4268835e36c1a69ce1c2952f6a57012354379a4a7cf3203687af6b20287970c5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Size 8.3MB
Sample260522-3atcdaaw8x
SHA256 4268835e36c1a69ce1c2952f6a57012354379a4a7cf3203687af6b20287970c5
MD5 507767560bb9a0c0eb251fe612315565
SHA1 c75ea8d6ac811366b5bae0f054f79a50b3876fba
SHA512 ddbe54c8f8405dcdb3430f058042836d92fc4ce28d4d6cddec20770b1e1e59b6916d7612643d6931f7908b4bb0dbb67ac206ea91565d00e4cec54a6689db70cc
SSDEEP 98304:fYOrRn+os45gaHrh/w3D7nTsReRR9KCHngbr:91/w4ReRR9L
TLSH
T1FB96394677F455E5E1B7C2B489B696B1FAB2B8951C34E70F1061821F2F33AB09D2D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4076	alg.exe
8	DiagnosticsHub.StandardCollector.Service.exe
3320	fxssvc.exe
4352	elevation_service.exe
4764	elevation_service.exe
4744	maintenanceservice.exe
2724	msdtc.exe
4760	OSE.EXE
3688	PerceptionSimulationService.exe
4732	perfhost.exe
4068	locator.exe
724	SensorDataService.exe
3832	snmptrap.exe
1604	spectrum.exe
2664	ssh-agent.exe
3556	TieringEngineService.exe
5040	AgentService.exe
1684	vds.exe
4376	vssvc.exe
4200	wbengine.exe
1560	WmiApSrv.exe
2524	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\63701c4479c0b0e8.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7d9596b41eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b5ec06b41eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074d4b66b41eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec37b96b41eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d83e66b41eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cca8f6c41eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
8	DiagnosticsHub.StandardCollector.Service.exe
8	DiagnosticsHub.StandardCollector.Service.exe
8	DiagnosticsHub.StandardCollector.Service.exe
8	DiagnosticsHub.StandardCollector.Service.exe
8	DiagnosticsHub.StandardCollector.Service.exe
8	DiagnosticsHub.StandardCollector.Service.exe
8	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeAuditPrivilege	5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeAuditPrivilege	3320	fxssvc.exe
Token: SeRestorePrivilege	3556	TieringEngineService.exe
Token: SeManageVolumePrivilege	3556	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5040	AgentService.exe
Token: SeBackupPrivilege	4376	vssvc.exe
Token: SeRestorePrivilege	4376	vssvc.exe
Token: SeAuditPrivilege	4376	vssvc.exe
Token: SeBackupPrivilege	4200	wbengine.exe
Token: SeRestorePrivilege	4200	wbengine.exe
Token: SeSecurityPrivilege	4200	wbengine.exe
Token: 33	2524	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeDebugPrivilege	5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeDebugPrivilege	5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeDebugPrivilege	5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeDebugPrivilege	5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeDebugPrivilege	5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeDebugPrivilege	4076	alg.exe
Token: SeDebugPrivilege	4076	alg.exe
Token: SeDebugPrivilege	4076	alg.exe
Token: SeDebugPrivilege	8	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
5004	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 5976	2524	SearchIndexer.exe	115
PID 2524 wrote to memory of 6008	2524	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5004

