01533662897827596dcc245ae8246d1470bac846da6b64acbfaa595c1e009d25

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
Size 5.5MB
Sample260427-pgldfsax4x
SHA256 01533662897827596dcc245ae8246d1470bac846da6b64acbfaa595c1e009d25
MD5 731b5b16af42397326ac225940a784b5
SHA1 73b8c40db3b055bfff77b5620e28547e22c718f6
SHA512 c75de071c43a5ec6b96d42224907d7134360031e9896f40bfc19fc5f31cba44e039c3832b0bf3a8fe688489155233fa4fdc2b1b1368c8b0099b5d20c43c90096
SSDEEP 98304:oHnFkb1kjZ2vFFWjb8ww1V9CYPASWNZ7WCGir9raRtvVjiwy3Go1Ms:rb1+b8wwxCYP1WNZWy4tJiwyvu
TLSH
T146465B1267E9A039F2B31770AE39B36456B9BF755831D10F72442A0E1EB4AD1F934B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2208	alg.exe
480	DiagnosticsHub.StandardCollector.Service.exe
4644	fxssvc.exe
4684	elevation_service.exe
808	elevation_service.exe
4052	maintenanceservice.exe
1860	msdtc.exe
2460	OSE.EXE
4712	PerceptionSimulationService.exe
1664	perfhost.exe
428	locator.exe
4040	SensorDataService.exe
388	snmptrap.exe
1124	spectrum.exe
3348	ssh-agent.exe
2812	TieringEngineService.exe
1608	AgentService.exe
3176	vds.exe
4024	vssvc.exe
4516	wbengine.exe
2212	WmiApSrv.exe
3020	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\443e083b89fac755.bin	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7a88c1057d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001819590f57d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccb6101057d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef4fb10f57d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ea2620f57d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
480	DiagnosticsHub.StandardCollector.Service.exe
480	DiagnosticsHub.StandardCollector.Service.exe
480	DiagnosticsHub.StandardCollector.Service.exe
480	DiagnosticsHub.StandardCollector.Service.exe
480	DiagnosticsHub.StandardCollector.Service.exe
480	DiagnosticsHub.StandardCollector.Service.exe
480	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2472	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
Token: SeAuditPrivilege	2472	2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
Token: SeAuditPrivilege	4644	fxssvc.exe
Token: SeRestorePrivilege	2812	TieringEngineService.exe
Token: SeManageVolumePrivilege	2812	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1608	AgentService.exe
Token: SeBackupPrivilege	4024	vssvc.exe
Token: SeRestorePrivilege	4024	vssvc.exe
Token: SeAuditPrivilege	4024	vssvc.exe
Token: SeBackupPrivilege	4516	wbengine.exe
Token: SeRestorePrivilege	4516	wbengine.exe
Token: SeSecurityPrivilege	4516	wbengine.exe
Token: 33	3020	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeDebugPrivilege	2208	alg.exe
Token: SeDebugPrivilege	2208	alg.exe
Token: SeDebugPrivilege	2208	alg.exe
Token: SeDebugPrivilege	480	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2224	3020	SearchIndexer.exe	106
PID 3020 wrote to memory of 1080	3020	SearchIndexer.exe	107
PID 3020 wrote to memory of 1136	3020	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_731b5b16af42397326ac225940a784b5_elex_glassworm_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1584

