6b8dc736d841a3902ab0274aa68800ea37d2c5683824992934be8b0feaa94753

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Size 8.3MB
Sample260505-msad8agy6j
SHA256 6b8dc736d841a3902ab0274aa68800ea37d2c5683824992934be8b0feaa94753
MD5 456ce3e8fc16d862ac25f1f030d37c67
SHA1 deab00c51f8617d5a542d024ad85ff582e9394f6
SHA512 3860022dbe15ee3f1ccee7db60a311b773fc614ad1b7ff473c718a0951f237a517624dda1495d9b05b286f6007b51c59787bc290372f9277e342ca696a3933ed
SSDEEP 98304:3YOrRn+os45gaHrh3w3D7nTsReRR9rYPKES:113w4ReRR9rcKZ
TLSH
T1B1963A4677F455E5E1B7C2B489B696B1FAB2B8951C34E70F1061821F2F33AB09D2D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2008	alg.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
2100	fxssvc.exe
584	elevation_service.exe
3420	elevation_service.exe
2320	maintenanceservice.exe
4208	msdtc.exe
3920	OSE.EXE
3716	PerceptionSimulationService.exe
3332	perfhost.exe
3956	locator.exe
1516	SensorDataService.exe
1152	snmptrap.exe
3004	spectrum.exe
2372	ssh-agent.exe
1088	TieringEngineService.exe
4308	AgentService.exe
1400	vds.exe
2932	vssvc.exe
1836	wbengine.exe
1752	WmiApSrv.exe
1712	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e2978ed87932a944.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032f3be027cdcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000caadf6017cdcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000136b7087cdcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091fb04027cdcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f7e41097cdcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004670d1087cdcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043cf11097cdcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
584	elevation_service.exe
584	elevation_service.exe
584	elevation_service.exe
584	elevation_service.exe
584	elevation_service.exe
584	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Token: SeAuditPrivilege	1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Token: SeAuditPrivilege	2100	fxssvc.exe
Token: SeRestorePrivilege	1088	TieringEngineService.exe
Token: SeManageVolumePrivilege	1088	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4308	AgentService.exe
Token: SeBackupPrivilege	2932	vssvc.exe
Token: SeRestorePrivilege	2932	vssvc.exe
Token: SeAuditPrivilege	2932	vssvc.exe
Token: SeBackupPrivilege	1836	wbengine.exe
Token: SeRestorePrivilege	1836	wbengine.exe
Token: SeSecurityPrivilege	1836	wbengine.exe
Token: 33	1712	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeDebugPrivilege	1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Token: SeDebugPrivilege	1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Token: SeDebugPrivilege	1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Token: SeDebugPrivilege	1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Token: SeDebugPrivilege	1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
Token: SeDebugPrivilege	4936	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	584	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
1292	2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 4188	1712	SearchIndexer.exe	105
PID 1712 wrote to memory of 1884	1712	SearchIndexer.exe	106
PID 1712 wrote to memory of 228	1712	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_456ce3e8fc16d862ac25f1f030d37c67_glassworm_mespinoza.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1292