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4684

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4764

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4744

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2724

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3688

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4732

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4068

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:724

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3832

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1604

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2764

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1684

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4200

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1560

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5976
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:6008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f9303fbf64ad114825933a7ea500117e862737ae6e23eb7d5d20a77128dda7f9
MD5 fbf2791b3b13256e0052fd49be5c209a
SHA1 c56f91d759b3a7f322db8c7d12b4250417c48079
SHA512 caa0734cd6703447985c66081cb6c255bc13b02d8679046f2b4aacde3c176de6e6eed051ee808b325d5a0c8acad524f23d71e1d231d55015bfe1b1a0195bcf8e
SSDEEP 49152:ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnRqHCHOqFWMSxfBp:M3q6sjBdCHngbr
TLSH
T1E1D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 de238ac590fae37199fdf2deb6d099976071707c45d3f0a83c29167b4ba1fb3c
MD5 c99c806b256f3d945ac52f2674e169a6
SHA1 5686b109c16588ce6143bdc2679dc7ecafab3178
SHA512 390655720d9eae458dadcf7983270b1f7ce8b2a1645820721240ec501c39e2ec0390c5e2d38ab1681cb99d212a9513bf807b3ed5c24fcbe31a0e80127158af68
SSDEEP 24576:NXYfDtczAEWWquSCHOqk5qWKWMS+I762fiop:YtcrqHCHOqFWMSxfBp
TLSH
T16875F12877E408F9EC6B427DC8628512D6737C9147A4F78F03B49A651E332D85E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9e5bf8769d669b70448c81628fa0e3d8bd08a92c97621cc84e6cab162cb12bfa
MD5 dbaa9d1be0656e453145faee51519a25
SHA1 5c6ea6e944973972ca5db712bbae2579c0d7c21d
SHA512 f9b2bf3aa6f7ef0b08cab01c6444f0dced197de670c98285fdce0a895cb2d295f324e7321621aabf6c0ec1e8e6c4f8a59e8ea1b52e8c65350bd1b92fb71ed139
SSDEEP 24576:q0Le5ji0hmxxrMdWWquSCHOqk5qWKWMS+I762fiop:qPji0AjCqHCHOqFWMSxfBp
TLSH
T12C85AE16F5748331D073C0B9C5D2A69EE97230825B308ACB4296D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bc6c3d05a3a45d84f06aa7fdd56a23bd4da6b222478a19ee00754272475078e8
MD5 5880ccbac566de024cc0dc7b3dbaea7f
SHA1 fa5f2fa15c97881eb40f28f47b35c27a4cd67b41
SHA512 9d6005240fe215add284b5f637bed37405a580a2bfd009ec117d153383c4fbafc2c2190fbe80ac451702bb886d14c6c27a17271c2aca8adde87733cef4f8822b
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWn6q8wyuHWWquSCHOqk5qWKWMS+I762fiop:p/ezSC6vUzPveHjyWqHCHOqFWMSxfBp
TLSH
T1C5755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8d8db2157c4b1783bf2a9cc453841bdf68b1516f4bfe4ddf58b4eb45cd9650e0
MD5 8727494af28a5e5e4f139d444c123dfc
SHA1 dd0cdca9b3193e6e22fc745db0af55e3bc07b9a5
SHA512 4fb5121e07b350d4e4d4d7818b640703f0404cc3ed6587d4f26b9ed817f4e0646261b388e9e2251ae8080b7b8d996c308bcdca41d48a7bea5f12dfe84b311ca9
SSDEEP 24576:3VbqPb88hv/l+YAWWquSCHOqk5qWKWMS+I762fiop:3VO88hXl+DqHCHOqFWMSxfBp
TLSH
T122559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 145f105af49bd8ead6cc6e0d00966db96c4843b88dd8c81f3fac685310a563eb
MD5 e0f9774448356d72fd590bee8a52534f
SHA1 241785cd7b51b4fed73b4e63b64721c1e9a64c98
SHA512 1222b8d5fc4911995f54c6a2abe0216cf89c3b5defa02e79c845f6473f3ab8608653207d7eafc70928e1ce4245b7c28152a80f8ef6bbd83612429a91ba153094
SSDEEP 12288:YLZDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:YLZWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1EF552316999C1042FEFD267EB80D39E6C2733FE06ADBB64E8375B74920305B166D9138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 b4e1dacf005eac2d25f4f8df917521166869508ea1e55d1afd78c71348b800f2
MD5 ef4b2eb80130f3c4763a1acc85ecf824
SHA1 a89af0bb741b0c9ee078634216d520795a0a3a24
SHA512 361b44f9d5975508177a1313ea2d9f87df4c336df55aa47a478b311d1fbbc8ebd029d31c9adb7f219605e8d8353fde53940b79eaea2843e79d52581b5b28f1e2
SSDEEP 12288:ieBNUbTVO86UWDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoWb:iJIUIWWquSCHOqk5qWKWMS+I762fiop
TLSH
T13175CF3BEE28FCD2C67E4DB95A518640D77278704B62A3CBD175830E9E235E01E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3bab16b3a5d58c6619ca5e1c70b0e3f862c7aa8e8da3dd26f405fc58264d7d7d
MD5 dce9853ce949598f21fede41fc41b4be
SHA1 e4f9b41323bb78e5777c94b23809602f3f8fabf0
SHA512 1792ecd9f5a341fdc0900dd112b6e3ae5baf0fd3cdfaa612c453d932d85ed4d5658a76414ec779fe79ded37962574e3f8d9abf93ea7e2bd8f1e6a868461e6c66
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THt:cQvGAdlCEL8c/DRNw5CUCHngbr
TLSH
T1C5266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5301ac81eb3f2b9be91fd365f324e7768cbc8e7be7d7cfd455491baebb88218c
MD5 213c658d9f3ea05c74fa2e8b9ef5e575
SHA1 58a45447d28a74a37d07f3f62031df3a38fde466
