5dd12d69298230e874f67b9ec402e5367eecfbecb5d9ac950dd307f22d57a672

Analysis

max time kernel
148s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
Size 5.5MB
Sample260427-pvsppaew6n
SHA256 5dd12d69298230e874f67b9ec402e5367eecfbecb5d9ac950dd307f22d57a672
MD5 a36741a614684d46f1c90950dc126a47
SHA1 6ecc2f7f774ef914ac7f99f65100366351df1b77
SHA512 94c9350a71fc8ae77d384f30e05c6b691a2e7f22dc80016c6a259e10256a258b77bd9befc480f753f55bdba33d7aebc1a40b85a128d6fc5279f74e738dfae0bc
SSDEEP 98304:NHnFkb1kjZ2vFFWjb8ww1V9CYPASWNZ7WCGir9raRtvVjiwy3GR3klNIo50:kb1+b8wwxCYP1WNZWy4tJiwy8kwo5
TLSH
T150465B1267E9A039F2B31770AE39B36456B9BFB55831D10F7244260E1EB4AD1F934B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1660	alg.exe
3128	DiagnosticsHub.StandardCollector.Service.exe
2632	fxssvc.exe
4388	elevation_service.exe
4472	elevation_service.exe
444	maintenanceservice.exe
2420	msdtc.exe
2828	OSE.EXE
4716	PerceptionSimulationService.exe
796	perfhost.exe
2204	locator.exe
4740	SensorDataService.exe
4356	snmptrap.exe
2392	spectrum.exe
2448	ssh-agent.exe
3348	TieringEngineService.exe
1656	AgentService.exe
1692	vds.exe
3844	vssvc.exe
5108	wbengine.exe
1916	WmiApSrv.exe
4252	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\af93c93214bf40d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f8397fd50d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dff88dfd50d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005257edfd50d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006431c7fd50d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057978bfd50d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ace2d7fd50d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3128	DiagnosticsHub.StandardCollector.Service.exe
3128	DiagnosticsHub.StandardCollector.Service.exe
3128	DiagnosticsHub.StandardCollector.Service.exe
3128	DiagnosticsHub.StandardCollector.Service.exe
3128	DiagnosticsHub.StandardCollector.Service.exe
3128	DiagnosticsHub.StandardCollector.Service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2992	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
Token: SeAuditPrivilege	2992	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
Token: SeAuditPrivilege	2632	fxssvc.exe
Token: SeDebugPrivilege	3128	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4388	elevation_service.exe
Token: SeRestorePrivilege	3348	TieringEngineService.exe
Token: SeManageVolumePrivilege	3348	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1656	AgentService.exe
Token: SeBackupPrivilege	3844	vssvc.exe
Token: SeRestorePrivilege	3844	vssvc.exe
Token: SeAuditPrivilege	3844	vssvc.exe
Token: SeBackupPrivilege	5108	wbengine.exe
Token: SeRestorePrivilege	5108	wbengine.exe
Token: SeSecurityPrivilege	5108	wbengine.exe
Token: 33	4252	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeDebugPrivilege	4388	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4300	4252	SearchIndexer.exe	106
PID 4252 wrote to memory of 4480	4252	SearchIndexer.exe	107
PID 4252 wrote to memory of 544	4252	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1660