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2008

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2908

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3420

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2320

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4208

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3716

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3332

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3956

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1516

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1152

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3004

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2480

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1752

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4188
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2656 2796 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1884
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2836 2800 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 72ed7ae3700f24b14415cc65869e1c05619f868c2aa42cf5417db82b21cde6e8
MD5 9597bc6f9aa125a83ccde1663f924630
SHA1 261540eb05a4f637d1943c60588068d09cc705da
SHA512 64c8fa5a4748a6339b9b0ef65e2ebeaa655500e3c30a911c049eea6ebbbe9a979e4322ebd8c6611e48ade4031663075860dfaf357fb7b2f07044ced686444803
SSDEEP 49152:8b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnjYPKEnSG:m3q6HjBKYPKES
TLSH
T134D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 d4ed7c2ae9b0702676db79af1d2042651a3a8ad36f7ffaeb1bb116b9dee92a23
MD5 f13b841b3432356f7b3a49faf1630fe1
SHA1 3e33450ac53ec8c96112807da0747ce4660b6445
SHA512 8635aece388ba4e80172c67f58ee6656a15f45a76e0096b633cbe261737c84d52a20c6736b277fb0693cd1d9b2f7424cd561e76beb149287b1d6d7ee73d02c1f
SSDEEP 12288:x1XLsswWkxy2lRq2czAh45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkQ:/XYfDtczAuYz7KEMdX6keYnAcerN
TLSH
T1BB85012867D508F5EC67823DCDA28501EA33788507A4E7DB03E899661F373D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 3960662b79b4be71fc76091e8cab0273425bcf9957c4e7397fffe204f02cde75
MD5 842650468bb526bd67816ae5546d0075
SHA1 0753467978704456849ea6ac0559a90cc374061b
SHA512 848d63b11dcd6ec2daa140f441ba23b43a7d4e4800daa474806dad6538f3c362545c9c54b37af220984f3d8c77883175870cea08dc23f2fdb40f2aba5dc261dc
SSDEEP 24576:N0Le5ji0hmx3rM7Yz7KEMdX6keYnAcerT:NPji0AZQYPKEnSG
TLSH
T1F4A59E15F6748771D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2ce969035e9751dd33b58864a6272e171fb2a8d5d9e78b295dc9319dbdc5fbf6
MD5 08a4bb4ded52848a9947139348ac81ad
SHA1 a11aa547429432d3e55f5ff6961bca63ca18bedf
SHA512 a20f9093d304e2e2d019060cbc783fc9b9113cb84a8823b322a1a1b3c7625205197bda9f3f61f699c2e9d706672f0f8f7cfbc5f07d0bf6c36a4e2b9d719a6aaf
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWE6q8wyuBYz7KEMdX6keYnAcerR:y/ezSC6vUzPvxHjyEYPKEnSG
TLSH
T1B5756C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5ef9ef5ea3d3874ca08b1b4f60849bbc37602a13a644112b5a045689527e8674
MD5 bce10e17a432a520e7809089c302ee29
SHA1 23c6995095d7c859c8a5a7189334810fb9a7be5c
SHA512 aa08f1fc98ece413bafd7bac64a0ed67fd04f677567c7af328363ea2e2be084d67535ad1038498b9fdd45eec284a0111e5bcfe104bb7498e68c942906acf5ac0
SSDEEP 24576:hVbqPb88hv/l+66Yz7KEMdX6keYnAceri:hVO88hXl+/YPKEnSG
TLSH
T118559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 0df774f7f98cd0806220eafe442b28371d53385f93c96e7f371c77ae11af6054
MD5 06bfe16a494ca7432773162344f0380d
SHA1 fc2c56e664f25b373cbf4f1eab7ecca2e2bf70b3
SHA512 180733a62782be47066dd5ba9b03653fbc4d1d32247235ffa1c9baf486c5f56ae9d5795e26155bd77628a03c4c29691c0b6d02bc778e837ac662cda7357af207
SSDEEP 12288:ZXk45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkK:ZXnYz7KEMdX6keYnAcer/
TLSH
T10E6523048B1A89C2F85F067BFFF5494089375DC62E9C9761C94CFA4293BE222C50679F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 9f55f61a00744812162ee43bd21db3e99095c2f4f813cf528abdb78ee4b805d2
MD5 abac628836d0ca5019e2ff327cfc51f8
SHA1 cb508c49bc1ca83a8774c0a59e4517bf811d1182
SHA512 ea305f430b753ce131531dbbde09f3e3d3888bb2f39a5c6ff13d623a735d6d494a504bb492c141b73aa8b5d50c10507b1860febd48bacb5c41777dc5b1df4e94
SSDEEP 12288:ueBNUbTVO86UN45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkz:uJIUSYz7KEMdX6keYnAcerC
TLSH
T1D785CF3BEE28FCD2C27A8DB96A918600D77278704F51A3CBD164C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bca50f4c7c740387b23d63bf7d09a4134b2604591b38867bc7fbf5bab6c3a1af
MD5 01d7def0e6c61f3fc796d41204ac2189
SHA1 35bafc169f1ab19381ca4d750e91f7a3a2bfd173
SHA512 321cba111db74676e56b8528b351d8cb2530b7c61781fec14b366fa2418e8ee1f7338dd5b0d2851ee99bca2aed0226c4367f065bd22e254e60c44a585d21a5b5
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THJ:fQvGAdlCEL8c/yRNw5CxYPKES
TLSH
T100267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 3913f82d40178a8d59fe8c627d9a7ade32966d9c2202ddf32646164e15f9e383
MD5 75ec180304ca2133d4ff24f70f21e057
SHA1 824ea9d337b696a550021d980893f067e27e1b90