SHA512 ee00a1879f6aa57f99e183dd75a055bd78e47f8413bfbcce45ee3f8aa977f1528b3aec068352724d8c0bf31b6ec4ac5154d17fb3420e7f32084e2cec8f1a1a67
SSDEEP 24576:C0ewsAjqWWquSCHOqk5qWKWMS+I762fiop:TljSqHCHOqFWMSxfBp
TLSH
T14A75E031FE74D032C6BF0DB61B26D716543D7A604B912AC3E3B89E9D59302D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 47adf008bec228cd6c441f84d0c7dcdfc91ae5760760d9258fccd4bde3e5898f
MD5 488056ed3d48b396b4440ebe151a6fed
SHA1 c5ab091225fe6e9cfa55cdfaf292b8e21a350d07
SHA512 b641039417f6ee6cb5ed2df60ae962cc7988401a5a7cd83f670536341277b18ee91d46598b25d49a6eacebcd61ddb85484be07751389f58a4e2c4a05f0de91dd
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHe:LUEtQevvqc2W1cpV2tI32
TLSH
T15B474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 716741ca5ccc99638cbdd59f243af05e8a8d48a709a824f06d101583ac0e9243
MD5 4052751a4ea58c9ed93ddeb5916e169a
SHA1 23294150f582b9d562043c4612ace8905d944e5a
SHA512 c72497b55ff5b9442df0cdc196485f3b24d3f71903d28cba03c5863859f689cc835f482e94c7f110eaeb6878bcfa1cdec2542dcea48d707c60563dfbfad3c4f6
SSDEEP 49152:+CbRquA/m2yL5zifFiV+XenmE3/zyqHCHOqFWMSxfBp:zoqHVjnmQCHngbr
TLSH
T153D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 10d4a7b12bcf82e155011a934247953e211daae931f369a0f9eefff22ba61940
MD5 30e0144f7488e4f9e703b794e3da0c92
SHA1 5511f555c8a5a5c8e1d1c5a6875825c97d20bfe8
SHA512 593a6641af10fd0c13396ee34560527891c938508528226ee3a2571ad52f8aaf5e711e206d377e68723cb8706156018bb443b276978c774ae208a7d4f765e85a
SSDEEP 24576:MAhGL3IFoiwtA5l7S537WWquSCHOqk5qWKWMS+I762fiop:MAMUFoiq5vqHCHOqFWMSxfBp
TLSH
T1CF359D81E7F945D4F5B3AAB899B69171EA72BCA55E31D20F2160D20F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ce572d03716e9a3b815375322aa0d2bc12b36eef0632eb2ae52d560028f82477
MD5 642b9d0af8f2a36efbe6d4f4c42dcea1
SHA1 e5821e83632ddc594e78d726417bfaa87b0e7cd2
SHA512 af88f58cc4d58894d00dd09dcdf71dc07c0013e52683fd53c2bd12d1b89be859e7b255de818af059d5cbd65bc0e939c826dbaf570605e044cb06af91d3c131c2
SSDEEP 24576:cwu4OWOWWquSCHOqk5qWKWMS+I762fiop9:cwvOzqHCHOqFWMSxfBp
TLSH
T11365F14676A80CF9E9A74239C54B8136E7F3BC512A65DB1F0370C65B6F332616E2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 15044b48551d1d5b20b3edad911da1b4f693130dc1aa0a74d3fa66a9128f84c4
MD5 7e472ad1058737b52ff0c177f5bed207
SHA1 e7f1da45ec324db679d58bdc0d3d0cafe06ac2d4
SHA512 e71a44969636380672d66fa7d20c78de4e0a7fb833f70063b2eb4f0de52788469ef49b544d61ae689779f4beffc031ed37719feb6a4e56dd4d15c301cac2cd6b
SSDEEP 12288:MeZ1IycDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:VZuFWWquSCHOqk5qWKWMS+I762fiop
TLSH
T15555125A32E820F6E5A7127DD8995A46C3733CE267B653CF027453692E33AD12E39331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3d9a56e183db8c60e6d753dbe6fbab1e221ac0d9eedd571975e727e1eaa623bf
MD5 fd16e1954141c2326e2bab6605a10e99
SHA1 9c8a57369aff69be51d1ebb0beed4e5d4f0366c0
SHA512 3385168eb1619a87708367fc6307d6f06abc4e50ca9ef536fe136d7f32238e1d38fd5a5a83bc877e90c9a0c6ad4c96f5d14be57104b7be7f81c9693975724391
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:NQRQyi36YOcPbLvw2gAf+PN3BCHngbr
TLSH
T13A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 93076912fd23bec329c1e1de32734b9e85bdf6a85afe75543ff7655caeb37dfd
MD5 a8bb8ac597238692476fd62b169bf5e8
SHA1 b481899e29efd6c8c34e7b218f7c6097f4db8481
SHA512 4beeb1a276b07b0d2760a70ae6b27e37ac04878641e7265bd70a2d3cf7dc4415f620432cdfa4ee1386fbc9c694db14274892611399959ad2b2c9fa9a3d1dd5c4
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:WQRQyi36YOcPbLvw2gAf+PN3BCHngbr
TLSH
T193667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a6d7536ca1dc96288c1efa3951b6a101bb870ed375299424bfbb12731347672e
MD5 9b17145e2c69d5d61b3958bbf6bdbeb1
SHA1 0b7e864ef770f5788b8927462e9b1dcfb866726d
SHA512 ed301bf470a4523aaf70c771b6f604c4290518d01f70f24cba919229fc071c23941141403ec044b3044bee92fe512371acd549965ac77bb07456855bc5e440e2
SSDEEP 49152:w68Qg55nhceWu7PNU3/CqHCHOqFWMSxfBp:qthLRc/jCHngbr
TLSH
T1D0B55A33B2F60099C44DE1769F4A973196D27C718FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8bb3c898accbf92f6898a5b5ac6c3b5d6b1c92177653c31069d1fb3231c3e17a
MD5 00c5ab3b481153854021637e9c805b40
SHA1 f51eb43916121afa40ab9f3e0329b8d57f46553f
SHA512 7ff1224c18427e2898e5063b9835a66a78bbd57c94f818d85751e208a1225dd685c90402b40576017e85f7061cc71eb8b883c37279ce05507c8cebc1ebbf3ee9
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99X:/y5112gYy5azzVvt69nLKnhZSCHngbr
TLSH
T1AD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ef53c5aefdebd12f62349d2969e56dc667e666464454ea42151778f89b1ea7eb
MD5 fcdd95cc418d70f5ca96343ce344a6c7
SHA1 3c8a6dce8e1c03e80bfee320f2fa15e8e46d6fb5
SHA512 e3369be20ac80f28cf8f2bd1d6daa05e260c8af218f703d5cc0166a56c64f6fc37c2afc97d60d3585aefafafc02f758201258db606e8b2f0c0654ee0e9d6220a
SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glkqHCHOqFWMSxfBp:zu6Jmdxd2dpCHngbr
TLSH
T1C9D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7e1c56ac56c047c57115d82dd80e1ec456a1e696acc599bec19fe57966b4ca63
MD5 fe01674119beb7e73dab144c00aafae2
SHA1 0ef821725c5d6bb4678f6f192c60404e1205cccb