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:808

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4052

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1860

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2460

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4712

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1664

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:428

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4040

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:388

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1960

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2212

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2224
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2860 2688 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1080
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2896 2892 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1084cd7b433f31a14d631cd9b5efa79be866f54cdd5f8d5816d3da6fc0a788f2
MD5 c48f7b171227df4ad59d26e19eeb6f4a
SHA1 ff78ad1b9c98143e80f55e6acea2fa8752d3aa28
SHA512 dc131b3903c02fe8667a9aeb7f5f22c9b0b789a390aaf741c244477716bef5dd012b6843fbf0dcefc8d88bdb8b33ba6af5696e51b09f3d1fcbb0b2d5a850b651
SSDEEP 49152:Zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnP/ouy8grLLesK:v3q6HjBZ1Ms
TLSH
T1B9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 6f7c397ba4d160e9b41704d7d75a32170524dd80db70d292b175913ff31d6d16
MD5 0d25ed0a9fd59f6a36173588213e521b
SHA1 4f8deff36c849f44ddf8b3d3a4680b918ab02676
SHA512 ce4217c9c020c80395f4fa820c4526af27ba7f243feb2a077b9636144412f8e0045e06bf103ef57c1a7570c09d2b9bf5efdb3b3edc2650a6fcca6c2c71220b1a
SSDEEP 12288:X1XLsswWkxy2lRq2czAu+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbl:FXYfDtczAuUOoTqy8QCYrLLeYKUML
TLSH
T1DD05022867E009F9EC7B823DC8A28111E67378554760E7CB03E499651F337D49E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 fdffe185fea251ffd6559230582231448f16e7f74f07625b3bcc5c73f4f8aef7
MD5 b41f857f5ce6a022ba6193f30ce9bf51
SHA1 4ddd2749463e2a4f9029e981eddba9ad59b75aa0
SHA512 bb37a795aa176ccb08b3db6f98cd53e5462037f594ea564e0f8eb5d6a9caac50a61e884180ffda897ab9f4dcb13736a7aa9ba3127aedc90a0ca022e5c292617b
SSDEEP 24576:V0Le5ji0hmxirMXUOoTqy8QCYrLLeYKUML:VPji0Acc/ouy8grLLesK
TLSH
T1F235AE16F6748731D073C0B9C5D2A69AE97130825B308ACB4286D77C7E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7519d82f8ce546b9a5b8717d3aa77241f1622903f2f0008773ea72749d9500c1
MD5 71f5c40545cd083b0bf2d1b0e2382334
SHA1 8f993a4754b2498869aa053ba8358162b4aef4e0
SHA512 0c8be89a5b02fc624d6301e00565a0c8d4d2f5700bd22d4aad0d95f8b60a83a22231b69263afc9c6d2b6dbb29c4534a2344149425181d9297dd7370e6e006d0e
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyuRUOoTqy8QCYrLLeYKUML:E/ezSC6vUzPvxHjy4/ouy8grLLesK
TLSH
T12D755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f417628d896d1cd0a94d83b00a3a7b8a14f6ef4991a30f55ede17fb0d08747e1
MD5 d425c6d2b239b36390bde3542f5626b3
SHA1 a4fd878e16047afffebb8a956404cea2c1f3efc8
SHA512 137f5e5106407875f71bc5518cbbdd785490f22e1d1cce67948209c9f1683481da05d30cea9c3a7186e821f49825c58fcc359a4b6d701867c7bdae0353177eb7
SSDEEP 24576:EVbqPb88hv/l+6SUOoTqy8QCYrLLeYKUML:EVO88hXl+j/ouy8grLLesK
TLSH
T107559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 16ace14fe95e3e02e6cf4058c53e6ac97c185b8fe0bdefb02a9ba6087fc2feac
MD5 d456bf35a27e7ef6c730d0132fcb0b29
SHA1 7ea2c55520f0d877995b67f982246ae327b76ccd
SHA512 17c9d456bea62f83da71cd40aa0ab84dcf4e3753c8b711edb4c8f6ce6426b9fe74d7fc19d3cf5ce1ccd4a826ab7f8e6d9c08941361d98c18f9715b6400cee1f7
SSDEEP 12288:BRb+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:BRbUOoTqy8QCYrLLeYKUML
TLSH
T196C423150D602D73FAFFCB35E42B5071C0489EA68D6242C99AC6796A5CB8601F7BB1F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 525ab81458dda8c73f47536a0a4dd60f0c3b49915a7e446d6930d75d6bfb7dba
MD5 eb27f405082243c57da3396fd7b61968
SHA1 2b14c11d40c49ecef1bf8487346b285e0a6c99f7
SHA512 047d93ec225204ca917a86fce30cefef465769412031601e331eb4ab241acdf748233fc2dabda265e389a8dcf8c6a303dfcef0f9844974a6afc80a9abec19c58
SSDEEP 12288:JeBNUbTVO86Ua+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:JJIUaUOoTqy8QCYrLLeYKUML
TLSH
T11305D03BAE38FCE2C27E8D795A518200D77278714F6293CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e723191a161292626d85140af53f2655a83ff9bb71ef06a178dce1518e9a9cd0
MD5 17b8f5ae5b6ab7fa6c6ff2941e676428
SHA1 20115c46a09551be8c00c869a0301205cff70416
SHA512 4372ee3f3f99d08a53ebd7d03785594798b404bd59dd8dd15f344cb6f6e343ba2bb31393741ef02733a89002498ff824593fb5ced6ea3717f2418948bffc3f7d
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH8:LQvGAdlCEL8c/yRNw5Cu1Ms
TLSH
T1D2266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 cb639860acf23ed2fda7d2ed183cb05b20344ca186f395e5400115048c608dbe
MD5 59ec47eb3eaf9df9bb6f787345861429
SHA1 065d256374d4b2d70279cd4c0756b6897d79da10
SHA512 f1276a67525097f76fd00dc4d3cd5a36f164c5e0f7356085a07172e9a0dd054527d11f24b1c04e11297a44f076d257337f0db3e54405963b6492d25fe6934dec
SSDEEP 12288:pAwSfxL/2Dc34DLLmt0LDQewsAjs+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCD:adewsAjsUOoTqy8QCYrLLeYKUML
TLSH
T1E615E031FE74E432D2BF0DB61B26C316542C79204F611AC3E3E88E9E59702D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 41cdcab4970240ec55fdcd0c0743e68d4f907b2ab8c4784bbf58fe594724f279