SHA512 d34bfef8c7192f53839f7dca39abd8060cde69b8a9b93b232e7e57c33d1499e02f9cd061bea7a2da33926afafff68d6d4cff7f4c5abe4506b7a3f2e97d68f491
SSDEEP 12288:8AwSfxL/2Dc3BDLLmt0LDQewsAjv45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkv:hkewsAjAYz7KEMdX6keYnAceri
TLSH
T1AE95E031FE75E432C67F0DB62B36C716543D79600B511AC3E3A89E8E5A742D22336A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 57883e08e8387522c5c62c99fdf4b605e6ca0e320530b93badb08bcf02f82862
MD5 3a906af7d505f568860f305c0d8d27be
SHA1 dc431459523c4200b983de02716a0e7aeeea779a
SHA512 922dd53b6e17b52e01d366e99d922ae369fb8cadb039e7654c5f2735ffb47f640cf683150b7b73616cd6b412f852e8038a544af24e5bb77df021e0e0f4204f5c
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHIcKZ:3UEtQevvqc2W1cpV2EI32In
TLSH
T1E6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cd241e8aa97309ac480c4a519beb765efb85f64396b646816fb51d518ad28aae
MD5 263b4639e126fc16d0851a05115677f5
SHA1 0b03a838bfc83d9a7169843aca064e9120bacc1a
SHA512 c8ed02a379ecd206a799a66829f6883653b0f16966001c1ea9a65fa0d968b5c9be3cad7a98e854f6e4bea66546021bdd7595e2d13bf908f0ba62f16f19f63d60
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/zgYPKEnSG:VoqtVjnm1YPKES
TLSH
T1D2D58D0976B8C2E4D1F6C77896A2C647F37178154B34A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4ca2f5f76ee20e73180f4e5e378e7dfeef3b292d321214c52bd7d1e9363c92a1
MD5 42f26addf00255baa70c1fdf247a986d
SHA1 82fe5a275b9ff4df53c1dec43fcd391fea9dce59
SHA512 8c31ccece06e9dc456db47a7adbbe76d065c01a3262a0883bd434e17646b5198bc7c5e1e247347350b1ee670b0075b838470d4c8dce9269933343ee520b65472
SSDEEP 24576:wAhGLJIFoiwtA5l7S53VYz7KEMdX6keYnAcerG:wAMyFoiq5lYPKEnSG
TLSH
T1DE35AE80EBF955D4F5B3AA78A9B68571EA76BCA65E30C20F2150D10F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 468cdb439b71a9592d2c9252f342f42bb87e07000db04d90fc175979be60bf3d
MD5 9f630261562fe04a4dc7e58d70dff3cb
SHA1 caed473ec591ae4751e50e8fd230d31b7c3ade2c
SHA512 7438a7d5acab8fda54ae1d5a2c6e6793f747afb97f75be66c2fd1991c442454e8e4c02dcd2752e2b93be7a845a18eea7b6383ac2f8dbfa3d6e7a32c2ecdc4b70
SSDEEP 12288:Imw5HEjsChNzBFgl0WDm+Ca45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkp:lwuSOWkYz7KEMdX6keYnAcerc
TLSH
T1E585F14977A90CF5E8A78239C697C132E7B2BC422A25D71F4760C6575F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 25171a4a4cc0c7aed2e9a5292d6405bcddef4c2793e8366ec08b5541c4a21e16
MD5 445ecbd7d59c2ecbfd82af3fe7327aaf
SHA1 49f878c77288fcef505a1124a76cd4682d6be4c8
SHA512 70347440d1bee1c6b7d27721f08a90c5c31b14f367f01c2dd5254a42bb5f1d5727ecf3ca1a3caf624337090261e92c4c1437ff757ea679dc67442c2b46c672ee
SSDEEP 12288:0jZ1Iyf45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkn:QZuTYz7KEMdX6keYnAcerq
TLSH
T18875124927A820F2F0A7423EEEF14601D7727897277983CF465892925F7BBD24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 682896511a47a54014ccbe4278d8f6385b296db1c473493741966cc58dc04ea0
MD5 399075c8e2a4f089b4b66b9689f22cfd
SHA1 a271497244f23e024f429c0eefe0b2ed50056d61
SHA512 5bda9a7174ecd68e483b61b4d16fff3b3c1bd369654d0943be3cf1d85652ed4f969083a2c9a0a1c02abcaf26051ad5bd7c4cf047fe8cd3d8f557cf715e148976
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:TQRQyi36YOcPQLvw2gAf+PN3GYPKES
TLSH
T13A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ddf9ffa3f6bae6e1ebb7a113de59962cd9d8f8727fc6bf5b4331faf7f13d1270
MD5 fed90f7a0c5c4a8ff98cb98eebc43f42
SHA1 e90a57093370f91f8cef6fe5419f07c8aa8573a1
SHA512 0fc0d1c71f8fcdfc0c0fe25ee325cdcca8408e0f9cb9e35594003edc4a91f11c546fadc0591525ddff2999b2e2252e3b8d4952c7371efec34df14587b92e7e98
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:3QRQyi36YOcPQLvw2gAf+PN3GYPKES
TLSH
T186667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bed205a54a5203e9a3b5e3d74b767ae852a097ba9b7684272b277e3a2d2f4e98
MD5 245faa683ca20f2963edd6e328b94435
SHA1 fdff88c5d0ea42d351c49f9b759be58f2f69ed8b
SHA512 0e775f6e15ae4447a0c68a2d39b5a96fba0ec91aa55119d05c9f94c9b5f27cf99965a1fc3e3c11c98eb1b95b0eec457a82750fb960d3469a89b767756cc22ec5
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0jYz7KEMdX6keYnX:j68Qg55nhheWu7PNU3/QYPKEnSG
TLSH
T11EB55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2bf8286c45a36c9192e21cb87468df649ebea5ddb876a3f0276be423120692b2
MD5 254b58244ca57212831d11c18c9e53d9
SHA1 9474e36f49d231a4c72a4965a70fa7f62795f336
SHA512 50224bc22f871a810db67886acd28ab015f45d53cd5c0ae0b9b94c7a2f187c3a881248175f5ebeab608e43dcca7a0f2e44184004fd69926bd8770a090b1b5fad
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:My5112gYy5azzVvL69nLKnhZnYPKES
TLSH
T1ED167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bf82c39b6f43b6aac84110095b67114c1d30bf45774a750119ede34a503e3bfb
MD5 0e7541b87f53b1338484021963956e3a
SHA1 6f7e56b84b0b38dd818fbc3f572ad155cca7f9ee
SHA512 d0d19910e22fc15584529530ec9a90f8947a53174005bd85810392f72d69b1449061bb2abaac8bc699ed9148d10a6c01ba104be29a30ef8630250bab92537d8f
SSDEEP 49152:sB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl+YPKEnSG:mu6JmVxd2d+YPKES
TLSH
T185D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 27174d85b88b228ab75588ca3b130f2342c835a6dc89a16aaafd816319bee076