SHA512 3fc18f57a307d3b605b854601595d6fd3a9b4dcf92107de5f8c2c1dd1c094e4dc91fa2bad0bc2be8258554a047ea9e88bdcb69f23eeca764e736e1f842759a57
SSDEEP 49152:L1hpsNoJpF1A63U44CwH7R4xYqHCHOqFWMSxfBp:LmifPWRQCHngbr
TLSH
T10BB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 882cc2ef43fbd6708a0f8b549167568e7897a02e4b9fb2ce4187649e502fe798
MD5 7de30eb1b64a86399bc910b0cc669310
SHA1 f80f61724016a7de412356b383c227e6cc38495b
SHA512 f903ff21a56501fb56f8a04cbbd6074c63205176557f6be07a511cb00dfb0082953658d751f1517f977ed8b0befa98ba18b32a1d065fc5b51906c0493972ab01
SSDEEP 49152:DSuZQIY0Be2KcRVtOnks6NMHqhqHCHOqFWMSxfBp:h5dKii61GCHngbr
TLSH
T106C5BF13F2E940E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8c322df1aa4d80b79e5400d3d61e8769110775443d1bba9a62966bc2b89e884e
MD5 fa24d3b7213a0e478e72f206c3631b7d
SHA1 27a89deb9e2532813d951a2a5d2d25fd74af2272
SHA512 b94e35e031f6fb1ea8629052a15796e5b652bb8de67c33ccfcd06bee911f18b3c69583338449861a35e04909b194a7f91bc1e0aeaa3b7d3be809b47fe764a501
SSDEEP 49152:IhtSn8EApI0fig3giDn0AP5w0qHCHOqFWMSxfBp:ZX2imphsCHngbr
TLSH
T11395BE13F2D900E8D06ED178C7468632E962BC550B39B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6503538f461ee99dfba842cd4bd129ac66f3eb2532638d0c3819a711b6e00b58
MD5 d75dcd22b8ca522cd0ed0580a9d24ee7
SHA1 c3264ad17c541b7e82b8209130c6823c8178a451
SHA512 a96497a19ad0f366531f2b4577c1bc74c0bc5f2b84b070a5830c3172dec48c6f863962d7d2e2e230a07790137c960bfc3838471ba4188d8b3dedd6555f7651e3
SSDEEP 12288:ihDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:iBWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1B3552316A8AC0443FDA826BEF80D35EAC1733FE1BBDB724E9379721560315B1269913C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a855ee49aebf3bcddeb7e7bd70e88adf3774b86ef17ce08fa67e09a68c9cf519
MD5 32e95d956f0d45a5a36e2d3b969ff126
SHA1 6e5ac9ba4d95a105aca62eab58367a879306130d
SHA512 4bb1592b016a0a4178056f05a41bbff3d86f523f1306a0239619283dd357ad39d4d271f5348ecf574037654550f2b08569457b8a81a02e6c29b2bab7e0678630
SSDEEP 12288:nADWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:nmWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1A6552315A8AC0442FDA826BEF80D25EAC1733FE1BBDB724E9379B21570315B1269953C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3c82d2f239ae83fd6b413db7606caf6ad36ad17aca0747ce82eb33492bbdc1e7
MD5 9241009b625d971973d615f6793a2395
SHA1 b84206e155a00ab7e0fc1c03b576a43cc86279ed
SHA512 2a3765cff6b05364c967f368cb8cab72f6c9e5b2d481cc2d801134948dbd0f638e4be8322058afb54b18105b0b9e6883acc8cb7858f90c645e2b433e23e05fa6
SSDEEP 12288:y+DWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:yQWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1D5552315A8AC0443FDA826BEF80E25EAC1733FE1BBDB724E9379721570315B1269917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a40f1cebd1740f5bba2c8242e34b1ef7984b9809c5dac21abd95dc21d5b0f633
MD5 2d653c2e89705a0005ceea682542b239
SHA1 d2767812edd8b91378be1c2cdce795dfa9eaca2f
SHA512 3b47efeca76b3cd49abcbad7356783cbc303214194cc43078554ee46a4d614cdf2dba6ca2570a72d0cb363906ba5ed556ec66fc3c6bc5d4d977c1a5846e3e3ef
SSDEEP 12288:sV/DWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:UWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1C855231665AC00C2FCB9577DD80A25A5C2B37EE1BBF7739F9320764918317A03A79638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b35a7763eb670d4e2eda7f081a59de25843af0e8bb952fd85649fee9acd86d1f
MD5 3e005a793caeea81bdb9058cad101296
SHA1 779d3172c8aae7b0e11201cdec9c9b0278759af4
SHA512 4a65dd5c48c51d2ff24dde7771aa9f1d4539c098f8548b64c4eaee79acf538903366809d2ebc5397103e2bf52e17ef2dea8a1d947c41bcb47d25ba0d21609ce0
SSDEEP 12288:KXDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:KzWWquSCHOqk5qWKWMS+I762fiop
TLSH
T14C552315A8AC0442FDA826BEF80E25E6C1733FE2BBDB724E9379721520315B1269917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 570fc22ae135427d7cbbd10e5c6c33da9909680881d805837d83bfa1e24c3326
MD5 58f8fbb812b227b9ceec903ffea32284
SHA1 359bad95bcecc059860fc6e25178a5861829c841
SHA512 0818e57cb45560e73b24ddbd30fbf9dd2618c404c8375927c4295db871707e0b68d3e429afa13029f127816ad5e70ae250d267a44840035ea1556de630d31e76
SSDEEP 12288:BUDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:ByWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1B6552315A8AC0442FDB826BEF80D25EAC1733FE1BBDB724E9379B21560315B1269917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 62be41f2675bf06da87116ac4c127fda631cc1fb3ebc4f5dfec80d26739217dd
MD5 ce23212e32569512f8c5c7de5a1dcdd2
SHA1 06ab30f5bb752bb87d693ab493b67cc29ac2960f
SHA512 9c70baadda605b498672d93cad005da46fbb170891468d5925244ddc26d2ab2c78cbbeec0a84cfae79f97a8723f356517bfa8effeeb2a0bd0e843de78228d7fc
SSDEEP 12288:OYDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:OeWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1AC552316A8AC0442FDB816BEE80D25E9C1733FE1BBEB724E9379B21570315B1369917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e7adbceb4b77e10d6c33cff7402eff35fe3bbbd140a262074b23347b2cf8e53d
MD5 e13978f7d31311bfecdccf49c3f9324c
SHA1 19e5944e43b11cc7fa432b8dc3787348a3df8997