MD5 d77937291d94628c9861cc1d32f0b764
SHA1 52bfe7b52680fb527f50020e0b10e938ea4f2206
SHA512 c11763f8a1b6dafc79cf36e4561657fb34eca9cadcfce7788bd5e857666f1582c06fd8d4f07e053bf0db9e53b3804c5638823e3967831d2fbe03fa51dae77a59
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHHu:MUEtQevvqc2W1cpV2EI32O
TLSH
T135474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a5c3045cef7e1721dc6193b35b2ad54165eb389102b4ba521196655a367d2f64
MD5 1ccc1d475dc860d6a77cae66d667fc47
SHA1 0d80afd9a13e7d633bd4c3e034a2dc14fb4a4452
SHA512 69d018d01c6dcf64725832fd035ee205438f40629ad49105b5ca765c51e8de5c391dcd392a1cf0de2d8c5ef75b8aae6a689a07164d36fb6e6b789c3a35dc595d
SSDEEP 49152:1CbRquA/m2yL5zifFiV+XenmE3/zM/ouy8grLLesK:ioqHVjnma1Ms
TLSH
T1F1D58D0976B882E4D1F6C77886A2C647F37178154B3197EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ed0fc8623d45d1feb1e5e90643ad695aa304e112989ec8067fac3a5ff6a2a3eb
MD5 0eeb8fddb273cedc65b10a21c6d14149
SHA1 9e4009cc0b8536e4de709fbbcf22fbff76a2f00a
SHA512 df59d737f71293159d0cde831d35a6f310e38a7ae2154437dd84ecb8b5826d4254e00e47e2ea6b418ef3d904fb6833f29c93ff2ed6960e33d2f0b6586b429690
SSDEEP 24576:jAhGLJIFoiwtA5l7S539UOoTqy8QCYrLLeYKUML:jAMyFoiq5t/ouy8grLLesK
TLSH
T1CC359D81EBF915D4F5B7AA7899B68171EA76BCAA5E31C20F2150D11F0E33A40DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 084ce974c7dc4a3d73d09063b10327b48424609f253df0026ce11b8ab1262ea9
MD5 63c8ce37ea5f694be902ed49850f7a38
SHA1 d0fe71aaaf33569c43e1f95a235f8b5492bb52c4
SHA512 a2fc85dcbdec56a56d25ffbb68eecd1b3a938d551df4dd941a6ab8107ae5d661b8803bd30f95c36b2e5a48e508358d52845d19037e37f6067f60f939a275fd27
SSDEEP 12288:Cmw5HEjsChNVBFgl0WDm+Cx+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZD:bwuoOWYUOoTqy8QCYrLLeYKUML
TLSH
T12105F14536A41CF5E9BB8639C5578132F3B2BC122A21D71F17A0C65B5F37311AE2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 8feabfffe046e61da1b9aa0eb30fd761f11d6d87aab97f42c87499c99be2af6b
MD5 0da2d5f33fe98e9fd5ed4e7b0e9a32ae
SHA1 2415b4270848f939e8267db03054e0b27b510fba
SHA512 7c8a836d42b6c2cd0914eaf499747d3e292332474481a90522ebaa83a580ecbccf28de592060b7b0fdbb5dc81e1fd019c16704f2019491e44996565b7cc83e1d
SSDEEP 12288:DBZ1Iy8+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:tZufUOoTqy8QCYrLLeYKUML
TLSH
T163E412592AE024F2F1BB833CD8A24155D3717863577243CF1695426A2F72AC2EF3A772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3eae61e543d4ae0a82e23bcd6be1e0264e975703209963b42674faa60f98fc4d
MD5 2c662860667882f194a739a4e704caed
SHA1 897e5f11411a398f671f7c7df146b4b28a829c50
SHA512 c4b383c5eac86e3aa6a300612d1559ad0e8b4ea3fe41edf2d6a0077f41804f7981e3b965a9015974ba0a5ecd713808c3bc3f08c7c631aaa823abe016bb05cc51
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:yQRQyi36YOcPQLvw2gAf+PN3t1Ms
TLSH
T1AF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bbc2f2f3fab40a46d6a84920b47e55a4059f19409b6b26f9f2901925939a6dee
MD5 89dea6ad91126dd1e27a2edea0aedbc6
SHA1 f3f0f6b9a7260b3ff9bfdf15813b3405288a5387
SHA512 5342766381a1f3c1ff79e19dff0c28d015fe8be5949990fff1c9780e60dcb4b6ae70f28c19aaa8cf02a4a781f07aebf5849c73164fef0d87b550cdf9ff5b1ab2
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:wQRQyi36YOcPQLvw2gAf+PN3t1Ms
TLSH
T154667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 91ce9023710554b620f4fed4087f8f565a8438009f682157bcaf5fc204e29249
MD5 ddc88b9924934659a55719a011426baa
SHA1 242aa3838e4c995410bfd030ddf3f33ede3dbea2
SHA512 6f95496c8e2f2bfcfcdcb4bee509f26149b91deec7341b99d3d473342927b04989a3c00649b811049e2b03c5b7586d59f1288ad10075e69d0da77255ce28204f
SSDEEP 49152:q68Qg55nhheWu7PNU3/c/ouy8grLLesK:YthWRc/f1Ms
TLSH
T102B54933B2F200A9D45DE1769F4A872196D17C758FE0E3DB8541720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d6558da58350053b024bc5071a8eef436dfa8bab122d480688d86f5ca837ca16
MD5 50dd91223c73f57e89f3981c52b367d9
SHA1 11c7336dc55138084287bc29f1f36342fa852ced
SHA512 5dd96163df64d76ea2b7be6fdcc90cc262d0df70ea17eccd608d8561207b998fa1752d02e23bff1300868e7214c9d22c685e2148a69958d3c6906eb4aa83646c
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99C:Qy5112gYy5azzVvL69nLKnhZ01Ms
TLSH
T129167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a6e9fa4a007c2aa66139ea5ed0b81be8a39f30b5335e076dafd31374134cb4d6
MD5 c820e1f8508376e5abda4a01a759919f
SHA1 0b0208bb9c4fe59dd466232ff6becaaf0f3a50f0
SHA512 5f9fd0eeea4888fd51d5032beaea36b3479309353a84688bb2138348f08585a735ba548bde1427387cfaf035b89d6ba6107f274df2d0c6c4101834b860248964
SSDEEP 49152:rB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gle/ouy8grLLesK:9u6JmVxd2d11Ms
TLSH
T1E9D59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ad24e218729852a9965b6e6324d77b2910858e07700258690ab0e20e2d4f5a81
MD5 63f2d4780f0daf64c12510897818c572
SHA1 ff5cd2951e009c1b1d039bdfb89aedf60167c872
SHA512 04bb4b788e35ea5b1d0d9f5cccb0b8c73cdc0934c736daba2558e1a3252314cfeedea0586932acd45e74f4ddd0d1bf6f1099211fa82350e92374f60cc39890c6
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4x6/ouy8grLLesK:ImifPbRa1Ms
TLSH
T11BB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 09d33a33896bbf65e2aee603719ea1d8e2c67a7bd68971499218def86ed3dbe9
MD5 8efac855cf1fe70a5f48a1bb183bd601
SHA1 28a97b27d146e89e9849b68269c29aa6ccd18363