MD5 63bf2c036e24745cf0b223b53950b9fa
SHA1 00bb196f22fe73a4f15bec18d1f64e986e8d910b
SHA512 924be8bf8a2ba464767a0d75826ee35d59ee42fc2abd82f45f68c3ed58708d1a6a8b4cf12aef5d74d8d48f0696c6ebf5f83d2ed8e0916047c4d471b1d195a789
SSDEEP 49152:m1hpsNoJpF1A6UU44CwH7R4xyYPKEnSG:mmifPbR1YPKES
TLSH
T1C9B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 90082bde1a0592386ad52eddd477bebd5883417fc64f011df93fc867678b507e
MD5 3ec6f89194713386f98baaf8503bdfd8
SHA1 c41e8109067b30a715b4d8d97fa754a5e4d62386
SHA512 a7ddaa301120eaa6087780b84002837b914f14a1fe4c3b4ffa1e427c1f5f42f283e8c6ce95b95c10910267476fb2afea59d074df65b5750e928a54ec715cee24
SSDEEP 49152:VSuZQIY0Be2KRRVtOnks6NMHqTYPKEnSG:75dKTi61TYPKES
TLSH
T1B6C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c4b664e63253feb7430f6fce2fb95019b588b81ba93f56076b3db2752bdcc28f
MD5 ebd879a9cddff539b4532e599b65059b
SHA1 d55c86f4f973a30c9915e12c50866a40d3c18d73
SHA512 2dbcdc2329147c4455e315051393cbb9ca8c538655ba532d543e466f5e26be5a6edc7c4effcf522c47da1da982c8e499b458584050c200056578d57fad2b46b6
SSDEEP 49152:3htSn8EApI0figngiDn0AP5wuYPKEnSG:mX2iyphZYPKES
TLSH
T17C95BE13F2D900E8D05ED179C7568632E962BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 18f00ef653f3d5e010e8315d966bd5a78276141b41ea642d615e52c9465c30d0
MD5 6ff30c3798d070de4f91d8ea2577cb39
SHA1 8d93717e31b9374d15029ca7097d95be8d55aa20
SHA512 f20525e7d9e27cad7ba18d6299fe72b56a11e9924a27db661f895dca6fd0d5e84bf98a7ee62df8162e297d6f51310e075c5dfa8e98ad7c6c48b130b423072701
SSDEEP 12288:K845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkE:K/Yz7KEMdX6keYnAcerB
TLSH
T142652304895B8AD2F84A467BFFF04540C93A6ECB3B8C93A5D94DF50293FF622450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 406bce686438b82c5592f62e2a46cc4c73baec6173dfbf5ed787bc97bc9bc9c0
MD5 9d90104d981617d20c34302412c22600
SHA1 e773bb270fcd957f9a17ecdf57ec706b8fcfabde
SHA512 b97d3d50b14e8917606ca06787212af3f99900bb094ae5a3d26ac8f395380bf6a9e9a58554cdc07ae57c5b9fc96078dd6e533264285efa6a70c8360637f61cee
SSDEEP 12288:2j45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkE:2MYz7KEMdX6keYnAcerB
TLSH
T12C6523048D5B8AD2F80A467BFBA14540C93A6ECB3F8C93A5DD4DF50293FE6324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 5a7dda925a873d3c9e9ed276f7c2a864302e1f84f85f47bb70e0573cd1da0ac6
MD5 40885029af4f16d4c6f1749474cdf02b
SHA1 385a1a2901d34b9c23fa99c376c676fce0568316
SHA512 00e2624c6dc729960749c86d1052c455c85a10e58f98b4f1b3d2387b4733a13d0ad166897a0fdd4e0df5e569a68b5f8a851c1d8124d57f13220d80d8ad79028a
SSDEEP 12288:Bl45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkO:BKYz7KEMdX6keYnAcerD
TLSH
T1C56523048D1B8AD2F84A467BFBA14540C93A6ECB3F8C93A6DD4DF50293FE62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 6377626dcbc196cfc6f6c6f8065e9188c73c1595ec8eb18c72f328b9f9d1761d
MD5 08d977209ffe80aee15b029ff29f6a8d
SHA1 4193f4b979308aafed05b4d26c6c9c02da3fcdbd
SHA512 0dc543472cf65e0ec19251f59a4fcd2b7f9865e7a3568c77f934bb44c410071577a4481ac2d2ca213e89180fa0dc9a85c72cd9faa5fad85536039537f8e6ece6
SSDEEP 12288:/Vm45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkr:HYz7KEMdX6keYnAcerG
TLSH
T1787523044B5B45C2F85AC27BFEB18500D6767CC73B6893EFCE08A5424BBE3615924B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 5b2fb0e6b5daec6d6c696dd4087af8e44b5c953116bf8c245daa2035f05bee6b
MD5 47f9d7a19b6a80cef51966d34b04f1ff
SHA1 dd5d548342169e90a0d4b8e6245a10116a5be3ca
SHA512 59919fa9233aef58cd71f5d7ba0fca60de363e926ca7e7dc674a4837af78418064ff25c4df40b1a77e7bf61737708d65a0ef5e2f538189abda527ffec408ac20
SSDEEP 12288:fu45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkI:f9Yz7KEMdX6keYnAcerF
TLSH
T1A86523048D1B8AD2F84A467BFBA14540C93A6ECB3B8C93A5DD4DF50293FE6324505BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 9c09069ffdba01365f0b789f72d432e496ea7fbd53f7d359bfb7cca5af6896f0
MD5 105b67bad444c49c3b244d12073e5d45
SHA1 7ce4c059a7d108baa684853cc8054f749333d5cc
SHA512 05daf966ddb22237a43f5755851891614af31588a473953e5e65933563f65beb7cf7793c06cc77abf7f26bf9286bcfac1ceb842d0abbf5dfe859032560804acf
SSDEEP 12288:wn45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk3:w4Yz7KEMdX6keYnAcerG
TLSH
T162652304895B8AD2F84A467BFFA04540C53A6ECB3F8C93A6DD4DF50293FE6324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 573b415d456c66206171df971e03788f8837e811b34f6315dc479778a5147ce7
MD5 02cfcf787b2026761d91cd8bba690818
SHA1 729b3e69ae63b877b157f12f75a8e7559dc52cb5
SHA512 c0302df88318127074e6392b27feaf59ea6d78610fb6319af64bd8c749a5365867bf36a2519856e91d31c255afa955e7c7b09585aa50e776b12c21964c33f033
SSDEEP 12288:cL45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkf:c0Yz7KEMdX6keYnAceru
TLSH
T1BF6523048D1B8AD2F84A427BFBA04540C53A6ECB3F9C93A6DD4DF54293FE6324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 80e58400e6c8021ab42d0e6c7bc3a31848551b67b21c6af1ccd2540988c23bcc
MD5 f729be75ead63f19f3c84e9ca62e57ba
SHA1 184edda53e6afb12c4395ea88498f562c9c09677
SHA512 9df86449b608f2b9c0df36ff4e43d029ea946d45ba329b08a4e53435534030da233d2d451388309ed59602f6565f42143e17e5b3bd26d75de1e55cd02316d242