SHA512 e9af02410fa6f74869d2d4374f0e8608a0f9bfb84103dddedcc2ca26d602e7ee5c2e790254bb74f7f732f773bed2fd3990b974ebfc67fa3c688b3e319c4b5547
SSDEEP 24576:lZMRzFVSOGWWquSCHOqk5qWKWMS+I762fiop:lZMRzf6qHCHOqFWMSxfBp
TLSH
T1B6750195B39418F4ECA7423EC8155916D2B37CAA1BB0C61F03B4366A5F333A11D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 03a97ab6d0f004e264561cf729867a34b2c48cb41e0b5ed454112b574229e62a
MD5 b91c997e502142993b34abd55e18b1df
SHA1 f4fd4473a28fcce2fdf3ecc4f56ebef692312197
SHA512 f0ecb9716a4740b0dc65d2bffd4493e00f827c40d9b54d7fedddfd4fb346327deb7aedb82f9699ea34df399ab8fe9abf8ec1814952d7f069b09155c107ccc4c5
SSDEEP 12288:kdDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:k1WWquSCHOqk5qWKWMS+I762fiop
TLSH
T134552316A8AC0442FDB816BEF80D25EAC1733FE1BBDB728E9379721570315B1269917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ed4d9e7016e0d9943184ad612c549ad2c5ced5d147455372cd90c7e49419543f
MD5 29d6c513479e6d1e43b1ff2dc7d2e842
SHA1 a13db2ae99db967f4fae6ec3e4b2bf9d3830de4f
SHA512 8ede50d451b2899b53ef06d2ddadc4410c2b8bf24128586c68357f833bc4088b37761c8ba1f56a30a342cc9b84f96229e28a2f19a1664a4a3c435d799e2d6cec
SSDEEP 12288:3JDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:3JWWquSCHOqk5qWKWMS+I762fiop
TLSH
T170552316A8AC0442FDB816BEF80D25EAC1733FE1BBDB724E9379B21570315B1269917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ecadd2a24cec43a3733e8ab6a0f3916d4524afe2fc7ca96701b58ce8303fcae9
MD5 f8194342ca41d0297c62cb235998fbdc
SHA1 2a976c64023a4aa00d89a7b2677ef215a422e176
SHA512 10ca8bba8bc4e6259c56e35063bb7e4032c7bdf76e1978b7c70550ba6d9b48a00d32a3a8174a9c28f9e98d841ca20668ade8a7b9bf2a3ba98e0c3a561b4484d7
SSDEEP 12288:5yPz5L8cDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:4zyaWWquSCHOqk5qWKWMS+I762fiop
TLSH
T15565120772A430F9E4765239C8561A52E3727CB21B619BAF537453762E336E06E3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7a2163eff1347015eec076c05a966dfac5831edd3159e4c4a8597ed6f82782fc
MD5 b6d6b54a4a1263a90d55ce32d5080279
SHA1 381ffe798e39de75634a964b7bbfefb52bfd1d05
SHA512 5b95f41cd3d9fc89aa56d73c458c09b77a21370deeb619555a71b8e8dbdd85e9479bc0b9bfb9225bb6907e3524e728cf5cf100eb07fb98d7885fe3837b89f285
SSDEEP 12288:HdDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:H1WWquSCHOqk5qWKWMS+I762fiop
TLSH
T173552316A8AC0442FDB816BEF80D25EAC1733FE1BBDB728E9379721570315B1269917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 83d0f82454dab7ded6e31272d355d73aec8eb504d7abb7cfb74e29612363c721
MD5 3f68aed0d6f884d073f969228dbab7c5
SHA1 584871bb244f2592b72e1a561b289dd32a5ec853
SHA512 7e8ca3081cdf65eb84e2765b8ae9d2e7b74a873e23ff3b33c83e89228bf664918c777cde468424e4160910e12f670a1b291a3976e03ca2dad5dafecd09a8eef1
SSDEEP 12288:9dDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:91WWquSCHOqk5qWKWMS+I762fiop
TLSH
T1F4552316A8AC0442FDB816BEF80D25EAC1733FE1BBDB728E9379721570315B1269913C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6759f33b3cfe8124987de248c2c21d5b5e92429cb40f2317bbb4fdf95892ac07
MD5 ff73577755b2d893c73ad0adacc0d973
SHA1 769d09bf30fa88d0d147a2403b77427f42acd34a
SHA512 98bd6cc3bec905cfcf8c4da21c04e55833482065f2d57ac9fb7ce155e4b1a248a971a1076960b453103905f945f62d6d232d38be64f289338ebba51015b0b1b8
SSDEEP 12288:dyPz5L8cDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:UzyaWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1E665120772A430F9E4765239C8561A52E3727CB21B619BAF537453762E336E06E3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8aaf08c16ef9299ca72c4fd569c47bac485b47c976818841243100da770eacbb
MD5 86cd8e4448287a9e9ca27da00ba194d3
SHA1 3a98705c44869661f6ad7905f68223ae020937b9
SHA512 5f929e4ded1838af392cea211c3bd436c9d70a2dfa2beb459a41ac2699d292102f03961d5037f16c0ae918f9c7d0590340698b37b27cfa1614952ffeafad7972
SSDEEP 24576:HcP4mcvIjkGOxhKP2l71SNKbrh/8KBtWWquSCHOqk5qWKWMS+I762fiop:8P4m4IpOO67N8KLqHCHOqFWMSxfBp
TLSH
T10165AE2DABDC0096D0BA917885658A49FAB1742A2F3286CF1160933C3F77EE54F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 feb98e9b1f41d6f87b74dd69907396f228069b95e9ae6857b75a8a8e2181761e
MD5 c98a959de2b96134914263d6b6ad2a49
SHA1 f096022a288964f32ddc7281edfcfdf9484269a0
SHA512 e47cd14958df32e9f024cbda955ab59721ccfa2340f287412fa845721a6291b8a62a73b7657222d53c544a1eb92b791cf32f66b5b7578f60b91acb6a977dd330
SSDEEP 12288:bbsftDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:OFWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1E165F019D29801D9D4AE2279CB065A41F3333DA197E2E3CB53E0F53E1F366906DEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cfbe079e14c0ee99e89eda78fbba9e07851500444f331b00991c338d209a901a
MD5 e9e74dcb02b88aa4ed9dd6c0f4878202
SHA1 3423ad59d8e1ec38f5ab70c11ec63402aefff19e
SHA512 f67efcd2b330b7223d9d35539111d98b83e84f71018f2a335e5e0e937b90533c56afceca521affecb3d8b224b786aae9b180d1e58e9b72ecc0c6660fd0422168
SSDEEP 12288:QNDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:QlWWquSCHOqk5qWKWMS+I762fiop
TLSH
T10F55231695AC4403F8F92B79A80E6575C1373FF06FD6B28FA325725920309B12DA923D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 fe5631eecdaa7b111b5d3b5cee091baba1f2c1882f1ff3442945dd8745d188c4