SHA512 800493333b525a40f4a0c8a0a267549e3708d4a62146feb58337675660fd54ea0b969149c25e9d5b8d46abc1bbd0f21d4f468d95222553764be17340657dfb33
SSDEEP 49152:jSuZQIY0Be2KRRVtOnks6NMHqf/ouy8grLLesK:B5dKTi61Y1Ms
TLSH
T116C5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4511b00e780dd9da6575a0dcc739c29611bf9658d1f8e758fd011b1c28fda825
MD5 472a3e639317f03e8b30c5dde239dcff
SHA1 e50b778752e084aa31b553c79e5012fe1103c6d0
SHA512 002ca23429f4d3e1de52516a63f469f59c1cd0a01062ee5a105e99385a027bb8684489bd59a263ad9f9265c5c38daab8373f5b799504754f188791e1d783a2b4
SSDEEP 49152:whtSn8EApI0figngiDn0AP5wu/ouy8grLLesK:hX2iyphm1Ms
TLSH
T1FB95BE13F2D900E8D06ED178C7568632E962BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 674414704fdb5da26565da4ca56e22b593d684b9e3048a3397e3a381714f3456
MD5 0c0667e825c23eddcc30b4e927e7ed74
SHA1 043c76de6e18724c888fb99b841425b7f0bcdc5d
SHA512 3c826d79185f5e5a6b990b00ffa6b2977652397f5648b6f4dcb33a4e37b242b3c13f2419fc6ce36c5349883d1956897e44e259c5fa51dcc9746cf29c85961632
SSDEEP 12288:0j+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:0jUOoTqy8QCYrLLeYKUML
TLSH
T1E5C423190CA11D63F4BFCB35D42700A1D04C5EA79A6202DA6BCB6426ADF8611F77F5F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8187a7b87c5d2b10a42d6a8d6d3b5319b1f84b67c6778e30e96eb706adc9aa4c
MD5 af28cbf55577f31ea39dcbaec07f7492
SHA1 120aca8ce00fd18af3b5e12bddc9d416f10b7d20
SHA512 57279cd25d0b2159f816370b5177ee78c874b521be304a6ff38b536a2b20ee7dc286f1e1d0cfaa01c8f9f52ed03ddc2c4a1a639fa1b0c8526769917e522ff459
SSDEEP 12288:gw+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:gwUOoTqy8QCYrLLeYKUML
TLSH
T18BC423190CA11D63F4BFCB35D42700A0D04C5EA79A6202DAABCB6416ADF8611FB7F5F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3188e0c4d9c76634f7a814f146f910df9f176cf764bf7eed73d599a0e1f33aa2
MD5 14a93931a5609657574daaff5f2ce536
SHA1 f4a5298d4332a81fd58c003995c6d9ad2eadfdfd
SHA512 07a476969a822581b861e0552ee3c7d6f6e1c40aea85c214ffa8f03515cc6e98b165b2bad227c0a2db63b3266ea57262168afec1631ed4fe49735101d21ce29b
SSDEEP 12288:kC+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:kCUOoTqy8QCYrLLeYKUML
TLSH
T102C423190CA11D63F4BFCB35D42700B0D04C5EA79A6202DAABCB6426ADB8611F77F5F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 bf47eb82cb6496a6e43a0d4ec1ae90b6aa7cf944c4f02b3fb1d22cfe76b5e106
MD5 e12d73a5a8ed1f2dcdf4e5e3cb01ce21
SHA1 e560476edb4f17464f7478a255836353ddc24d62
SHA512 b1883ab67ae7cb76438508e89d2086d0c2eb33e14510ad97bd55cea93a2f284ad791fbcc57ade48b89a51256e3c07502fa7aa3b465eaec4f13360337650bd576
SSDEEP 12288:uVd+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:sUOoTqy8QCYrLLeYKUML
TLSH
T179D423151DB119E2F8BFC739D4234061D0A8BDA69B3243DF9B82141A1DB4710FB7AAF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2f8fc39ee3aab1c391c22bd199e9bb8d834114144236aaa184a5bd1c542de444
MD5 7a73dd2e6b7bc9a78dc6b02bb081f779
SHA1 73db5382bf91950c8710f732e892ca3428f779c2
SHA512 5d1eec08641547b047145e98a6808e105c9bf1d83e9df9db0bab1ff6fc7cb60f7421e1cb040d7e8f6f932dda547ae5bc33b7a3f76375ccf412f2fd5cbcebe285
SSDEEP 12288:pV+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:pVUOoTqy8QCYrLLeYKUML
TLSH
T1DFC423190CA11D63F4BFCB35D41700B1D04C5EA7996202DAABCB64266DF8611EB7F5F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 63d66cbc1d069a17a6e4e32673ba4bc7064a4b0f0ff9517cdbea7da32c13df3d
MD5 fc9ae39fde5ac50e40f982f7aaf36a74
SHA1 308420afb4b3d00b6e8c78bc7ecde0e1304fb6a8
SHA512 4356fbac3b0817b4d9d5dfb32b1fa0f9306d51c5baf1ad60194691a34a4db530e8179da35bfaaf1d8a5685cf866fedf9250c0e6a6ca1b719dd84462801a4f0a9
SSDEEP 12288:B0+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:B0UOoTqy8QCYrLLeYKUML
TLSH
T140C423190CA11D63F4BFCB35D42700A0D04C5EA79A6202DA6BCB6426ADF8611F77F5F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 c3ab94cfb751b6f34edc4fdc0fb8dad4f15ab71935fd979e95cc24050efe2607
MD5 1e14f3fbcdbd825e9fa87b2b319db668
SHA1 98a2942a93af11a819ab3c5b9ff9f5cb59791549
SHA512 8c78461092fdca4938d7e9ba517842124845f5be11423461ceebe65b8659c562cf3979c5c346a8e75bebaef586cb0e6d4a1d4e550e75334c3ed872e80ccc8e4c
SSDEEP 12288:pI+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:pIUOoTqy8QCYrLLeYKUML
TLSH
T1C3C423190CA11E63F4BFCB35D41740B0C04C5EA7996202DAABCB6426ADF8611FB7B5F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1c55acc4ff54104397d2e69b004cb5341a8cffc84ea4002527e78984247ae1da
MD5 2db727a88414d22f1371b2119bb41e66
SHA1 d709eb9316f286f600b8017dcb0b64fb9f4de4d9
SHA512 4d4f699e11519808f3a6175563ee74788c7239a72eab3346844d41c8f323f8304b09cfde23fa4d96767481686a7f792f4e6f1a40cfaf0b05f7d24f0de4f23b0b
SSDEEP 12288:4iZwb6zzFEoS2cPvyQ+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:7ZMSzFVSOQUOoTqy8QCYrLLeYKUML
TLSH
T1A205F19577A01CF4ECAB823EC8268516D1B27C6A0B70C65F03E436265F733615D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b12532b9e1bf5743a635d218623a31a9e03dab5d2e68b34b6a12757f5ac96d5f
MD5 8e8a6d3339e90d3cf6846c8588a403bd
SHA1 d9d2210b4028538c116ace1d959c2d3ab9790f33
SHA512 103b9bd2805f3fc41b558698e8ee456dfdf5d780345a07a87ec68034bea9004b716f36fae87cac64bd300b9f76aa5d55c78b8076d59a5835bb4bf2d2a3d7173f
SSDEEP 12288:Yv+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:YvUOoTqy8QCYrLLeYKUML
TLSH
T192C423190CA11D63F4BFCB39D41700B1C04C5EA7A96202DAABCB64166DB8611F77F5F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 284e2b4e8f7c4a84ec47299d2f6fca836dd4ce57c840df26a20576b9352d4441
