025c48
SSDEEP 12288:u70Vm9IYNvUyBpIUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3Z:/pYNHqt2rR8FfBhRJUEbDk1ulUJ
TLSH
T1EF05F12FA2AC0CE5E57B917989D28205F2737856176197CF05B0827E1F27EE8BC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 793be7fb1a91c2102f1f492132ed7230c3851edff7ee0460634ea9c0a39680b5
MD5 01b1fce62bcf7e6474a6fe142f19af4f
SHA1 ad6862da307893367d451156c1aeeb4885266086
SHA512 42956949377ff2d7a2d69fb431957f5460b0d476b191663f3a4c584867129f7f1b6a5e9551d15b216ab2de62f8a3f2c21e15ac04848352300fdc80478a860088
SSDEEP 24576:InXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKy:InXoJJYH84VVS6AmEOJas+cHBjSSKHPV
TLSH
T1FE65BF5EA2BC04E8D5BBD17DC5C24506F57278661331CACF026182BA3F27AF56E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 20941178fd2a5ec8a27e84ca9eb2bf11c29eeca70b207ea0a961b655fba3c301
MD5 6fd1b7318b61cc052cc20bbdddf83586
SHA1 9cbea441658526e6516d88cbb732d2f7814c85c2
SHA512 01c3c6451cc8cf69d1a94c9c1701c4e3e5c76530ffe7b778051537dfe9a2b9c83cda61d5630344f7637acdbc76c563d6a01d160b13f94124d51bac800d56a7fd
SSDEEP 24576:hv7Xbxd9Tuycf8M/TYlSuxrr2PCgt2rR8FfBhRJUEbDk1ulUf:hDLL9TuJ0M/TYj2P5t2r4PRSEk1ul
TLSH
T141858D5EA3EC42D4E07BDABD85B79146FAB2B855273081CF0251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 09d80fc202ffc8b302d11d1dedc6684b2b300a872847a7a03fe2d8184f3215db
MD5 bf394e79f09c5a728604b5734d1bbba2
SHA1 640699382dfe79f8e6a213654917b8aa4ba676db
SHA512 1d8154c66399bfcbf90b0776a20b26e7f4fc34dfe2487f263f5d3573dc6134789fb57af3cc596f7cb3e12c1f37e220ddf7e0d10c08c1843a531860f14dd6e3e7
SSDEEP 24576:PegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wvt2rR8FfBhRJUEbDk1ulUm:PngOJOmPOHzvt2r4PRSEk1ul
TLSH
T11D55BF3FB7BC15D5E03EC17D8A928916F6B1782613255ACF0560827E1F2BEE46E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 b6a68ee68323d338b3a1cfd4fa7380a17cfe9e2a72363a11797c591497d46b49
MD5 a1ab1211001bf69e7fb1b65aee3da9d8
SHA1 6b3748dc0f871398bcbe56afcc593343e8036157
SHA512 5a366cf155873047f615efd0b089332b4b9be593714dc46c99b0ad79e84996567a45c5df0c75b7c8181bacfea8fbd8ac4535cdbe35192ae71ab8f17ccf7968ae
SSDEEP 24576:PLJnJiTk3R3waE4JrO5t2rR8FfBhRJUEbDk1ulUb:PLJnJK8R304lOt2r4PRSEk1ul
TLSH
T17515D02DD2A810E8E0B7C2B4815A5756FF31386D2F216ACB19B4D4353F12FE0AA79F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b309b07a3c45bf5dc29323f9a55dae77cd78cefae831ae54077160e2f78a4369
MD5 5ad6207b646c839ab0be8e1e19fab43f
SHA1 807970ba1ab4db8d5813bed5c0a2b09f58a45329
SHA512 d5c12c0772ded5576c3ec2f23025ef1795b1753048b5acb6c9c262766b10c44ca2fc3fdc289adbe97ff5535df4ecaf1e1c5b972b27f04ab7dd506a27d6ef21b4
SSDEEP 49152:v9mqCzDScAZmlvTcFg8Ph6dt2r4PRSEk1ul:zKt2sEE5
TLSH
T142955C05F7EA5298E8B3CAF1C96694159B327C409B34F7DF0A80CA7A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 f4d0edde00e2202b0f289517760388d7c6f6fc2ca3c93bc26893cadf60a1fb2a
MD5 c28b760d2fcae6976ff22f646467089f
SHA1 378edeef810e131c0a15d62bcc7e8f2cf7ebff53
SHA512 0b81e66ff9fcd201457a890f3beb6b952c2776adeda8e51d98793d49d708c5c8c69dbbd98d2aa6ad7fc02be31e86afde432f00160bab554e1e45919a6ba877a7
SSDEEP 12288:8lYJeXm5nkEUuE/UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3V:8lYJeXm5jUuE/t2rR8FfBhRJUEbDk1uk
TLSH
T1F7E4125D73AC20E1E26B857898E28614D332B866276267EF15E0C13E1F36DE56D39FC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 6f1bb092994302ff6686adac7a7f3d4e15ca9f9525986828a958c01272467ec9
MD5 9556fe660909e8a600255b9503425a8e
SHA1 eb751331db9e203ea73799a191f7428595d5061f
SHA512 0fc63224c20b28c84e40fea4ddbe786a9699326e5010f75ca385eb2b25ec1914e6147b53cdcaa3fbcaedc88cb60fd9eb628edd7283219c097ad2aec4f76c70b7
SSDEEP 12288:fmu6ky+UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U34:f7ty+t2rR8FfBhRJUEbDk1ulUI
TLSH
T1C5F41201B3E454E5F6B64A38E9B382609A317C156F6197CF18D0E63F2E36BD4B870B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 604761991fe923f27fb814981f688ce085c4f1d8db2ebb29d0cf2a9ecd1d3d78
MD5 97cbd2eae660fa610f031e870b51ee54
SHA1 c2e0f40b2c06756fb5e820fcced750e21372d35d
SHA512 46ce679295927e49b2e8dcb7fd174a08a2b94070ee1e19058d79a4586fa204bab9f3016bd7f43fa49ed67d96abfe03f9241c04254e17b47251307bd9975951ab
SSDEEP 12288:DPvUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3B:bvt2rR8FfBhRJUEbDk1ulUR
TLSH
T120D4231AB3A854A3F6538A7464F6C31050223C593FB1AF9B2CE094392B359E5B9F5EC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 bfa3eb6d1327eece9001a7a075d8ec5aedd0efde485b62caaf0883e89c1e9d35
MD5 0f96e40799be82f6d011c7e26952fd8b
SHA1 20302127ded771a81fb55552e29d8f840a90b729