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1924

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4472

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:444

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2420

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2828

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:796

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2204

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4740

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4356

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2392

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2408

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1692

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1916

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4300
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2988 3036 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4480
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3020 3048 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6b9c5ca1a52cbbea6f14f820bb16b5f2ec98b6a7dfeb9f5bae41a6dc72e85fbc
MD5 7581476053b55b2555c704d87672230c
SHA1 3b1117f107a8336645c0ebe5acd436c490bcdd5e
SHA512 c4720797b4828ffb84b67c4148d0cee8e878ded218d302a6e438a3f4534da9d04ca72897b8cf8e036c98e93b8c4ce6c60395c43ab1f472d7b285acda026bf1eb
SSDEEP 49152:tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnj1PlklNIo5uz:z3q6HjBE3klNIo50
TLSH
T1E8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ed35cfdb29f413af88e131271a21b61dff560c6c6959c1ba47d46367e5c4011f
MD5 50bd6974b74ac7d4e910980889e03fdb
SHA1 e2d023f3c24d7ce4f6225f5fed8ea32dff9db7a5
SHA512 7c5dd6b6187780b7021d85b7484144030e3e35001f338c4625a3259c1599247aa79988124a13f42d238568509703eb64d2ec405d6309c30170c4ebc44bc731fb
SSDEEP 24576:qXYfDtczAiu/GT/2S1FtlkR4sNhCu5kTMsjz:xtcx1PlklNIo5uz
TLSH
T10D050128A7E808FDED57813CC8A28511EB737C9547A0E78F03A499661F336D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0a1e1d884d895063145291d8ebda317f68507ede6ca00c7150a106cc0dd5b40b
MD5 ee2720f183c06119912cfa474a4c40ff
SHA1 fcbbc484300176f2242d6de7a1e65caa4c5901ac
SHA512 f37585a1c88a01c8260d18eb5be174b69323e397556aef54b4e9e39b60f7c891d7035872aad1075576e8dfbaf55919734eb9ce07d823b36c7b00bcd1c5a06fb6
SSDEEP 24576:d0Le5ji0hmxirMRu/GT/2S1FtlkR4sNhCu5kTMsjz:dPji0AcI1PlklNIo5uz
TLSH
T1CA35AE16F5788335D073C0B9C5D2A68AED7130865B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 238e3a334d823dccdf1f3dc1ece23aa95c8a8059728ab616aa52d2cafb07a416
MD5 4518d40dcaffd8d8c348c087db8a0952
SHA1 3a4c5bb9cfcadb08059dce9a97e7d7ab92f3b45b
SHA512 c869a1138fa45359aead42b557a4c40e7df49c25cc8fb342fe82d77d2574caa56b9ba6bd9b66f81646a109998755c7a7c00f8817e21d6122a1e44f75eec2add6
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWE6q8wyuru/GT/2S1FtlkR4sNhCu5kTMsjz:N/ezSC6vUzPvxHjyc1PlklNIo5uz
TLSH
T10E755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 17a22cd6f3b27f4b5208732a8e7e72f2b17ed9f75b3974991f318ffd974e0819
MD5 2ed6886f69092d3a26692cab5ceac73f
SHA1 e010b2912bb460fb06bddfb4066adf222ad6f526
SHA512 53d3ba7a8c0bad44e71b9881a4a3adfb0baf9e9fb4b4e2f2b77bd9e9d8c5cd965f5f19ba2b71d5bfafcf842d48e08daf88698c2a3a2b9a70b8f421ade30b4760
SSDEEP 24576:qVbqPb88hv/l+6Yu/GT/2S1FtlkR4sNhCu5kTMsjz:qVO88hXl+F1PlklNIo5uz
TLSH
T19355AE66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 561f1b887ca4564ad93e9bc5005167a154d300d8985ba176e689c0bbe21a0957
MD5 327b3a55f173098c95a58495233f6c20
SHA1 b97d1f044636b6e6689df83178acab24797061be
SHA512 b0a0abc811b10db83cb004cd8cfeb603237ac796b3a53e77aa8d402927c9422b4c8285cdbed891ce35f610c6b55d865b0b8592b3544be6705babd7b8e3c177c7
SSDEEP 12288:4RnFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:4RFu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1F6C42322CDAD90ADFF0B0034327F4FA097B57CB99EE0960F2417359B9933862BA59751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 7dcab8fcf11b15f37df1eef5468bbb33c5f64c88d1d5e2fe65c5d6618dcd5212
MD5 c134f796c9b1f2aa449ecb629829ff58
SHA1 3bcb26381bba0a470052899623853bb2e675314c
SHA512 5e8dc0ac897c37ebf8a53c422b43a9ef2034b9762324da9307ab8bb5ea520d2a50b7852cd1a35cfd02d36ef4276e8940ab3674f5045effbfad47b4e0d9611e9a
SSDEEP 12288:heBNUbTVO86UWFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jw:hJIUAu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T15A05CF3BEE28FCE2C67A8D7856918700D77278704F62A3CBD165820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4825418412c1b86c50ad82855e2c9dbc7a2de285003802fbf88e248878db46bf
MD5 08bd18e0cba66a148c65eb70041f37d8
SHA1 156842803ce9958375fa8523ee4db6aadbf350ec
SHA512 e900ba331bf4fb7bb8afafac969de62259e73979ae578be7b863b5feb1e27461927b83a00313c3e10e1b6f73c9ee9279067f5134c3a4b5510a07c20b88b0a6e4
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THg:HQvGAdlCEL8c/yRNw5CH3klNIo50
TLSH
T1A6267D656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 ff2a363974ec6a06e7956eae9a9a283853efdb36dfab83d4c3e3a98c73bc919f
MD5 b033e91c5fb7efec5976c0bf34426aa7
SHA1 6ba7b2df03463b281e1d6472dafc5d17ce224830
SHA512 8df49da0386d55fc46186a22fd0c5c98e59ed410f249a76f68e4be5a4906473fee91bb271be3d7de741d42df9361433a24773ac08e78e226e89cf1bda15de7cc