SSDEEP 12288:MiZwbHzzFEoS2cPvyD45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkz:vZMTzFVSOsYz7KEMdX6keYnAcerm
TLSH
T190850194B3500CF4EC67823ECD658906D6B27C5A1B60C65F03A836675F773A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 768d04659b1aecbd4e4d449d8ce5b1228ed8fda4b6ffef97918941b772512c66
MD5 0ae7a9908f2e683f41f6ddea5f95bdb4
SHA1 8d46478f249f0f055b2fc68d050e4aa76ee4ddb0
SHA512 51c0fbcc8f7e02b2db503656338c54aea48a8a4fc2abe84599f63702e47f1b69f1129562956a72b1c8124b65b702cdc87ad3214cc4c1ca6e525bd0bc354d0ce1
SSDEEP 12288:po45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkw:pDYz7KEMdX6keYnAcerl
TLSH
T109652304891B8AD2F84A467BFBA14540C93A6ECB3B8C93E6DD4DF50293FE62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 83b672ccfa4558dbc2e130b4a98bfb58a695cd48d84e8ea457de0fd4275dac39
MD5 ed3c32cc5b66a241d90060aa4693067d
SHA1 6c766efb0166b3c75377f8fff5fbf5043015d0ab
SHA512 be88657661df576b8dc7158da94455519ebbe2c73f36dc255725b50539766ade7fb95aa9c943facaf532e08d414dfea2c7c73e0357a5223503f11013a8b6d4ab
SSDEEP 12288:XU45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkq:XXYz7KEMdX6keYnAcerr
TLSH
T1AD652304895B8AD2F80A467BFBA04540C93A6ECB3F8C93E5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 647371df986e0dc916831ec84dddbf5b60811b224339f45fbcaa48ca79c3d99e
MD5 5a03e6d9a5d0425572921a43bd0a1305
SHA1 774649353110d6994e14f6d3e2a1627f119d4e72
SHA512 24a2110587eb008d7c40b052caf0648a4e673b3806c17547ef6dcb547084a4492e08fa6db3a9c1952b7451f308536cd403ef3ad7148cb3a80fd7c7e7aea80280
SSDEEP 12288:QyPz5L8f45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkq:hzywYz7KEMdX6keYnAcerb
TLSH
T1F575120767A630F5E0278239DDA10A01F77278761B248BAF579457732F3B3A19D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 5cce6044603f3d22d3c50051d4237ecbe2da5c32805bbbfcabfb6546889a75e3
MD5 f37f69309af1aec7406c833c6b03df04
SHA1 908c2800bfc0c0f6ec99c3f2ae887cb9d4778cda
SHA512 3115393fd8080cca35b40b5d70765e2bdf8609f9a71028b274275a329bbd169d2d28d686ebc3c5566509f4feab3267e1f44baeead9d0a05d8c0248fc8b8448d2
SSDEEP 12288:Ao45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkK:ADYz7KEMdX6keYnAcer/
TLSH
T130652308891B8AD2F84A467BFBA14540C93A6ECB3B8C93E5DD4DF50293FF62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 b9999472c0b9707a28284717e391781db71e788b611ee1fb855ee001dca71049
MD5 88a4779f25a4b4f3bf04f3578befd920
SHA1 9ae5a51656d1aad521a8679002006d643371a5ba
SHA512 7696933455d494c7bec0fdaabb99ce12c5356726fc936e0785b1cbc6fa5b556673d729d76550bcffb92afa8c1bf2ff48020f8c5db9668d3d70f3fcd8dabe9874
SSDEEP 12288:Eo45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkz:EDYz7KEMdX6keYnAcer+
TLSH
T1BA652304891B8AD2F84A467BFBA44540C93A6ECB3B8C93E6DD4DF50293FF622450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 bc602e86954ee6bb0f99708405d1ff8b0788c373fa5c9a50dd9b54949412ccd8
MD5 985389252b3859c0e8aa796cdbd0f15b
SHA1 82438ea6c1473084e4afd60c1548912ad5ab9ac9
SHA512 6926680210fd8af23e6e6fee9b99d2e0a3058c0cf3dea65ab3743c45a6a1692d45e083dd01bb312cd6757582f7576ac633beff0c0bd015f6c07c62c9fee60c29
SSDEEP 24576:dCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAWYz7KEMdX6keYnAcerl:dCUxPTY+8Wg2lIL8lrIUJLWw9YPKEnSG
TLSH
T1E465BE1DA3DC0896D4BB81358A518A06EB32782E1B32D6CF2160C37D6F67EE55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 f7103d58039038d239af258dfcafdb61f4c067cdea97fa019a6b0b6d68a6dbbf
MD5 69990995e4a780ffea94559738b82c2a
SHA1 f9bb50c5b5e348bd4c0f30a5adf01dc41eb32bb9
SHA512 2a5eeb77d4d6d36cffae2d60a171e2f4e3cbcfd77740c680bac59104681a48827e33215fef9fab28bac5a7e8271f90712cb33654b49bd19e1438415c370943bd
SSDEEP 12288:5zsf445Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk4:ATYz7KEMdX6keYnAcerl
TLSH
T1E2750109C29802E4D06E527ADB964A40F3337C6657E1D3CB96C0F53E1F7A6909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 9a022a7086cd08d3fb3e996162684d33902c86d1b4fe79e76864f1dcfd9aee1e
MD5 71bfc368a66ed33009b448ca39e84517
SHA1 3318b10e3f6115cf8bce9f8b80e5024556aa1261
SHA512 60c0013363e516eca99016e9d856175d43068837028accab8c1284ee70a1b3475fc00834d461fb12f593faa027976e78887ea8b1a7d1b368227b5fc6abdd3608
SSDEEP 12288:zF45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk6:zqYz7KEMdX6keYnAcerL
TLSH
T13B752304875E8DC2F86E4677BAB58520953E79CA2F58C2D3E80CB242937E6E18D3574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8097abd887f2cbe39009eca6b5ea4a48c0748b8a5ec639e5fec39e27655aa392
MD5 9ff527acd85770b5d739dfb79318ec6b
SHA1 b62eb7cfa1a8ffe4fb12be50a7101d77237e8612
SHA512 fdf409bed51464daf0397b64955e751c306e93feb3bcbab2ec003f415611c2d3906b7a56d49f4e3608cf5f09c8acbe23c53503466e4d395e5c9b39c7c73d2ad0
SSDEEP 24576:+8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCgYz7KEMdX6keYnAcerZ:nRZwQCyiHiQEaaPnMbYPKEnSG
TLSH
T16A85AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0190C27D1F2BEF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 68a248e015b637cc42fa3ef6c72a20cdd82b48fd82f4dfbc5c21e8b43b58a245
MD5 62d6e0fc95d23258feaa34cc6d9358cd