MD5 6283f1d8c8ecae93817162f1dffb4e77
SHA1 90563af0a3f115577e04f039d8f2eb6f50f230d6
SHA512 a36100240aa32f9f2ca4db7f9ae33f3a6bbaabbb5e3c1505f7fda0c1d3096d480347dadeb292693827547937a7e7aeb2bf8414eb32171a6f8ec7200179cb05a0
SSDEEP 12288:zr+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:zrUOoTqy8QCYrLLeYKUML
TLSH
T1F1C423190CA11E63F4BFCB39D41700B1C04C5EA7A96203DAABCB64166DB8611EB7F5F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5cc75d375f699e08c51c5edafff87481e79469c5c9198a3f5da73943a0698c63
MD5 f953f60076036c888e771f19f7903276
SHA1 3cbec6ee03099edef16a4d52a9f3acf829e0bd31
SHA512 e1e746e83727adfd42157e5bc7132a55fd0f92aec86038e7aaf70c3b4306c029f2c278f850921bec46ccf59fd7a9c02bbaafec5344402e894278c41ca0fddccc
SSDEEP 12288:syPz5L88+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:1zy8UOoTqy8QCYrLLeYKUML
TLSH
T119F402172AA130F5E07B8239C8621511F375B8364B218BEF579406762E77690EE3FBB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 bb20136a0631b4e24e957320b8c0f7d7a5f4cb4b57871dd07c003dc36617e6d2
MD5 605ad90fcf6ee99b3e80d4c4bac25750
SHA1 ddfa7dc15fa47cc103efa6e0efcce166150f8b05
SHA512 4284d2abc49585291b02fde2a0cf38e11c95208d386c404ad05633873cfaf26979558c548a7c70f6581d5e0e231cd4be5e028dba8b824841b04e3038d76727cb
SSDEEP 12288:iv+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:ivUOoTqy8QCYrLLeYKUML
TLSH
T1CAC423190CA11D63F4BFCB39D41700B1C04C5EA7A96202DAABCB6426ADB8611F77F5F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 218fb84782ca301020bffb286893ed960ea6ba2b25d24a1be3a5ce691c433aee
MD5 adc6183ee4fd5e189dbaff34d8bb194e
SHA1 85a7f18908699fb90e5bc9db44646ecac8695f1d
SHA512 7dd9450d24fd54141dce2f6a2b9c01f07968550f530e9ea8ad88e964732997bf4a2bc87fbd9f741625c2d0c4b7a37e6c0c9922f412c0c46af44d8b6be16eae8c
SSDEEP 12288:av+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:avUOoTqy8QCYrLLeYKUML
TLSH
T1DEC423190CA11D63F4BFCB39D41700B1C04C5EA7A96202CAABCB6426ADB8611F77F5F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 948486170387cb25a6d6106ce2e46d03b13b152048fecca85c2b7f3caf10eb25
MD5 70ece562e25699bc8236ff94ae726dc7
SHA1 18f606d786e100e04cf9e6c5a92554165c6c3863
SHA512 80f8769beca13f0859e977de66592a4bafa4a7be8b8586f62deb7690e657ec207483633810c1b5921e6df7dbfe82eeab604f6e4d9d9a7f76f9b4172a1a87816d
SSDEEP 12288:MyPz5L88+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:Vzy8UOoTqy8QCYrLLeYKUML
TLSH
T1D1F402172AA130F5E07B8239C8621511F375B8364B218BEF579406762E77690EE3FBB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 4b6f63013297c4374d642c5b7158e9707242c7f2d27a6b0500120d8f39e2fd89
MD5 33ab4a804e6f5eec0377a43e4af34ff8
SHA1 e0272dda0ccbdd1523473a3e73bd59494e557c32
SHA512 2a77352a21093c4c3ee5fb1973acf9199f8c6f250aee6d489d45aa7808252f08fad5cb2ea7e4333322ab0ea4ebf7278ddb97e2ceb03f89287dd01865b95c7cc5
SSDEEP 24576:ICUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAmUOoTqy8QCYrLLeYKUML:ICUxPTY+8Wg2lIL8lrIUJLWwV/ouy8gW
TLSH
T1C765AE1DA3EC0896D4BB813589518A16EB32782E1B3296CF2160C33D6F67ED55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 0a72b89ff7a4f21c27034e91f44a09780ebe703f61a89197998291990a0d4531
MD5 3489127382b380980f17d50d67c4898c
SHA1 1ad056d6db26fc606c3b166dd255a68e6e06e920
SHA512 e1f4da8027814fc9fec83f9e547471f08e10dfe031ab0fcd232e66d25ec71505786be3808bb74c3cafe125cc76ef4eeb4b56fc12980a476a2c204ba54c309b88
SSDEEP 12288:HNsff+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:EfUOoTqy8QCYrLLeYKUML
TLSH
T1EDE40119C6A402E5E06E9239C7164240F3277C6687E2D3CB57C0F53E1F75690AEEAB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f978e125945e5700235d2ce586102774569e00209b76c1a2556bedad86720787
MD5 505e5488faf7882b81501882b71b96a7
SHA1 2d7ef2b43d2bf54c5e2a20d517346b1e98c9631f
SHA512 ba589e750287252592d816330c4a934c45fae63d0dad98232ce612387d72aaf9b81ffb0e6535bcc0b2707ddd9e5f793d59cef603f8c11ce564628dfd051650c6
SSDEEP 12288:mi+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:miUOoTqy8QCYrLLeYKUML
TLSH
T165D423150DA41D63F4BFDB34D42B5030900CAE769F6242CBBAC621566CB8A41EF7B6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 fc64b453a6cd276f348872a056681f8e466a4554b292bf3982e03b06c2f73d44
MD5 91d8fbfff38bef03f1d2d96eb0ad8189
SHA1 165651edb5dbee77ed640331ec48ded23f742ede
SHA512 c001a3985a5c4ebe3f9745a292985d2b96b325835212bdb648f505f6c01cc362d33443c2d259e15f2925153a95cbd24f1fb776afd051260493a9030071e1c3de
SSDEEP 12288:zbxA1U7Ky+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:zbxA1UGyUOoTqy8QCYrLLeYKUML
TLSH
T1D8E4022E19AC18F1F5BAD63D88928105D3317C26572153DF25C5827A0F3AEE4AD3AFD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 759462374f299742314ef46be4aa203c8c6f5f304dc4a3a7b759d03ee473ec2c
MD5 5e7dd87c418dd87398dab18249fc76f3
SHA1 2674f953d67de3f29e2654f8eff0c0499baf4aae
SHA512 618e73aae04fe3119fef98eb6f204f7e6987b3c55ff87bcd2bc469813faeba48c142a693be9e653dda11b423579cfc63a47afc93ffaff2a9920375ddb6e42893
SSDEEP 24576:tjsmP0yHaqrVqHra44KDzMsrntUOoTqy8QCYrLLeYKUML:tjRP0yHfVqzlAsrnt/ouy8grLLesK
TLSH
T16A45AF2EF2B910B9D4AAD236450107B5FB71742D1F219AC70170C635AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 149f82975002dad0b134e1325beb5f46d3e94e192c71b1f7038ba6c6a632f10f
MD5 308b76899576ecb0a95de32aaf277802