SSDEEP 24576:ndewsAjau/GT/2S1FtlkR4sNhCu5kTMsjz:dljY1PlklNIo5uz
TLSH
T1DD15E031FE78E036C77B0DB62B36C716547C79604FA11AC3E3A84A9E59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 93690be5cfa42dc0bf49269199ff920d177bda3fe0f94879afe9ccefe39116cd
MD5 a6a1269507793e0c0b81176c70c79ec7
SHA1 90baa8a17aa7c360ee6f86c8260f49caa66be24e
SHA512 b0d4048965e23be4b4257dd1526811b3dc03de968ec3b65500108a5611df6dbe005d896a02dc189d939818adc8e99b80d20d6a265d417e2a3c7b14fabc4289a4
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHYkwo5:IUEtQevvqc2W1cpV2EI32j
TLSH
T106474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 907ce497b664db6cbaced4dd9ccac705e4b26fc856cb1d231d4f791247741a6d
MD5 a70bd3220ee6050574aa1501249fe366
SHA1 6b977d42fd1210ba02106e086a0dbec718d6d143
SHA512 686783555133f605f341905fe6e890590c715e820eb6bfa51cb55d111c2bb34685a51522a30c897f0c76c49f709a5da7dd26f420c850e72cd4ade9f160efc941
SSDEEP 49152:ECbRquA/m2yL5zQfFiV+XenmE3/z41PlklNIo5uz:NoqtVjnmr3klNIo50
TLSH
T1F6D58D0976B8C1E4D1F6C37896A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9b227594e704859fa5a84de211b3be55301cb6291475ef15b5bc821e9209da8a
MD5 bf6146d43d170ec95f4e70bfef275e55
SHA1 33561bbbaddeeb10a42dd7af1d1d68cf75f03fbc
SHA512 f23758e353ee064d43e3d518e8ee6c49fa3e8f537c9d2ae2a5ea2b697a67ac07c5a2c627821de0411c8f6bcbe5162485927518435599b0f1c008035fcaba4d6c
SSDEEP 24576:fAhGLJIFoiwtA5l7S533u/GT/2S1FtlkR4sNhCu5kTMsjz:fAMyFoiq571PlklNIo5uz
TLSH
T15835AE81E7F955D4F5B3AA78A9B68570EA76BCAA5E31C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 386d9824d561d858a1f62968c79c14e0d31ff8dc15009a569b88f83efe7257b9
MD5 db4bd6f0d954ac0bd26220073dc553b0
SHA1 b65dc017ab866044f44fb597363562c2acedb6a2
SHA512 e14140572e8cec4e1afc6fe1ce996b36fa8abcbc49349ac3b8588151d218e975149ea6d331fe965dfd8bca4c755aaf2b606c046747eb0cdca3e8f60b34a18604
SSDEEP 24576:LwuoOWGu/GT/2S1FtlkR4sNhCu5kTMsjz:LwDOf1PlklNIo5uz
TLSH
T1A405F14676A80CF9EA678138865BC532F7F2BC122A61D71F1760C65B5F33261BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 44c137fa72bd9294d06a8e82061368eb7cc48ec2fefb3489c7cc7ed9d5f41cc7
MD5 e386561a0f06544c62ffd236d720913f
SHA1 fd73859b0c21fd1fa076bb1e0cbabd82b3d47349
SHA512 e76c7904cf9fe28475859db3a7f119959035af21fb48b26682e41dee5253838ea95ada6472e7de180b78a56b2bc91e1d1a5e6b4f8127541ad1d761dde7b06721
SSDEEP 12288:0BZ1IyIFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:SZuZu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T133E4125A26EC60FDF643413CA9F94B40D7B27C666B7183CF1426025A5F33AD22E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4e94e571025727265859ed76dfe6e388773400e98e0623945f1eb901c85570b0
MD5 4854c55e65076074447c607c766b84f9
SHA1 1f0476e8048113f4d8f20d73b88a6b9f25396f19
SHA512 e6cef7f6276c367081f86313625354e860864f1da9fbc0f02e25e9f1b5741daa5054b305f4320bf6a1c753f2c552d3c488f89c48a8c762dab5f0d45815ab5bf8
SSDEEP 98304:LQRQyi36YOcPQLvw2gAf+PN3G3klNIo50:6QyiKayX+PN6kwo5
TLSH
T158667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d7a494a0e5221c654ff65131962108965aeccedb03e8f6387626ad9c742884de
MD5 c1117ee0af7ef1d0355f77cca7deb17b
SHA1 58e889e0150da1548f375dc9425547e214e177c7
SHA512 f963af38cb708002079c897587eaee171831ee441a2a1100be2aefd1dc3aaef18d83a8dae75150bfa33644f0ad2c7664106a5ccd1be03f701f74008069f92a01
SSDEEP 98304:fQRQyi36YOcPQLvw2gAf+PN3G3klNIo50:uQyiKayX+PN6kwo5
TLSH
T17D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ca1c8e0cef4bac0ab70e95179bb1442a36882dedb14c787cdc5d4781abdc3329
MD5 d7e491e977bc371ea4cfb324d89191c0
SHA1 132f4e6ca8894b83b0a6cd83a3dd7824fcf9e172
SHA512 53d49bdaacdc6703255445bfb267a4b6dce9b177e7f029f148b0a3ba4b3840edbb7288cdf15e6a3c9ac0cddb6f01abc9927e84d1ac7bb7f9050d04d5876c753a
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0pu/GT/2S1FtlkR+:q68Qg55nhheWu7PNU3/I1PlklNIo5uz
TLSH
T1ADB55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2c9f887c6c071ffcbdc894ac955f9e7b8185bc95a71eba4ecac1e32e15ae3b2c
MD5 3f2ae850a86ab764bc62a99433e948e5
SHA1 61aea6935fef3d20e35369a785fcf37ef6b1bc35
SHA512 1ca0bfdb38d7cafe1679386dfe9a612a490c55360077b0a65638a5c1a573d2356d5238ad4520d2c5ef2cb403d4dcbc3dcfa6dd8960d73cd2fd99ce5bc6f2534e
SSDEEP 98304:Uy5112gYy5azzVvL69nLKnhZ93klNIo50:VLIHmWh7kwo5
TLSH
T190167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 30007a1b26aa4020d94f9cd15c10807551323d82fcc5b6625ebf097a480cd1e7
MD5 6c46f24b9d39661d6661d5a9faf27abb
SHA1 dc5180ea4602d8528a6ff964f50a99f48e4759e6
SHA512 c6acccada48d631383ff60f6077e918a05b4ee5adef90ceddea1966403dedef1f6d75a8fb3f4267f28b7b232df3d3d267f467771123f3c1f2016ee9aa953011c
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glQ1PlklNIo5uz:Pu6JmVxd2dQ3klNIo50
TLSH
T12BD59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fb36a650b80171b293fa8cfbe2850b62abc264382a5559881d8b3ebc299eaa0b
MD5 6ecc9f8bd6facd6cdbb0378418cd8311
SHA1 d2561db527594733401b159bc6c00564202ba425
SHA512 3b5d63b9852042d07b8825033743f3fc914e1ffff704116ee14c5b995bfe13c5340d056f56b1659625acf2bea10a068c935c03d5923fc765468dfb9a987e3b03
SSDEEP 49152:Y1hpsNoJpF1A6UU44CwH7R4xS1PlklNIo5uz:YmifPbRr3klNIo50
TLSH
T139B5BE13F2D900E8D05ED178875A9632EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c6a7c72378f2b6ec096c0a6d8759cfc796196f0f8d9be8626e05c8e68db66a2d