MD5 05b4604bf66d373cdbdcadbda864ad54
SHA1 8d8cde7b68a142102e1aa8df6daca2e8bed786a1
SHA512 4811c6c101657ff490c1d87a1b273c6076a51336e1a4754a49abdaee58ce76985191a5f3d46e2567906cf7ce9fa24fae223b79f8cd1e1bc4bc538bc769cdb8e6
SSDEEP 49152:Ra0h2GEkuAe73q3pp46zwwQnqHCHOqFWMSxfBp:Ra0hNYG4JwrCHngbr
TLSH
T1C885AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 c63c35a0a948ce39e953c954d659ff007998d25a84a3c5cd8696b62edaf1d760
MD5 4a9f7460e9fe726c23aba9ea9df76a37
SHA1 176b12245377a9a7e117e529e9bc91ec8c662178
SHA512 18451700d1ec6ec71dd4aaad32cebfad34c8bed44343241e211324d547846c9ae7b685fb08305cc8bbbf73fe74bf560c2cfd6202b5d469620ece67465b20db0d
SSDEEP 24576:PhbHjP2WWquSCHOqk5qWKWMS+I762fiop:PhbHjmqHCHOqFWMSxfBp
TLSH
T12B55123E26AC20C5F5B5A27D9446454AC332BCA12762A3EF13E1927D1F37EE01D39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ad372e9b8c994389683d3fc886285da855e4df25694b50dbafc207bebc415f31
MD5 65fd4cf6640ce033d4aa74b7afb0265f
SHA1 6af5ae66b9a778834a672a85db562312d46a3514
SHA512 6d9653bfa8818c96a0ddbbed0038ebc00b86fc267084fa4b2d556862ba4a4f4f5b8433a5a6b2aebe6fbefcf087daa6c5f0305d40526043649195012f38bb9228
SSDEEP 24576:A3YgnJcRTk4yti+R5dpR/OWWquSCHOqk5qWKWMS+I762fiop:AIgnaTk46ppR/2qHCHOqFWMSxfBp
TLSH
T14F45BF2DF2B910B9D8AAD236450147B5EB71782D1F209ACB0170C538AF1AEE85F39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 0e40740344f1437173bb863c30bcafde686b8ee5cc9159ec23d8eed095ce5488
MD5 9baee0f55f22a1ff247ee971f721260a
SHA1 75019f33e2e8fdd3a64a62a94c7cee07d644a304
SHA512 72140890edb309645e29c0c506aa71bf499723ec6db4d2d67f2b757aef117fe9004f1d95805796eab2ac21c4ac00f4bee63f3f5fd36088f897ab36c11d20c532
SSDEEP 12288:p5DWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:p5WWquSCHOqk5qWKWMS+I762fiop
TLSH
T1F6552315949C1442FDB827BDB80E25A9C1633FE06BE773CF9279B25560315F236B9138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 0742b8e5819a4b173bdd518abe959c4af878d3fe3aa770ada9e35b1cf2b48921
MD5 ef2af1cacf6a83f2d674f73acc626519
SHA1 79d5e90b08bb4bcbf391124c004a6f13e4bb2420
SHA512 e1848e944381424d49e75375ae851f737ef96cb234f71c7efad0135c9e488157db3048b99d9066084a637b7bbd4f661118d42b68f5e81fb6f8d029077051860c
SSDEEP 24576:RbL3UTEWWquSCHOqk5qWKWMS+I762fiop:RbL3U4qHCHOqFWMSxfBp
TLSH
T1BD750115F7A400F9EC7B923CC8669A16D272789D1764E7DF03A84B651E237E24E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 dd8e0d8962dfe1ae49a9113c48721ae4b4c231de9e334eb95423caf169844740
MD5 76037ad181afcd2ab239bb7a684d5ebc
SHA1 3a20fc7f824c25f7c92419e4c58800de8357b10c
SHA512 ad29febad8f20504b459cfea83e42096064158bd24ab05fec3c6dc495357f974b92fffb5fe6a98cf9b7c59c29a5bbe8e465bab38de7fcd664848ad1e126b53bc
SSDEEP 12288:EpFtIO2DWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:fOoWWquSCHOqk5qWKWMS+I762fiop
TLSH
T11D55022A36EC10D5E479623D9946524DC3727CA21B6263DF03A0917E1F73FF86C3AA61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bc1aed65ba3a47652e9e29b9f9abd8f49a36c0d5175c42f2e532c8e1542ad904
MD5 5d92d84b1ba5aef79abcbaa914643073
SHA1 0f581d978faa2cd852e372c4262d9f4cf648b31a
SHA512 3bf10503e8501de1c05db9b637c99305d512b5566e171891c5ca2c0623568e37f9cda68d1a6766985f93c4325c46ce74860d452d62ffd92779d44d0159d6aa6d
SSDEEP 24576:F7NM9YmZqmWMUkPjZM48Mv6bEhs1WWquSCHOqk5qWKWMS+I762fiop:F7cBWMpPjN8DbEhuqHCHOqFWMSxfBp
TLSH
T10A659E2E6BEC81D5D476D13DC9928206F6B2B4611B318ACF1262833E7F37AE45E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9bf471001668b22970a6e61b099ce22044eb3ce14866e7e44401f2ba32b6b8b0
MD5 a622a92a10fcef3659f7e6c1e0dea8a1
SHA1 1bfdbfb55425d65869e41f2a32f2938422d30ad3
SHA512 306858b7be90ce07c7a6f99fab8349f961fb3f9a398dea329eb8fa76306c765100d298070c2e06114c73a4709aede7332ae46ddcdf29bcb9d36a740f1d5722fb
SSDEEP 49152:AF2YuHNETovcvNYf8kmRqHCHOqFWMSxfBp:V6tCf8kVCHngbr
TLSH
T112857E2927ED80A4E0BBD27D45B79246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 76967bbd8a74af2495c715365dd04f2f5e2c1770cac227c8c6346f336fd5a11c
MD5 d650067eb53ebff88eab116e25d1826f
SHA1 dddb2bfaabd7c3ad18e2d5ceea3d9bc34813fdd0
SHA512 49b909e10774e0ead1c69675fa37e94aa705957fd6b9088433d21a674c51edc7203c39067fb406b30feb5f0e970d3a40f2afe50a5fe77e7d74544b6767a4df7d
SSDEEP 24576:KAFs06+OmlfkNXEbTosWWquSCHOqk5qWKWMS+I762fiop:TFs060lwXuHqHCHOqFWMSxfBp
TLSH
T12D65AF2F66EC00D5D07ED17D8997C91AF6B1746307256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 800cfd1f7166d72fe68f4633a6aae884fe770e8c0ab1c44f00a16f431d2321c5
MD5 94581cf9ebfa8fa0af468f594608671e
SHA1 99e71ff226d01ed5572c2416cc06cb201d754ffa
SHA512 5e49a8c0c0c80306b7770027f8255e0fe4351fce168f95155435b74755b974b20ab81cbf645e2fbdfdf1f6ac14cfbb720e3956e1e7326f3bfdeb7e16cbbcf813
SSDEEP 24576:NJnJ5D3WtTWWquSCHOqk5qWKWMS+I762fiop:NJnJ5DGtHqHCHOqFWMSxfBp
TLSH
T19475D02DD2A810E4E4B7C274815A1796FF72387D2F226ACB2474D5353F22EE06979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 470a75f71c0042b128dc2065b37072ee578f25a02e1c1c4a586aea3244dbf26e
MD5 89db83990791970ac317b80ba0a362cc
SHA1 a3436928210080e47b6f6c5baf924f73fb1a9457