SHA1 621f06bfacccc6ee9110a4be8535fc0b2435425d
SHA512 e1d26bdf2e174fa24d3310885ad63966469e227a454b25bf4a9d6a5b8d64688a52e5ffa50a75b30b59e5f3a172cb23a8d933ffbbaa5871e2b0b47b8c6cf4ac03
SSDEEP 12288:5U+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:5UUOoTqy8QCYrLLeYKUML
TLSH
T185D423180CA11DA2F8BFCB39D4174070D0086E679F7303DB6ACA65265DF8652EB7B5E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 8e493b9d53e1d79853abd0c37fa0ab6c3e463f0bdd10fe34b3b11625cbfd46c8
MD5 8a25c0b98d7488e88f5353b8625ae66a
SHA1 c50b1875f2619a74855c68a1daf80913aae4c5e2
SHA512 96d1a6e2eda699295c7658794361538a2b4704d3976a31dab6c5b9b6403e5ef505dce7052e860e5744feab2407b0c44e5cdaaff1af75bacbc8b331d7db9f1e5a
SSDEEP 12288:tOb9A4LWO+vAYFTu+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:KpLBUTuUOoTqy8QCYrLLeYKUML
TLSH
T1FB25F115EAA404F5E87BC23CC9638526D272B85D0760E7DF03A84A651F637E18F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 660621b3b2eec4a12b9a71529c213318c246ce96dac884caeda9aa3c19f21cbe
MD5 afea3764b7aa00a9d66e045992d4d991
SHA1 8c62b74019d4b4b5ba338084a2b7aa3f2751674c
SHA512 cc093ae27db163e49612e24d80743c717cf73f235347aeef9986f88e01f67a01070a83198b9f4ac0b6da7bb46e2641c8207a2d98ff89840eaa06a03f4b1d4e48
SSDEEP 12288:M70VmvIYNvUyBpT+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:ZrYNHJUOoTqy8QCYrLLeYKUML
TLSH
T11B05F12E56AC0CE5E57F923DCA838219F1727866171193CF05E0827A1E17EE8BD3E781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 05dafa825eb4d3ed43b833c00c118bfd43b1bfe917340a6e1104e1726379b73b
MD5 c593c6fdb039e2d7c643aa092c9c0879
SHA1 9ed8503361b95c4c5aebf3d7366a6f27265beeb5
SHA512 1c0d99e4e37774916fc240557533483b8654a265233a49e418979400f54d2af7acda52d755a26d8d99da912ab3d4a6685aa8b8bf90243826bc8dc007f23bd9ed
SSDEEP 24576:5nXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKm:5nXoJJYH84VVS6AmEcJas+cHBjSSKHP2
TLSH
T16F65BF6DA2BC04E8D5BBD17DC5834506F5B178621331C6CF026182BA7F27AF5AE39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fc44fa1066cec0e3f9de287e3e7c497d21bab6f73c09f28b08049178e8a2465b
MD5 9240ee4c3acb1de94f45803d2fc948d8
SHA1 bfc9270b227538c50127d47973e580ab52a2cf3b
SHA512 e43460556f7d81646905bc0bb95da74d5926d668d3c138b4b9c4ddfcf37223b9dee07d7a6d82c7a74606bcbbdccb2a235754aa3521a6fcc884b1bd284fccef20
SSDEEP 24576:Qv7Xbxd9Tuycf8M/TYlSuxrr2PC7UOoTqy8QCYrLLeYKUML:QDLL9TuJ0M/TYj2P0/ouy8grLLesK
TLSH
T15F858D5EA2EC42D4E4BBD6BD85B79046FAB2B855173081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 cdedd0c24993889788a05b14d000c5c4a3484bdc92d86e3bb3a7309a69c786d0
MD5 d8d702c2f77dd0e76b01d83019475035
SHA1 006ddc14a173861f2f5837daa3c2f2f59b366533
SHA512 c1c3b7ffacfc80e63fe50d3801fcfa001f2af759f4496b8af75cd060c78cebd5e4255eae38fd06cd5b3d1edd4f18ddf1c69990d0ffa11f71e5a7418a8857549a
SSDEEP 24576:WegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wuUOoTqy8QCYrLLeYKUML:WngOJOmPOHhu/ouy8grLLesK
TLSH
T13A55CF3FA6BC15D5E03EC17DCA938816F6B0782603255ACF0590827E5F1BEE46E3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 fa28d4b23d7300296e9dc99ae192ac342b594f05bbe3b6f8cb066c2728a11ab1
MD5 e316094bbc423c88148869ec06c625af
SHA1 ae25fade137931926eb2827b7e7acd3330cfdc42
SHA512 28e6e8ba3a071b720b635db4aaed3af3e5f22e25f1516e976e2de3688820cf079e5a41d100cb020b2bcea7b0cec19ddc1d278b18ead395775c94c274e279360c
SSDEEP 24576:xLJnJiTk3R3waE4JrO0UOoTqy8QCYrLLeYKUML:xLJnJK8R304ld/ouy8grLLesK
TLSH
T13815D03CD2A810E8E4B7C2B4815A1656FF31347D2B2269CB59B4D4313F12FE0AA79F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 bcb636c134c8c326fa22bb477a113da9ec1fb1da26ae4686681b9984f2ae04b0
MD5 304a7f4ce9af1f9a506a22ffa0220597
SHA1 c6807aa03807a79ba67a19f5f49d5d40f87e1daf
SHA512 4ac96d14b1b7c45c501c7c9e4a954ee6ff41dbda84d92c2d8677e57214765325346410d179c633b97d8f87e84c54ec6c1f7f04463a31483b962db750cc8c33c5
SSDEEP 49152:39mqCzDScAZmlvTcFg8Ph6I/ouy8grLLesK:rW1Ms
TLSH
T18F955C05F7EB5294F8B3CAF1C96294159A327C509B34F7EF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 331a54d57c4b299e13d4599adcbede7b99e0233e3c25363e9af6191b984d22b4
MD5 78a0a862a0618b67cd7cabd523b8181d
SHA1 ee72d5477ebeee84253598516500e8e250c2671c
SHA512 52781238b26c327d86bbde20ee65d1d1500c8f1da95e561aa1a2e0c3b01cc56685031145e8ab68959364d0cba155cbb9e9bad493c9bba5156015f95a3065e085
SSDEEP 12288:slYJeXm5nkEUuE++lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:slYJeXm5jUuE+UOoTqy8QCYrLLeYKUML
TLSH
T17AE4121D29A830E1F17FC239D4624154D371B4B2571213EF56E0C17A8EA6AE2AF3EED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 e620d6e83e4d0f1244295bdcfbb263f942b54b49feecaf3693c3aeb9e7367bf4
MD5 758d2d92e896e23fb9c3cdf6c9567a7a
SHA1 3dc4e07a5fa0677056285716c96dbc2138910c11
SHA512 d03721a5ca2ee8d9410862ea7a3c67874654f6be4af4ba843894f7a63e2a830baefa69bcb29d36fa4215ddd91a798dd94790f5241fdfa7fdb7ee8859d388ef14
SSDEEP 12288:Zmu6kyN+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:Z7tyNUOoTqy8QCYrLLeYKUML
TLSH
T1A3F412042AA025A1F9BE8B38D96341A0D538BC318F2143DF55D1E63F6E757D0FA35BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 ad372a43c83712f74acb10fb484370dc8ab5005c0e515c0dbd27bf7cbe575af7
MD5 4a2fb0b47d3cd0c57341b30eb66d66fe
SHA1 dab09205a58d845a3e77046483945ffd066f66c3
SHA512 23c156008f019d5ac5b832997d6b5e427b156fd0a4832c2604b51114159520385d05a5b2635ebc09d2f757d0dcc6c817bb55fc002bab39d298a3d6edc080a201