MD5 afe8921698c9874c572c1834e1463a70
SHA1 408ecba3760b537395ca8cabfd2996e86c109739
SHA512 8ff42c39bcd43d8924c49c23ba5bb86809055a9506868d59da1ec925e65a9792f02e296e1a1c4eeb77a93b734e44761dcc0fdcc651b745a52b40dc4e1b7515c0
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHq51PlklNIo5uz:n5dKTi6153klNIo50
TLSH
T155C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e1e8843269ceccb6c3b7d7ffd66e8043a285443d7f885d9199463887ffa78ebc
MD5 f6374b960e968fd1c43ded143c8f9fef
SHA1 0a91a88b90be99eaa34aa3960836cfd9b1c4ab5e
SHA512 89ab2d14bf36e8cfd6b572faa033e2cae5ba037299a27713470d18f97da84f01773eab7a137152535a6a32c8835160e260e6fa63508184b8caac53997bb39483
SSDEEP 49152:jhtSn8EApI0figngiDn0AP5w+1PlklNIo5uz:CX2iyph/3klNIo50
TLSH
T10895BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f5ccc3e2188eef9568a444b361ada88757d2511a25ad271cdae98a2779e4f569
MD5 b5bee75d52b810ca2c0cc257fe838f87
SHA1 13ac7a68fb20ed025cc19a552f70ee1b1fa51811
SHA512 54be9327b4a9a0dbb8daabb31b1181f4255bdb388ee927313739616d222950de1c1427cf567160190bed0a707c9ef5e093d7af63a514ab877bd2d8cf064b9266
SSDEEP 12288:HvFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:HNu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1CCC423269CAE909DFF064134327E0B90D7A97CAFAFE1520F341B20179B33D623A59794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f0a5cd7a5a51c2d773d76e96065ac705a6cd372717d401075d4d552dcd00c5ac
MD5 a3cdb3bd19a8e7a5225129f8d5a7120a
SHA1 9676b606c847439a1bf04ac970da11757d7594a9
SHA512 f0be1abd09983fbc2a0df1e9fbe0a2037b501243a7f97c269110c826f5daf8de82b85789a86d81b33aae171463aabc0afb6823a23e07b3374a08c912a7031c5f
SSDEEP 12288:PkFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:P+u/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T150C423269CAE809DFF064134327E0BD0D7687CAFAFE1921F341B205797739623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3e7a19792ba346e487e5686e090745af71ab37b140c987d5785e0e01aa2ef13a
MD5 25d722844b7d7867dcc3b08ae9f1099f
SHA1 dbc73ae8819f44db5fba81c69e8195ac45a81dd2
SHA512 642608fcef0b40cfca510bf8fb1a871d2393877374d9660ef7774201a17bec6eddd2376ad835738ce133d075cc3138a31503ef1155971bbfd0e3be5aa2c8a293
SSDEEP 12288:peFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:pou/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T145C423269CAE909DFF064134327E07D0D7A87CAFAFE1521F741B20179B339623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 9d3be165f23705419a8417801540a712dfcbb3c1591e1fb8092aa40ae9a35cc6
MD5 43d6e8f4e2ac20f24e6bf203795c73c9
SHA1 703c0eb45dfe4eca4bbf87f5b6a97ee646f2faf1
SHA512 5179ee7b89242c65a809ac6e80bc9556e35ecba58a41d125c1a1e1095118346fc644206efa398be9ad2e04db7e885679d0592d598d80ae0f4a341e3002576b70
SSDEEP 12288:uVxFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:au/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1ECD423125AAE40DDFE078138B67A4790D7B57CEAAFB1935F6402144B4F73A913E34B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 1dd033453b683fc1c27b47b5e25ad4974e31db4d6f4c368e4d55c857eb278519
MD5 76f84b7160365fb03d0d42da21e524c7
SHA1 4b8fef1d53c5f4c72bd54822cd08039a7d50ee0d
SHA512 b3725461751d9551977dd4c8986d4bb77ea18a27f8030ab9f34a92d2c99ce0125b265f79b50c4dbcd07ad85ddaf3336206f5e4c6cde5b8d95cb7bf410dfe48d8
SSDEEP 12288:eJFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:ePu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T11BC423269CAE909DFF064134327E07D0D7687CAFAFE1920F341B20179B339623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 13b52ca24f185f28820e22d33aa672f5a372a28d649255fd963211d806441cfc
MD5 fcf7b87e834f5d5a46197e17113875d2
SHA1 d447a94dac89e10111952fc8298186ca7bd96cf5
SHA512 1adea924df7692601a3388ef590050fc8042d0f140a44037537b07b1d92a9562542aa69218bcb879bb69762d174a1176e70e4f7192eeb2307d86c0ce085f7631
SSDEEP 12288:ogFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:oCu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T156C423269CAE809DFF064134327E0BD0D7687CAFAFE1921F341B205797739623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 bc9f732600b29caf4e5b9cf2db9afdd8d896290c8b1b6cf22caa411e73a2ce08
MD5 51fa2011bab58d579f2da8f056f66397
SHA1 ca35378df504c53aeab4a203bd728cba221044c4
SHA512 6b99115aafdc229e7d7389ba01e63bb7a7d5b99396be9aef7d0231457f34a99d8c8ab8add8fbdb091c260ce3387d4907113c9a7b724813fd4630a804e74eb040
SSDEEP 12288:5cFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:5Wu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1C2C42326DCAE809DFF064134327E0B90D7687CAFAFE1921F741B205797739623A197A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 bf4f9b5a1acd9fc5f86020b319a49c9b276fb8849763d8c384a186099f443dce
MD5 3545948585a0fcf589779489099c5ce3
SHA1 b1117d3ecf86a4778b91f6856d675840b6054d93
SHA512 6887cffd38a093cd9927735d0c0613a10297bfcb659ffadaa07e4142777f3689ecefe20f8a0e9258cb0e682fd791165427d9e4cbc44f4ff0ac794abd39e03b9a
SSDEEP 24576:dZMSzFVSOeu/GT/2S1FtlkR4sNhCu5kTMsjz:dZMSzfQ1PlklNIo5uz
TLSH
T1430502A5B39418F8ED67813EC9258901D6B27C6A0BB0C61F13A436675F333A11D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 eb1bca46991dec4b909f693319478c98586c1197f84e6815e7cc10234bb5819e
MD5 8dc204628e6e258c555c23d52f8b9008