SHA512 35629041a9eb44ba0fe5391f0b43e54580458b6f8a8788bde2e2f04e30d571e641f1baf09d5417bc573d30dbefe72ebd91601bf3f0a5d6a341acf4849667ec78
SSDEEP 49152:Io06DIKdwc+eQnSt65aVNqHCHOqFWMSxfBp:V8CHngbr
TLSH
T1C9956C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 8f09a2e805ea248d240f4aa64177b10a624635e72386b5104632b8c6ceb4007e
MD5 3bb1da99020d7da4566db98270e1e89a
SHA1 b07b94dbfd1dea343961dcdbeb43565fc319241d
SHA512 ac0f75f82d448e473cf9beb4198f8062c6f3fb087e86447e1f8d98b396d95c2be780047928231e84da928e554ca597f260beae8a5aa857dc2ee552910638f034
SSDEEP 12288:BEP3RrjDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:yrnWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1B155126D66AC60D6E47A617D94454645C3B3F8B02B9337EF42A1D23D4E33AF52E3CA20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 0f1ff287396776cfae941b3fbadc2c6847eb30670eb9c8e536625b71b8aa3073
MD5 f5975af4aedce3a843014010c9188e6f
SHA1 7ec26d27d66d1a3d62540dda34ca724590cb14f1
SHA512 f28ccfece1d5de8629401c725a64acbdbcbfc773e1a9242fdc950a173ae571283e0bc56d8a5ca466eedc0a819dc2397abb807dd5e9af247ed434c91b05be9c84
SSDEEP 12288:4jkyADWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:4IymWWquSCHOqk5qWKWMS+I762fiop
TLSH
T13E651204639C5085E9B9163CE81751E5CA727CB06F6263DF92A0F33E6E32BE06D34B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 f713c656ee20f9dcf5c934e3c7ba823bd220455d2611cdec88d98de07188ea5b
MD5 66a42d9377e0aa237e01a831363872d7
SHA1 e9bbae4a8f3446871340f0fcd67054db1dba5bd6
SHA512 94c0017b9d1abf39c7a65bb800f5348d7f599a37e29dbf247b49e33d39b3896adfe3333602ed38e1d88952bfbd514bb5e9310296226277f90a118790f2d9a224
SSDEEP 12288:nFmDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:FYWWquSCHOqk5qWKWMS+I762fiop
TLSH
T19B55231964AC2046FCB916BDA80D2AA5C1733FF07BD732EF52B4F23564315E136B9928
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b84edec4048396606c487f6e43833a1e8ab5c6260c58bea2c3b26ba002ad0871
MD5 33f515e0d8165a8e2d923767567a0b18
SHA1 d0c99660a8ff92d088a3cc9bde9b4b6f9a05c002
SHA512 4829b1ed486dbd055b75d1fc249e79abf63cbef79d0e994dda42bca374ef91244e5768db64dc8641fc192c2b84dc365a9fd4825efa176b407bf2a4e1913f5307
SSDEEP 24576:oQ9MxZKdcz97w39WWquSCHOqk5qWKWMS+I762fiop:oVKXpqHCHOqFWMSxfBp
TLSH
T141558C2DABE9058AE177D27994A250C3A673B4301B35D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 9afe40ca0a40df4754bd9c4b748b4e8f66ba0d139d7d5d9fd87ce7f5fb332daa
MD5 0f2927bfd695e07af3e32db0c008dee5
SHA1 2cdae5cc9ce697c8f5b8c954bbe872c60029e6ae
SHA512 e59b08e2ba305a2f3221c235db6e8273f372c69f9523a09bc9173a5f683d2842040965f4a57da8aaf8d6f9c5130583fd6c2c6e1291f8117e46901732954cd4a1
SSDEEP 24576:PyocxApqWWquSCHOqk5qWKWMS+I762fiop:KocxApSqHCHOqFWMSxfBp
TLSH
T17A65E01FBBAD40A2E176923C88858745E773B4705BA263CB5691C33D4E33AE97D38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a85a0ee19c0cfc6bcd6b0e8b07effb0822ad7cc26ba563f7ee28ccb08cd6660c
MD5 b70ca8b2df539f3a84cdf19173c2af2c
SHA1 7d8f47b7e005f90add5be4d7c24a87b8104d719e
SHA512 42e5f5fb931f3a6664f844ea6f813944c5943969d2707d6e8c731d5208aca8d8c5ba805c16fc9d8feb730211609e229209689bf2aa76e5eb882b3e94568ed6ef
SSDEEP 49152:hWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKSqHCHOqFWMSxfBp:Z0zuNIPCHngbr
TLSH
T1AEA57C3DA2BC00A9D8AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1e9ff78820da579b627bba37c3f9e4035f4a4536478ab5746828a8264689aae5
MD5 0c35f0f536c73fe3439fef04be0f3d23
SHA1 16dea649e9ed56947c6306bb8ab8db0370b8fcae
SHA512 63b95a7c97921a25cbdddcab03c644cc7bde2c94c40c260825081e0f70c33409eb44d1180612b4dfca8b8a762e9878792cc4a5151dc9c11e295a2886c3ca3970
SSDEEP 24576:A1QT7EcpfxR+N5AWAz3ooiYujMqbnWWquSCHOqk5qWKWMS+I762fiop:9TDxR+N5YzT4jM4qHCHOqFWMSxfBp
TLSH
T14B55B02EA7F815E9D1BE85799A23C512FA727861033193CF42A0C17E1E379D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 5285b1da15eaea066baeb298136ef7879e816cd54647fa10bce51bd12deb8db3
MD5 a934543da15c1fcf0269e10f9fdca9c3
SHA1 c89c51f04ecb5f417b3404681cb3885eb1700596
SHA512 b45f90cd61243b4637946b0016c6c04c796022cf825936a21f8a69a57215ed8b6436e2fd56926a2acb8edd8ef8294a4eb99363eb84746195d1ea23a4fc851d12
SSDEEP 24576:3TMdOz0FFS+bmSLbWWquSCHOqk5qWKWMS+I762fiop:F0K+bmSLfqHCHOqFWMSxfBp
TLSH
T10375E13EA3AD14E5E47AC27DD9438906E67338A1032276DB06A0C1793F67EE4397DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 faa491b9ef55e7c35aa8dc19549deb33586030d24c35006135b4bdf593c879e5
MD5 eb20d3a18776a34abe01815b61f66406
SHA1 600b6adef0edaef11dcd37d1b037cda58bfc894a
SHA512 0f6396c1cd82703478e028daf5abb6f4cda33ae9a7218bb81afacad542cf0f90e847006f7bc7db95842cb97365ac9b547ca9838d2830843caa955fab5fe1e875
SSDEEP 12288:i476DWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:BEWWquSCHOqk5qWKWMS+I762fiop
TLSH
T17855121D63EC30C1F8B52279D91A1155C2727CB127A676FF22E0E67E5F32AE05938B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-36-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/8-437-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/8-43-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/8-438-0x00007FFE612F0000-0x00007FFE614E5000-memory.dmp