SHA512 b4eedd4f2208af1aed084283448f10f2bc466f53d1eea592243346ebcde95142a8af1379dc356b01df41b2ce1f412bf98b2f5c835443c815833f5455787e9e21
SSDEEP 24576:SC+TyQIu93VAumZr7jmkt2rR8FfBhRJUEbDk1ulUx:S/TfIq+Ykt2r4PRSEk1ul
TLSH
T1E5558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 cd28323be02b4a75e20459f77744362cb34de216a04f7e47b2cdd2e40b7eda7b
MD5 463d7990007a4ede6d75cabbff7ad571
SHA1 e40e9e9a6b037a514ba074a59ea6b7ead15b04f3
SHA512 3e7b128d69b3ad2f502f9d04760192ca7460e3b3fe98dea0cdb4a05ae95159dc289acac97451f499699f55c78b676ae111cc92ba6dd10e66c1abafe856c33e7e
SSDEEP 12288:2cyrWOstaa3kcsrUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U35:vLQikZrt2rR8FfBhRJUEbDk1ulUJ
TLSH
T130F4F10FB3AE00A6E1A7C23C88958211F6737875576267DF06A0C73D1B675E9BD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9b9e7d9ebdcb089ba1e22a7907c003e49a995d1eb8cfeb3d76c7abf44debcd0b
MD5 f7fe6b2779b43d81ff944f220004b475
SHA1 7700d8d1e2fb76a7d9738a60169afb49febf75a9
SHA512 76a881dfdbacc43da4329de877943aaf7dbe6eed8a046d0b93903c4dbbc0bdf60969ae90175f2cc09173a325ce80b8b75396d8807be327da7f4ea1063aebad97
SSDEEP 49152:ZpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP+t2r4PRSEr:qpC7b4+80GTklt2sEE5
TLSH
T105A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB00B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 712e3731dd77b1b8548fff648a602fdad4e5754bc04c7938f9afb78d5e3da7fd
MD5 af53f720456144d8909d08de8b6c6e9a
SHA1 b421ee42cf533f5e2cb1a80cb94494052a42df2e
SHA512 2980635b5a7f82baeea7c5a1e0a0e58e08bbf3993f45d7c564737ee5de78343175c1ee4313bea0419ce114131fb8ea28d2a511b0ef24c97862e7c8515f88eccb
SSDEEP 24576:JSAwJPE1IDAo+4Kt+l4413JUQ2t2rR8FfBhRJUEbDk1ulUK:JqPCIo4Kol4vQ2t2r4PRSEk1ul
TLSH
T1B055BF2AA7F946E5E17ACBB4D663C611FB733822133163CF5290813E0E169E85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 3bfe6a5aa9abffdb42baed35c4fa482a7f474de5453b4a66c40cb74ef6304fe4
MD5 9bba8a5e3bec907e2e163eaa78c4d057
SHA1 0a4c5591bd4030249dcc0f88da402c859fb130e0
SHA512 06b0ab0779c30031ce035b72e02f9541a4d0009791a12241bb60d0416f9cb086778f73fec35df79cd8caff2b3414e73e3f3fb8966e41ee770bd1907641d54ba5
SSDEEP 24576:FyLXPLcw94tGt2rR8FfBhRJUEbDk1ulUu:Fy7PoXtGt2r4PRSEk1ul
TLSH
T14025E03EE76C08E5E47AC27CD6A38506F6723C9D037166CB19A090791F6BEF46939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 74f412ce4493b739959df42f85a1df56904ce72250e1ee07e23f4af996bcb3a4
MD5 50e8b9a9f714e948666c92cbaa05ed6c
SHA1 5686c34c0d6e34ee67bf128fbffd9ac1bef11aa6
SHA512 5d1e59d5c5809d0ca7204744c99971cf2805088049ca491194209400980b084680013f413076e895557b57f72e438c82ef8fd782566989e92ca557adc4057e20
SSDEEP 12288:m9lyvj3IkxjbBzbUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3S:mWv8qjpbt2rR8FfBhRJUEbDk1ulUC
TLSH
T1DAF4121EA3E414E5F17A4674E472C22180327C662BB5ABEF38D4D93A0B35AD0E53EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-114-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/220-108-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/220-236-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/220-107-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/404-85-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/404-79-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/404-198-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/404-98-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/784-165-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/784-161-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/784-289-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/784-155-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1184-245-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1184-128-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1184-125-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1184-119-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1448-76-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1448-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1448-55-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1448-54-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1448-74-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1524-375-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1524-191-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1524-200-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1524-199-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1604-240-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1604-242-0x00000000006A0000-0x00000000006F6000-memory.dmp