SHA1 4e12a6dd6bdfaf2c4c036f77e6aa7707e5bd7179
SHA512 cf1002435ee09519b6fa15d74829ad03c067c4fba4e1e4981f29f40446a60a5ef792f6f6e18fe4d7b7d5dc9b928ef331896730161e47cff2cec7e074be11af3d
SSDEEP 12288:cTFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:cJu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T110C423269CAE909DFF064134327E0BD0D7687CAFAFE1920F741B205797339623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c6776257404750ee3a9d088a3d2a5eff4a9097e51d3e158a47e2dabeb4f52bc1
MD5 0462b270329b11b9937b1560b7235b90
SHA1 1541b470898b2317934d4f129a8059b641a014d2
SHA512 a84bc54d8b7f4f37c829af58c6a8bdcfe6b69263a416603a175fb364578dbfbac99e779f42dcfd1aec80e423e92be0e32fdf5f085726ae1e831815195edc6e81
SSDEEP 12288:23Fu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:21u/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T12EC423269CAE809DFF064134327E0BD0D7687DAFAFE1920F341B205797339623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 72fc644ea7189db04227d0d95a61addad99b89988e13e2db06cb0f74558ebfbe
MD5 c7b908e20b90630c9385cb084dc0b873
SHA1 bd269588f66627a00fe2da3db1af11a138df4711
SHA512 4dbe005b2db3b67dc201fdef53d8e804622cc652b008c9de6d704c11f115911aee12c1966f5de2419021631a31f380e3dae8cc45e5864a075e8cdfbd215c78ea
SSDEEP 12288:TyPz5L8IFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:ezyKu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1F7F4121777A930FDE527823899660A41F771BC764B608AAF126402771F336E16E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e1108ebcd61257de7ceb82dca81c209c8d3eeb76fcc8d3f0f516558a619ecaa3
MD5 ad7ec40ba2f5144b6196591120092106
SHA1 11c4d1ad632f79b022d003d8ad4e3702d60a2f61
SHA512 48afa35203946247bf423496a4e3b926043167376a2cfb0bdec76f1b15db360f8025e5a44baa448b56baa7c8bcfa0acba66efbe7274e24d9615149b7b7b01530
SSDEEP 12288:rTFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:rJu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1D2C423269CAE909DFF064134327E0BD0D7687CAFAFD1920F741B205797339623A59794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 460f36c507cc9e7de6442b7e0abfba212268830f8a04a1b4fff473cab4659ce5
MD5 b72ddd072e4fba59cfaf96523cd3b54c
SHA1 f8f8d8ef2d6060232df9199c5083ff20847f4ed0
SHA512 95c584a2d72f7923f95504a7254ab51ecaf396283f2073ef9a36817bf0d458936f004d7d4fc140c137a6389df039edc553f5b39e0ebbf8cd703cde4826fbfa4e
SSDEEP 12288:hTFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:hJu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T11FC423269CAE909DFF064134327E0BD0D7687CAFAFD1920F741B20579B339623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 71b45b099467e508574e0cd6567d2476c3a75cc30d7eac05ce614808b01354ff
MD5 b89f0da0facfe3d90198e4ab7a4125fb
SHA1 10105f72ca0c951a3d585e8fa6223659e809a4a4
SHA512 53cae64bcb322c3389fb3e1cf3ff09099f3f8cbc15959a106bb91da88dccf999c740cc366c1edca8e848bdbfdd3c87cf7dd4be8694dc0751f9123cf08039ef53
SSDEEP 12288:GyPz5L8IFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:7zyKu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T108F4121777A930FDE527823899660A41F7717C764B608AAF126402772F336E16E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 09d16fc3586777c00dfbbe616f8cdde5dff8cef16138e1c8badab6f646a88189
MD5 9c5657d5be7bb36799d074aa11e62614
SHA1 13adaa8bf11154f7145321a71a1109b6c7fd1207
SHA512 af7ffba33ff07ea46cc9c503557e2ae5a0f741f46a9cf2f97cdcd843d815213d3e4c7bada48a019260f22093c661ee54dd49c5b3abc4d14a06b3d42ca7ab5093
SSDEEP 24576:WTHaLl3z0zD4u/GT/2S1FtlkR4sNhCu5kTMsjz:WT6Llj31PlklNIo5uz
TLSH
T1BA0502A5B39418F8ED67813EC9264912D2B27C6A0BB0C61F13A4366B5F333A11D3DF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 95165b626aafe4742708f594b0cf3e8ed944ec420caa876e06cafb11fe6105ec
MD5 3878a9f1366a2738d623c05f7b9e4897
SHA1 80e1eb2fc39006e3a7036210985b1ba5428bdda1
SHA512 193e6a88fa6667f48b0cbe64527710980e35f18a4c761995e7d534e894b2b91b7fc68b9d472cbd1e825b312d23e1c58e558078fb21656725ee07961178c07c9c
SSDEEP 24576:R37d9CHKy7GZ8u/GT/2S1FtlkR4sNhCu5kTMsjz:B7d9CHKyaQ1PlklNIo5uz
TLSH
T17025CF90F3E810E8F1B78A3599764511DAB67C9A1B71DE8F03A4251A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 1c938788852a64359dd01376647b17f64f264ee5dedce3818e6b293279c6100e
MD5 8fc7dc0d99b9c821786a01d96e294f21
SHA1 c2736e2e451bebe6fa0f9a27f00c6c748d848b23
SHA512 c10db7d6ddb9b9b7f67b84302b6ade6de4258e26ba68a656b82ca71240641dbdbcd84da480344b10cb1bd17b213ef0c367eb5ccbb584982cc50d7a2da52e722a
SSDEEP 12288:B+Fu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:BIu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1DFC423269CAE909DFF064134327E0BD0D7697CAFAFE1911F341B20179B339623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 35bf8e4804529a5dfe09f0bd438afe514cca128da3d975dc0063171d0cb18587
MD5 a54870131025ec3adeb1127619cb00d0
SHA1 ea69d4584f28f7a421ea55c1d6a5d01b9ba8d9e9
SHA512 a44a9cc66ed739fceadbdd36d2ad01f09557621c38416679552b09500a13998d8ef4e430d6b5db1e5f6b7d02f1216cb56e84c22be8857421e2157356e1bc15d2
SSDEEP 12288:MoFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:Mqu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1CFC423269CAE80ADFF064135327E0B90D7687CBEAFE1921F341B20179773D623A557A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 58700777d17cac4a32a4726b0b78f6537e46d6477dc02b69b4661c4c9df90bd2