SSDEEP 12288:xPu+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:luUOoTqy8QCYrLLeYKUML
TLSH
T1CFD4231C0C712962F87FCB39D4270060D0587A765B7212EF69C6E5369EB8601EB7B9E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2a952857c0dfb50552039546cefe0d6fbf85ce0ccbb87a6f0189f6417e758d26
MD5 257c54a56f394e6dfe467d950a0c329e
SHA1 5ea344c80615f9e8482bbf8823bd3f1b81a87183
SHA512 62514ea3756e6484d8ea3683e77dade7b6687b9f35dab526bd91ff4fdce857daa613beeaa6ee5480920f355fdf1b27c31c2615df66bce2c0da542e25b8a0bcd2
SSDEEP 24576:0C+TyQIu93VAumZr7jm/UOoTqy8QCYrLLeYKUML:0/TfIq+Y//ouy8grLLesK
TLSH
T1B3558C1DA7E91DCAE276C675C8A34493E533B872137186CF2084C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 fdb1290c09345f35f331434bafdd6addc00109e4ed1249d44012835b51949793
MD5 bf74c56666100503e54a82ab9f4e7357
SHA1 85475b3f7ace51a38762dc272acac7a0041ba002
SHA512 11d5ae1efbb43c5be7eba1a347c266f8e72b653ee9867f64105180fc8de15c2f0fb334498657649199cb9f4cb799664d9f8f255cff67f12eb1a131ba0949fb4c
SSDEEP 12288:mGcyrWOstaa3kcsK+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:mfLQikZKUOoTqy8QCYrLLeYKUML
TLSH
T13EF4F10EB6AA00A1E0BBC23CC8464151F2B37475572263DF46D1C7794FA76E9BE38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e072c4facde830b3d9d3cb6a01b04b35f8628644f6d41ec4cbfc7e704cf587c4
MD5 7e893cb3734d61f2977893209a6c777f
SHA1 f56f2be92d28d93435d124ccbb0bcb8a7a9e44b2
SHA512 eee33d39a2f8353f605e3bea2142ae182071d50aaa8a17df18a481d8559bc3a7dec21257410a56778cc3ea6e158ab7f053018f409c9cfe3de9f5b19f3ecc44f7
SSDEEP 49152:FpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPN/ouy8grLu:mpC7b4+80GTkD1Ms
TLSH
T129A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.7MB
SHA256 0d661d91a213ef2bc7118247f7fb1fabeed51abb960fcca2bdf6ab9ea48b6125
MD5 cfcdb8d609be8b73f32292ae9305e023
SHA1 1ad66c12a7510978d6ffebd193034a290e6d4e7d
SHA512 73abb37d9a984714977342e0d81096963207c57f9958f6fb2cb52ee0b1cad8c33cee998116c0107291aa4d4fe18d5690f24df49c6876de1c160019ff0ff6e701
SSDEEP 24576:88RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCMUOoTqy8QCYrLLeYKUML:1RZwQCyiHiQEaiPnM3/ouy8grLLesK
TLSH
T11485BF1E62DC46A5F0BAD278CDA74407E6B27816473197CF0291C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 85227b9cbf987a18f734e74ead4e190b4f6c9d5836d80ad724c0142bc1c62c04
MD5 cedeb46b0d62d188f528861a91961574
SHA1 c97eb642f7c35aa60df034196c89a3e7717ac1b8
SHA512 5eaed61920e29b6366366716ad6f944cca9dd21f8742a78cc3a83347421fe7dc9244ddce1d2c14384a97bba0707a68b8bc55187f8b86b34bd0c54825b27def71
SSDEEP 24576:6SAwJPE1IDAo+4Kt+l44135UQ1UOoTqy8QCYrLLeYKUML:6qPCIo4Kol4/Q1/ouy8grLLesK
TLSH
T19555B02AA7F946E5E17ACB74D663C111F7727823133163CF5290813E0E16AE89E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 bbba33f9865f33067938e42ab990f60f3e583e19bb7ae4e9e48385dba583501f
MD5 5d85e2e25d6c43339f90d03f83c19d1d
SHA1 5625eb6e13028bbb9f0b54648bfdb96d84a567ef
SHA512 e23aabb737edd80e60e23ce64b3a5a8c6628366182c9827ae8cf693310f1dd19dcd0898a8cfbc3e50656c8232a4430d7526433d5cdfede1d18cf8653f5ae471f
SSDEEP 12288:zSsyLCFBoPLCRyf6NQ4tF+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdB:3yLXPLcM94tFUOoTqy8QCYrLLeYKUML
TLSH
T19A25E03EDA6C08F1E47AC27CD6638506F67238AD033166CB15E091791F6BFE4A939B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 34739b7e6fabcaac3ff5aa622b21e0394b2b635312febcd3be5d6c55e3e6c94f
MD5 9d5da50b82368fa0445339a3805f67c1
SHA1 ddd7f3e5d7c2d787c4a45c9da4839715bbc67567
SHA512 18de11d0315bc3a0bc875d1730389487677e6f70fd0944543b3886b2807556c0d6bc975ef7b8311da64d30cf557083ce0b6fba31e0d0abc25eaee69b10bf2ff4
SSDEEP 12288:89lyvj3IkxjbBz6+lCFcD1goThydrWUeB+QChZsrwbebPeVmfCUqVfZbdbHF:8Wv8qjp6UOoTqy8QCYrLLeYKUML
TLSH
T1E6F4121E1AA028A1F07E8734E52381218075BC76177156EF75C8E57A4F74AC0EA3FFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-395-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/388-198-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/388-200-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/428-174-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/428-177-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/428-300-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/480-47-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/480-48-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/480-57-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/480-176-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/808-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/808-97-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/808-95-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/808-89-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1124-212-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1124-203-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1124-209-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1124-521-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1608-247-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1608-254-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1608-241-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1608-249-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1608-251-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1608-253-0x0000000000660000-0x0000000000736000-memory.dmp