SHA1 424428fcd6e7c9c25a18bcd20243c5d226d8de95
SHA512 8c650b7ff86c12d3544abb3e817565b9aafa6deae2c468d68d5942abc83964cc6b9820dcc37b9aec0de1d1b715dca6e1b1638ddc9ed9934ad0209e58a1f05211
SSDEEP 12288:AbxA1U7K145Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkt:AbxA1UGaYz7KEMdX6keYnAcerI
TLSH
T1E275122E56AD18E1F47A923EE9E18101C3327C5A272493EF5484D27A0F3BEE55C35F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 13c3f22e013dde994cb8048225220d8ec5df3fa559695a27c433d8bf8a8a00f9
MD5 7ac25fedefaaddee1a1be32ff09cb5b4
SHA1 504f85899bc0425361fbb5de21287ea5ac4ac3d2
SHA512 24189619d964af5156ad046794058f9459a5647523ace8978778ef3a48849c8ca305a8d64ac8feb99fc07568006c55e62319689a1e428368d512ef8f7aed6f51
SSDEEP 24576:ojsmP0yHaqrVqHra44KDzMsrnlYz7KEMdX6keYnAcer8:ojRP0yHfVqzlAsrnlYPKEnSG
TLSH
T19045AF2EF2B910F9D4AAD136454107B5EB71B82D1F209AC70170C635AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 6e428de1ca5302fe027fd372f411af56cb71b6d070c902b90d490f081b861618
MD5 160dba142e047f2f8decfa626f148164
SHA1 d880c76be817cb82b27a2c2566c290be201827fe
SHA512 7d8d3524989b2be9d105d3d898d171a11e46afd55db589d1974165e83462904e467f366bffec02180c51784f82b6825fd0cbee40e205c5c020c32f8470c6de21
SSDEEP 12288:BH45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk8:BYYz7KEMdX6keYnAcerN
TLSH
T19C7523088A0B8AC2F85A467BFBA44500853A6EC73B5C53E3D84CF54293BE6B7453579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2ca4f6a81efd797b44e9a3939043cf8c06775a5705c3e5221987c25336cea08f
MD5 662ba42860a6e7d711a84467f242c16d
SHA1 1a883bb772b71ef685fda25c27781772d3de048c
SHA512 c5b2425eb45a576da52530b691daf21a0c13f7d7d3200da3f225ca6dd0bfc9949c5ad1253c8460b0539f57a45942503de2a3203dc17b7da443198069f08d977c
SSDEEP 12288:/ObMA4LWO+vAYFTh45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkh:AMLBUTuYz7KEMdX6keYnAcers
TLSH
T17F950114E79500F5E86B813DC9B28A12D272B89D1764E7DF03AC8B561F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 a59482952931c9c37e2e9d9306ec04c5a3181182006ba8c34aa9c0033ece7d62
MD5 06d29157d6ee03ecd07c2a8b534a5514
SHA1 e7471728995b9f26335a11920dfe7ec01c9887d5
SHA512 f2151b8acab5286e1d6cb22c4185aafa434dcba78a1d3f3279e652a3fc34fc52a6f057d046c4cb042f3b0bdbcf20c5ac0a0aa2e9960c78b4e9b2fbd991c2b60d
SSDEEP 12288:E70VmKIYNvUyBpM45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkf:xGYNHJYz7KEMdX6keYnAcerK
TLSH
T16785F11E52AD0CE1E57B917EDAC28205F2737896171193DF05A0C27A1F27EE9BC3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b7005fb42e6334b20f616cc096b38b190521d5509bfa120eb94745ea72071e03
MD5 41a193f15b6413165f373747574087a9
SHA1 482fa8beff273273f2d4858637eb5b63e8b28f77
SHA512 8ff154138f773ce80a8247838381e7d4d89764f64e8a2ad8217cb8f84d2ee8de0f50f9da7e0da79dd6e0d1e0730d01a0869eefc7ad795266ed64a6c665a1565a
SSDEEP 24576:4nXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK3:4nXoJJYH84VVS6AmEcJas+cHBjSSKHPn
TLSH
T17065BF6EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 52e5a3c9025525e36bb2f1dfdbe77a2ff19d8fd1644d47d2aa4cac5371a2e311
MD5 6f2072624e4355f40433dff65e5d6e9b
SHA1 e6b9ebc2969861f104136e9d9e29599d8b07f7fd
SHA512 5b9497dcb25446c178f887c7debec6b24eed0bc51ad56f0af4c05fe2d9298a9bff4e9e9ea1f8fee1a3b89b03eb268f27b689c0f75a82db955258bf8c98062aa4
SSDEEP 24576:rv7Xbxd9Tuycf8M/TYlSuxwr2PCHYz7KEMdX6keYnAcerg:rDLL9TuJ0M/TYW2P4YPKEnSG
TLSH
T13B858D5EA2EC42D4E47BD6BD85B79046FAB2B855273081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 03d914a26481cd02dea5fd847848328a6ab9f2afd1543ac0a34e306173c03795
MD5 408214124ec8ff8202e1ebca5e84b9ff
SHA1 7fc2ecdf405f44ac691afd69bb8c3a4921f34cb3
SHA512 4b9866470a5cf3af001f7fdaea93cabf240eb32316a1d73a8d41c2b4f8e85f01eccfb954f782d686303c8f68825925d7d7d555e34bba7571b46ad01302a0aba3
SSDEEP 24576:6egJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wuYz7KEMdX6keYnAcerv:6ngOJOmPOHhuYPKEnSG
TLSH
T1DE55CF3FA7BC15D5E03EC17ECA928916F6B1782613255ACF0560827E5F1BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 bc69b5a8b8c347b0d105fbe22f0e370d59c5779ebbd20db68b39b1ed11b9d57d
MD5 927e8b2f43148c4f52414f012b80bff1
SHA1 7f58b14ae5d2a7d6233ee82233635ec634d8309f
SHA512 68621f819dcb418b1f2259b8d70ae2a76d98c608fc1aab6f74980109166e0b4d6d36aba00e918be5d28496f5400e4559e30de42aa08e57565a34057fa0a3fa3f
SSDEEP 24576:cLJnJiTk3R3waE4JrO4Yz7KEMdX6keYnAcerZ:cLJnJK8R304l1YPKEnSG
TLSH
T14385D02CD2A910E4E4B7C2B4825A1756FF32346D2F2569CB59B4D5313F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 cc726f4e3b25631b12ac7183a261e1e3fdc96dbc06286f949099870a13f3b52e
MD5 032914d0458d46d033c4f1be83c7e919
SHA1 2384e3be9681be18742a809b700a1c98c2b7dd84
SHA512 cf37c7c8ff0c23a0313456c924f6608ba00c94ee82c03369b302ebacb8192a07dc2b554f5e8610be894c251ffa8279f8b6ddf2839eab3d1fa47a3cebe5eb8e3f
SSDEEP 24576:FA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pGYz7KEMdX6keYnAcerX:q9GqCzDScAZmlvTcFg8Ph60YPKEnSG
TLSH
T10F955C05F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 8f4c26374ac9cb53cb4a0fb42b54217c65a83f743c0db36996e2fad376261b7d
MD5 e03c836c139781e85a6bab1c56a35749
SHA1 e2748365243f195903f859066df9d876508be5ab