MD5 b22121c7da756cd91189380be73be4dc
SHA1 874e08d5b40eb73d3db6c7c389997199c41d08e0
SHA512 b29e442946f6bdf7050e31b39e8b7ae77293c40e613a034e2928340922f86a0202f6f669b58d858b3b56b55962033d1921c2700f747f071f8a51ea518da8a2d7
SSDEEP 12288:tNsfDFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:CZu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1F8E4F01AD29801E8D55E5139D76A4A40F3337C698BE1D3CB22C1F53E0F366906EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c74ad1575cf3fcac94cc03e5790068f21d9430ba4f4c1c462b29dc7fd115a2ef
MD5 af2e102c80cf675939498e54596a9445
SHA1 1428a774a91b7fcdf071094be7d0eccfb521321f
SHA512 cee181547073a4a30e37f6c0d5482a5d9d38c3ef2b68a5f5330dbb75e6cfd7ff5792885788bd3ae895b0b8bd26a0e7150bd2018f02552da2bfdbd8d9fc9efd4f
SSDEEP 12288:qGFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:qQu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T104D42322CAAD909DFE1A4134317E4770936DBCB99FA0918F7407218B9A33DE26E34B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e07cf26384097a9e602c35b64d9d5e3c6262b972bd20ecd882c38216a7082705
MD5 850294ecc291f92dad5bfb29a203974e
SHA1 f7869271a4456aebebaa44fc8ef4420d55a955a4
SHA512 96ce9040310ce0ba73e019ae820c9f8bb97f8971dff8a9f36d3b73ddffbbe8f36db0713f8ae53d62a88fc47a50eb7a98aa4af632cd1d2e0a75060dc80ec7beb2
SSDEEP 24576:s8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC+u/GT/2S1FtlkR4sNhCu5kTMsjz:FRZwQCyiHiQEaaPnM91PlklNIo5uz
TLSH
T12585B01E62DC42A5E0BAD278CDA74407E6B278164731A7CF1191C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 3396d1df7eb4054956fc040b5cffea531fe40f2cfe2f84eab4829304ed90f2c4
MD5 6af5468134016bf3edfa8861eabd3b0b
SHA1 c7e5d24ecd7c705a84da36e54948e3ec0da7f562
SHA512 b48c0056a37e3f44ab4a5c310a6b993012ac7524bcf082a4cd14d4b79c6d362a8f43e4f4b788c338aa60a04ce796ab1e55643e0ee5b276b7c13ca17a494119df
SSDEEP 12288:+bxA1U7KEFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:+bxA1UGeu/GT/2S1FtlkR4sNhCu5kTM0
TLSH
T12BE4122E56EC10E8FA66913D69A68201D3317C6A1B7193DF2092827F0F37EE16D35F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9e1917df26f6108133197eaddac9405edf6bee3fbb8e1d034279b1b2beb58714
MD5 52db3137430eeec6f06d915e198acb14
SHA1 0077a68f9247853804042d5e17a405635ffec97d
SHA512 f2cc4dfffbb80826a2c6f652a3d089fc85c71573483f28df05fa7d35dd137cd6ac2c5a71d3790b302621871c749b5946b341c116fb1c955c07aff4d09b35fbea
SSDEEP 24576:9jsmP0yHaqrVqHra44KDzMsrnlu/GT/2S1FtlkR4sNhCu5kTMsjz:9jRP0yHfVqzlAsrnd1PlklNIo5uz
TLSH
T1CA45AF2EF2B910F9D8AAC136454507B5EB71782D1F209ACB0170C635AF0AEE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 d4cbcece129586841efdf05f0f9973a8f740157fe2e1784dff78e735a2ca56b2
MD5 a3c43d4a29cd1b5d2217ad2b7f4686dd
SHA1 5e2344538d09e12227202213e75b30f3c167f59b
SHA512 d0e49fe5fdec891daa70121029e39142405a6027d6523f810a90897639975219abe4019b0307e365248e0acf1d40f7b9c72e2088df5779a3793dd7673c68a118
SSDEEP 12288:V8Fu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:V2u/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1E1D4232699AE909DFF064138327E0BA097687CBA5FE1529F341720578B33DE32E35790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 8a811a3465e5e317de1bdb7b5e6a9389e9a6c8c738f7b1fffdd78c8342ab0ae7
MD5 6fe63fba3787dcb4f6fe21f7893b81a7
SHA1 9212388183eaaeaf8645d04a7df0a2a18a7c6b82
SHA512 76b759596992168451a6f8860d2c58eec1a8c71f5c05acdd967cd7f841e790b581f0feaa74c50b9231e27e1dc03a838d9ba61ba873b8294264169a252f43b1b0
SSDEEP 24576:MpLBUTku/GT/2S1FtlkR4sNhCu5kTMsjz:MpLBUK1PlklNIo5uz
TLSH
T16825F115E7A900F9ED6B813CC9768A12D772789D0760E7DF03694A661F237E24E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 7132aca723615bcdd728026178f37cdedbbc15d63bf2eac7b92286234584b3c7
MD5 e9f354cf227367cb3c7509420d532869
SHA1 b5222e233defc2438a58711649b3eab718fcf4c0
SHA512 542be0d04ee45b372962258b1362abd409880a8ce253758cac8066614eddeb70016274f98737512dd32e3f56e2f8de2821b9fe1befa0a60e47d856bcb0fa2474
SSDEEP 24576:urYNHDu/GT/2S1FtlkR4sNhCu5kTMsjz:urYtP1PlklNIo5uz
TLSH
T11505F12F96AD08E8E53B913D8AC78605F2727C66175192CF04B0827A1F27EE97D3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7b1c3d22f6ce4a589d4cd2c3ea414082abcef3d5e7a3ca3654904c4eaa7c0036
MD5 60094dff47a669c565b30fe40d75d2bb
SHA1 8b2793869d0eba00d3334ddd62a69f408edb9b71
SHA512 7b692cebfbd0906b4790cf20e9fae32bf80148b6e2667ca66eed1f937a541dc240a52fd3aa749234a408e4f212a1d48588f75b0cdcaf484a517fb9027554eece
SSDEEP 24576:TnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK2:TnXoJJYH84VVS6AmEcJas+cHBjSSKHPm
TLSH
T17A65BF6EA2BC04E8D5BBD17DC5C24506F5B178661331C6CF022182BA7F27AF56E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d62f55f62209dce2d7dd14db7202ef8bf18c46e4736bad88d57ed0e6ed6ae47a
MD5 2bd7257371fba5cf3a18c9ee63000083
SHA1 ed035d63379e6567afd6aa103ae2e81e35f0edda
SHA512 56398e95d1870043a278ed25ee17a77e13bdbbef37d6923940bd2e314649443e03027bc66984f38c703b08123201f6fb0a1803abca5c682091b0f91ed15bed09
SSDEEP 24576:Gv7Xbxd9Tuycf8M/TYlSuxwr2PCRu/GT/2S1FtlkR4sNhCu5kTMsjz:GDLL9TuJ0M/TYW2Ps1PlklNIo5uz
TLSH
T1E6858D1EA2EC42D8E47BD6BD85B79146FAB2B855273081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 6acf4c01cfec60b74487fb93c4770b4eeed59b4905d4c431098b011a1bcf7631