Download

memory/1604-234-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1604-237-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1604-228-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1604-243-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1628-206-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1628-214-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1628-464-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1628-212-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1664-247-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1664-246-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1664-253-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1664-495-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1688-290-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1688-287-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1688-512-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1688-281-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1884-269-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1884-276-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1884-277-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1884-505-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2516-197-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2516-65-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2516-73-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2516-71-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2876-217-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2876-225-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2876-223-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2876-492-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/3188-494-0x0000000000C40000-0x0000000000CEE000-memory.dmp

Download

memory/3188-106-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3188-22-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3188-23-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3188-21-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3188-15-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3504-327-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3504-303-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3504-343-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3504-311-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3504-300-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3504-294-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3504-515-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3512-345-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/3512-187-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3512-186-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/3512-180-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3748-257-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3748-264-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3748-498-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3748-265-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3768-37-0x00007FFB12B00000-0x00007FFB12B10000-memory.dmp

Download

memory/3768-14-0x00007FFB14EB0000-0x00007FFB14EC0000-memory.dmp

Download

memory/3768-545-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/3768-493-0x0000000002010000-0x00000000020BE000-memory.dmp

Download

memory/3768-7-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/3768-546-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/3768-88-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/3768-547-0x00007FFB54E20000-0x00007FFB55029000-memory.dmp

Download

memory/3768-1-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/3768-11-0x00007FFB12650000-0x00007FFB12660000-memory.dmp

Download

memory/3768-27-0x00007FFB14EB0000-0x00007FFB14EC0000-memory.dmp

Download

memory/3768-29-0x00007FFB54E20000-0x00007FFB55029000-memory.dmp

Download

memory/3768-0-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/3768-31-0x00007FFB14EB0000-0x00007FFB14EC0000-memory.dmp

Download

memory/3768-139-0x00007FFB54E20000-0x00007FFB55029000-memory.dmp

Download

memory/3768-30-0x00007FFB54E20000-0x00007FFB55029000-memory.dmp

Download

memory/3768-34-0x00007FFB14EB0000-0x00007FFB14EC0000-memory.dmp

Download

memory/3768-33-0x0000000042010000-0x0000000042020000-memory.dmp

Download

memory/3768-32-0x00007FFB54E20000-0x00007FFB55029000-memory.dmp

Download

memory/3768-28-0x00007FFB54EC4000-0x00007FFB54EC5000-memory.dmp

Download

memory/3768-26-0x00007FFB14EB0000-0x00007FFB14EC0000-memory.dmp

Download

memory/3820-151-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/3820-275-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3820-146-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/3820-145-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4120-90-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/4120-104-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4120-102-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/4120-99-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4120-96-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/4352-163-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4352-47-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4352-496-0x0000000000BE0000-0x0000000000C8E000-memory.dmp

Download

memory/4352-45-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4352-164-0x00007FFB54E20000-0x00007FFB55029000-memory.dmp

Download

memory/4352-39-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4352-46-0x00007FFB54E20000-0x00007FFB55029000-memory.dmp

Download

memory/4856-136-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4856-140-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4856-263-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4856-130-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4864-176-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4864-174-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4864-302-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4864-168-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4864-509-0x0000000140000000-0x00000001401C1000-memory.dmp

Download