SHA512 d9691009a2d046c056110ca2baf33f41282f4a3a06b265b7c342ea20ad7e6fb67bdf97f9f2042de97024793acbf22ccaaf7ea36c6b08caf17b8c83e538c3cb20
SSDEEP 12288:LlYJeXm5nkEUuER45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkD:LlYJeXm5jUuEeYz7KEMdX6keYnAceru
TLSH
T14E75120C6A9D70E1F02E817EEAA14900D372F4A6274553FF85D4D1768F6BAE21E39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 425a4f1bc69728079f38a79529b9696c83aa4f8c53be3fb303c77d2e80c3441c
MD5 ce31eb796001a5aefc8c35266283dc43
SHA1 d4c05e6f015bcc859680f5237d5d3c1c5dc2679d
SHA512 4660a76d9249076160e2c9adca0ed3dc2855565ea447ddddb669011a4790867f65d17a6e742651095c4c39be860c5fe171ba4fb510cdf75c938de76105b82e8f
SSDEEP 12288:JCu6ky245Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkl:JHtyFYz7KEMdX6keYnAcerE
TLSH
T130751204579555D1F8BA0639EEB28150CE36BC612F1483EF94C0F62F6F7A7E1A830B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 3e985b5448e8c1407feb7aa11ad94fb9290ce520604566dcda5b41b126860d3b
MD5 50c4f2f227e416bc58879625b920b4a0
SHA1 a2d13779678f5fde40d22f0d5c91c7ffa31b225b
SHA512 1180ff01195d4cebea3fbaf2aefffc9efcabd2ab4bf1976fbb9e2052cd3189ab0432a98c59806a343acef4ff912226e66a8cad91a622e75edee433a6086dc8b7
SSDEEP 12288:jPh45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkZ:7uYz7KEMdX6keYnAcero
TLSH
T17C75230C461B59D2F80A467BFAB14540C53A7ED63B5852FB98CCF562C7BE2A24431F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 cc1a1209ab8678724d6c3232635195cba2795a52f269b459da26eb2d3beb7641
MD5 09b35fe77d04a71e07b94aa29fbe09c7
SHA1 dbbca03f8291a60228b379e7800b12c47eacd0da
SHA512 804b2417564f50f2ac159e3f749203774e2ba9405c0eb79bb484aa42ef6c214cd3aff884098963a5c5d648bddbda3e7a9421482ca3db376d5fd24ea28fdbe5f5
SSDEEP 24576:rC+TyQIu93VAumZr7jmzYz7KEMdX6keYnAcerF:r/TfIq+YzYPKEnSG
TLSH
T1CD558D1DA7E91DCAE176C675C8A34493E633B872137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 8d92d90491423d59d44f8c341d8b59e904cb9279049c4a2d47717b9b9fcda6f9
MD5 0a58d822b348e32ce8261cea386e5413
SHA1 c3b07470f5cd2f74e976aa37cc325445a5f5e0a9
SHA512 2c99f0ca25d3921e2eeac64d0a1881035ca4753414d37ec92e62725f6288d5a722d161fa16912351f9e85c90ef87ecee68d095f117737eb24b7e3b7fbcd1241a
SSDEEP 12288:6cyrWOstaa3kcsd45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkr:bLQikZiYz7KEMdX6keYnAceri
TLSH
T1D785F10EB3AF00A1E4ABC23DC9954101F6737475171263DF4690C77A4BAB6EABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b29c7755bada75fe362bd6353470d1d005e63e983f764a2ad44b85381c508110
MD5 a37d801e70d22acaa3b9bc74019b57b9
SHA1 6c2c960c1bf8ef2d4fae935cd89f416230c26ea3
SHA512 7f4576c8b6d8d56b66dabd839cca4747ded272024767fa18f62458bfbd39360b7538488b22ed371681bd9c24e5f4cdc479f37eaba8695306a94075d897991b94
SSDEEP 49152:8pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPFYPKEnSG:9pC7b4+80GTk8YPKES
TLSH
T15BA57C3DE2B810ADD8AAC375C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2ca847c48d850519478a54de60d92fcc5e4b88230bc49f2fad58f6efb06ee482
MD5 64147329064b5b19fff6d242cc6e5c81
SHA1 f291057e1d3be1160fd89cb9b3d0b916cf68ece4
SHA512 2ebdff94b0a82463afb065212a2ea2274c84decc25a5fadadc25f4100beb53904227f8108b3f8fed446034d1bc28b18ecb56d5dc1c6e7ecaf05598e5dbed6828
SSDEEP 24576:6SAwJPE1IDAo+4Kt+l44135UQdYz7KEMdX6keYnAcerZ:6qPCIo4Kol4/QdYPKEnSG
TLSH
T12655AF29A7F946E5E17AC7B5D663C601FB727822133163CF9290813E0F16AE85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 7ec18f14392f6593a2d53c03fe1d6670b59225b4122c8b7d5c625202157ccdb6
MD5 693265234e0feff7c2a509d9d576bf0d
SHA1 789db0d932605cc45c02ce8fb56a16cff61620d7
SHA512 6a843e42be69dbd08b28479fe1fa862b82f7ed302c3cad9c41f96783aadbf0946aee8c07d7cb784594eaaf7861f5104e435d98607662c7e092ecf3d4d79d5a57
SSDEEP 12288:ASsyLCFBoPLCRyg6NQ4t+45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkx:4yLXPLcL94tNYz7KEMdX6keYnAcerI
TLSH
T10295E03ED66D08E1E47AC27DD6A38906F67238AD033166CB099491761F6BFF46939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 9d300e5c221f3854473261b67cb4a3e14d6d890560094ba59cb25e2ecb9d4f84
MD5 147b4462c9020e2314c2ae5f0406774f
SHA1 9a4a399d823a662892e3de6f806f8c1e77cfa873
SHA512 6e614f72e5bcf8eb5f897db85c5d3ddbf95b60576c75cf0bb96dca2f8e903c3d3b6c3fc81bfd8824e68087540a817d946d5c856d3dc95beea2920178540fdd01
SSDEEP 12288:j9lyvj3IkxjbBzt45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRks:jWv8qjpyYz7KEMdX6keYnAcert
TLSH
T17985120D46A468D0F47A4234FA728121C172BCB7276896FFB4C8E5774B3AAD1853EF16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/584-49-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/584-43-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/584-54-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/584-147-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1088-165-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/1088-390-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/1152-136-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/1152-342-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/1292-454-0x00007FFD07100000-0x00007FFD07309000-memory.dmp