MD5 e14083827d3dadf1cd99a9c9b2e1d928
SHA1 29241d2db020e13d5824b4ce986603a2d23b1c7a
SHA512 dcfe089ea0e67c65707f4b3848f318443724113a39e65e377a598973aa5fdc1a090ed9fd13c7a660bd1b4c8c90166764e6946741c47440bc4adfe50ec18b0448
SSDEEP 24576:LegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wku/GT/2S1FtlkR4sNhCu5kTMsjz:LngOJOmPOHhu1PlklNIo5uz
TLSH
T1CA55CF3FA7BC15D5E03EC17D8A978916F6B1782603255ACF0560827E5F2BEE42E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 46e0df9092c54bccce105b4bb1190154f601f83f65553410127afa6f032c6ca1
MD5 3d3fb52c57806aa9489f6b69ae22f550
SHA1 539ccb690a3e1faf82d61917fc40c3b88100e483
SHA512 13e3ddf9fe6b936d620cf4d3cf1cacc808f0b09bbe958411ef313ec979150b3c16a70ac3d6222e5c3fcabca2f898c4645552f7e88010050ed47e8dc77ffe3636
SSDEEP 24576:lLJnJiTk3R3waE4JrOWu/GT/2S1FtlkR4sNhCu5kTMsjz:lLJnJK8R304lD1PlklNIo5uz
TLSH
T17F15D02DD2A810E8E477C2B4815A1B56FF31387D2B2169CB19B4D5353F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5f571c12d4eda396791c5e8f4a1fab4616172872c58852147b8d66aa15365585
MD5 50f65b9e3ca0bc51d89bf99fbe5928e9
SHA1 4d582ae94fb1e3ff48d1156835fbd00ec97e8cba
SHA512 92daba8c5949ed738b388f03e45cb6fdc883dc33ec660299c3404cb58debaf88a35a75d6f34a74f98a54a96dd2b023ed60b68177f5a1fa248c20a2bdc73e4095
SSDEEP 49152:j9GqCzDScAZmlvTcFg8Ph6A1PlklNIo5uz:Hv3klNIo50
TLSH
T110955C05F7EB5298E8B3C9F1C96694159B327C509B34F7EF0A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 12e283ba6c424c6d7af3dd851954c28b28ea37bd47dae8bb3fc60a29ba66db26
MD5 f4c5ed5a314df195a74552c7900b2489
SHA1 6fb6a19317b67ff28aae79c41208bb9d4e44218f
SHA512 e28859f5f781dc5c8fb0f94b721418a1613981fb99fff71cc07f57039e1b10bae75cba86959335b61016f916676d6d5442f979c51d41100e4057ad21ec53dc8a
SSDEEP 12288:7lYJeXm5nkEUuEQFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Glb:7lYJeXm5jUuESu/GT/2S1FtlkR4sNhC9
TLSH
T1A1E4125D6AAC70E9F61E803965A64A50D371F8B6575163EF10E0817B8F33DE22E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 478d6fcffd24a07ce3e1ce035889ef30ceb8065d5cfe2ada7b608e96f8da7fc3
MD5 4c076d816fbb4f7397e96a0f0b5d9cfd
SHA1 caee1983447222c666a1e88171e9154b7d8a51fa
SHA512 458185ee757094f48c8b66637226c50df3f1ccf481bd51399fb135648dd6acf0af273cc3dcb2584ebbecec051665b1a8525b028c77973e01672835e15cccae48
SSDEEP 12288:fwu6kynFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:fVtyFu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T104F4121566AC60ACFA6A0138AA7742A0DB75BC359F6093DF2091A23F5F33BD17D34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 21df8fc412583b3d787e7b011267c25e22b7035f1feebbec91fd762e516f3389
MD5 710c7c9e018c7639d8c7a8cb3d2d0e21
SHA1 373999f07fcddcd971d4ab2d1d8f9e18eecf4d5e
SHA512 cc069ab2771d897a14f0d7c42755140bb7cc776e1e4e809183350c5ac3003932a7cd28ffb452fcf1d21eb4d4a1d6571b50abb8804847619f449b74a0cf29d2d7
SSDEEP 12288:DPSFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:bku/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T11AD4232989AEA0ADFE064138313E0B9097797CB95FA161AF34576077CB739D23A35F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 226c785a67df38da3d7e10c3922b379daed8ff7a83af187ad690adb6e69d319d
MD5 54b385e51a4eb2e6574df9572486926e
SHA1 c1154419940628ef2056faa4052990defd776612
SHA512 79940a8bde783db753f81cb0a277a7b281cc894626e411cb92ee6ea5cf731f43c551ace382ccdfeea62cc3075a5adaec0adc9fb095ab7ea15d7b91b4b081d6fa
SSDEEP 24576:6C+TyQIu93VAumZr7jmdu/GT/2S1FtlkR4sNhCu5kTMsjz:6/TfIq+Y11PlklNIo5uz
TLSH
T15D558D1DA7F919CAE276C575C8A34493E633B872137186CF2044C07D4A9EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 e203da5a74826c86fc490a6866b76e6926cfa884f87bbf5a434c29f1f10e68a2
MD5 d98606dbf45da60f0bec89647eda8dc5
SHA1 6f8b6da2dc48d64b0473b67aeb6073d201c354b6
SHA512 a04485761f5ff20d1578313a8e6b03a73e1a3e603ab344d03995499c50eef89befb72b3a4023477dc6aef584df6fefb24985bef7868ff520919e701469a55fb3
SSDEEP 12288:rcyrWOstaa3kcseFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Glb:aLQikZou/GT/2S1FtlkR4sNhCu5kTMs3
TLSH
T117F4F10FB3AE00A9E567813C88964251F7B378754B2263DF01A1C77A4BB75EA7D38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6577ad5ea7cd6b88135a2bc72b0e050c8b99b4d02ab1fe1eee3f63a6249d19d3
MD5 4db45a982a4f10ff75df110d5dfbfbdb
SHA1 fac8b76377b5997ac001a49fcb81ee5c46eaabd2
SHA512 f9b735f3ebb9e7f8a32e12e9e39d3548b4e97e50c0d6c897e570ef15010c1774450dfa91a95669a7cb149521e4afbf2dde625bcb68461de1a888feedfba90270
SSDEEP 49152:lpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPz1PlklNIoC:GpC7b4+80GTkI3klNIo50
TLSH
T150A57C3DE2F810ADD9AAC37585461665EE71382E3F2015DB10B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5562d781856e4954b8e6e5361e0d7f471948883f12b1be0037910d8a296b7085
MD5 a88dcb003fc7ef56a25c91ed4749e6d4
SHA1 a3d1bd68c8762d34fda0cda08afa1dbe138eda44
SHA512 df6d5da4e0f7547d420518c76237b3f78ebd404e4eb2e4ae42d792ff249c87cadcb9514b70ce9db525a32de8e093d9fad1c20fa6a4fb748d47902d61186daecd
SSDEEP 24576:xSAwJPE1IDAo+4Kt+l44135UQ9u/GT/2S1FtlkR4sNhCu5kTMsjz:xqPCIo4Kol4/QV1PlklNIo5uz
TLSH
T12455BF2AA7F956E4E17AC7749663C611FB7278231331A3CF5290813E0F269E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/444-95-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/444-104-0x0000000001650000-0x0000000001DFE000-memory.dmp