Download

memory/1664-158-0x0000000000870000-0x00000000008D7000-memory.dmp

Download

memory/1664-163-0x0000000000870000-0x00000000008D7000-memory.dmp

Download

memory/1664-288-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1664-165-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1860-115-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1860-121-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1860-124-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2208-32-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2208-155-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2208-33-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2208-18-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2212-301-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/2212-566-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/2460-140-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2460-264-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2460-132-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2460-138-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2472-42-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-30-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-1-0x0000000002780000-0x00000000027E7000-memory.dmp

Download

memory/2472-417-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-0-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-60-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-46-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-58-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-41-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-44-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-12-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-14-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-11-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-13-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-15-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-29-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-26-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-65-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-43-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-64-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-62-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-16-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-56-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-40-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-37-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-8-0x0000000002780000-0x00000000027E7000-memory.dmp

Download

memory/2472-27-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-28-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-39-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2472-123-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2812-235-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2812-229-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2812-237-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2812-560-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/3020-306-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3020-567-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3176-262-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3176-265-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3176-561-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3176-256-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3348-226-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3348-223-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3348-546-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3348-217-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4024-277-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4024-562-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4024-268-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4040-526-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4040-305-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4040-188-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4040-186-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4040-180-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4052-108-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4052-113-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4052-100-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4052-106-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4052-111-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4516-289-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4516-564-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4644-125-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/4644-74-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/4644-68-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/4644-67-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4644-128-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4644-127-0x00000000007B0000-0x0000000000886000-memory.dmp

Download

memory/4684-78-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4684-86-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4684-211-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4684-84-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4712-152-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4712-156-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4712-146-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4712-276-0x0000000140000000-0x00000001400CA000-memory.dmp

Download