Download

memory/1292-413-0x00007FFCC7190000-0x00007FFCC71A0000-memory.dmp

Download

memory/1292-412-0x00007FFCC7190000-0x00007FFCC71A0000-memory.dmp

Download

memory/1292-37-0x00007FFD07100000-0x00007FFD07309000-memory.dmp

Download

memory/1292-411-0x00007FFCC7190000-0x00007FFCC71A0000-memory.dmp

Download

memory/1292-31-0x00007FFCC7190000-0x00007FFCC71A0000-memory.dmp

Download

memory/1292-410-0x00007FFCC7190000-0x00007FFCC71A0000-memory.dmp

Download

memory/1292-131-0x00007FFD07100000-0x00007FFD07309000-memory.dmp

Download

memory/1292-407-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1292-127-0x00007FFD07100000-0x00007FFD07309000-memory.dmp

Download

memory/1292-35-0x00007FFD07100000-0x00007FFD07309000-memory.dmp

Download

memory/1292-453-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/1292-23-0x00007FFD07100000-0x00007FFD07309000-memory.dmp

Download

memory/1292-22-0x00007FFCC7190000-0x00007FFCC71A0000-memory.dmp

Download

memory/1292-13-0x00007FFCC49B0000-0x00007FFCC49C0000-memory.dmp

Download

memory/1292-42-0x00007FFCC4940000-0x00007FFCC4950000-memory.dmp

Download

memory/1292-21-0x00007FFD071A4000-0x00007FFD071A5000-memory.dmp

Download

memory/1292-0-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/1292-20-0x00007FFCC7190000-0x00007FFCC71A0000-memory.dmp

Download

memory/1292-9-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1292-1-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1292-112-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/1292-18-0x00007FFCC7190000-0x00007FFCC71A0000-memory.dmp

Download

memory/1292-19-0x00007FFCC7190000-0x00007FFCC71A0000-memory.dmp

Download

memory/1400-391-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1400-176-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1516-394-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1516-200-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1516-132-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1712-201-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1712-224-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1712-208-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1712-198-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1712-192-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1712-245-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1712-396-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1752-395-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/1752-189-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/1836-184-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1836-393-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1884-475-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-470-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-476-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-404-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-405-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-406-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-477-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-455-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-467-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-456-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-459-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-458-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-457-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-460-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-461-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-462-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-463-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-464-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-465-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-466-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-468-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-469-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-474-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-471-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-472-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/1884-473-0x000001C30B120000-0x000001C30B130000-memory.dmp

Download

memory/2008-123-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2008-16-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2100-111-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2100-52-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2320-68-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2320-74-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2320-83-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2320-76-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/2320-86-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/2372-162-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2372-153-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2372-389-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2372-159-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2932-392-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2932-180-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3004-148-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3004-139-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3004-145-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3004-374-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3332-124-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/3332-121-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/3332-116-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/3332-183-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/3420-161-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3420-62-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3420-56-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3420-66-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3716-109-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3716-114-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/3716-179-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/3716-103-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3920-175-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/3920-95-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3920-97-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/3920-89-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3956-188-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/3956-128-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4208-168-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4208-82-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4308-172-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4308-173-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4308-169-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4936-51-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4936-40-0x00007FFD07100000-0x00007FFD07309000-memory.dmp

Download

memory/4936-25-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4936-32-0x0000000000710000-0x0000000000770000-memory.dmp

Download