Download

memory/444-85-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/444-91-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/444-105-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/444-98-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/796-311-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/796-423-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/796-317-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/796-316-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1656-360-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1656-361-0x0000000000650000-0x0000000000DFE000-memory.dmp

Download

memory/1656-362-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1660-250-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1660-24-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1692-365-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1692-580-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1916-395-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1916-584-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/2204-321-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2204-459-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2392-331-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2392-463-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2392-339-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2392-337-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2420-113-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2420-282-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2448-349-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2448-470-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2448-343-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2448-351-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2632-58-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2632-81-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2632-71-0x00000000007E0000-0x0000000000F8E000-memory.dmp

Download

memory/2828-117-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2828-283-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2828-123-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2828-125-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2992-53-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-35-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-36-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-55-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-1-0x00000000028F0000-0x0000000002956000-memory.dmp

Download

memory/2992-8-0x00000000028F0000-0x0000000002956000-memory.dmp

Download

memory/2992-10-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-54-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-9-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-0-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-93-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-31-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-39-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-94-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-45-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-11-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-17-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-16-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-30-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-33-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-21-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-111-0x0000000001240000-0x0000000001265000-memory.dmp

Download

memory/2992-112-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-29-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-32-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-28-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-38-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-27-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-18-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-100-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-101-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-102-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-103-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-14-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-15-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-22-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/2992-19-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3128-51-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3128-266-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3128-42-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3128-41-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3348-354-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/3348-513-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/3844-392-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3844-581-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4252-441-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4252-425-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4252-398-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4252-457-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4252-375-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4252-381-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4252-585-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4356-328-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4356-462-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4388-69-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4388-67-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4388-61-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4388-279-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4388-281-0x0000000000750000-0x00000000007AD000-memory.dmp

Download

memory/4472-73-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4472-82-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4472-79-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4472-280-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4480-465-0x00000171C2250000-0x00000171C2260000-memory.dmp

Download

memory/4480-464-0x00000171C2250000-0x00000171C2260000-memory.dmp

Download

memory/4480-466-0x00000171C2250000-0x00000171C2260000-memory.dmp

Download

memory/4716-307-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4716-300-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4716-301-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4716-364-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4740-582-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4740-327-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5108-424-0x0000000140000000-0x0000000140216000-memory.dmp

Download