Download

memory/724-412-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/724-155-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/724-493-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/724-161-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1560-578-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1560-435-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1560-256-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1604-414-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1604-176-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1604-182-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1684-220-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1684-226-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1684-417-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2524-436-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2524-579-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2524-267-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2524-261-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2524-294-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/2524-313-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/2524-278-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/2524-472-0x000000000D150000-0x000000000D158000-memory.dmp

Download

memory/2664-193-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2664-187-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2664-415-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2724-102-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2724-108-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2724-439-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/3320-55-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3320-49-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3320-98-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3320-100-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3556-203-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3556-416-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/3556-197-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3688-129-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/3688-123-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/3688-409-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3832-166-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3832-413-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3832-172-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4068-411-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4068-151-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4068-145-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4076-22-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4076-574-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4076-14-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4076-23-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4200-434-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4200-246-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4352-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4352-65-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4352-59-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4376-236-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4376-422-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4376-230-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4732-136-0x0000000000670000-0x00000000006D6000-memory.dmp

Download

memory/4732-141-0x0000000000670000-0x00000000006D6000-memory.dmp

Download

memory/4732-410-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4744-89-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4744-97-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4744-95-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4744-83-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4760-113-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4760-119-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4760-440-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4764-408-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4764-75-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4764-69-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5004-28-0x00007FFE21370000-0x00007FFE21380000-memory.dmp

Download

memory/5004-46-0x00007FFE1EAA0000-0x00007FFE1EAB0000-memory.dmp

Download

memory/5004-7-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5004-610-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/5004-78-0x00007FFE612F0000-0x00007FFE614E5000-memory.dmp

Download

memory/5004-611-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5004-1-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5004-0-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/5004-27-0x00007FFE21370000-0x00007FFE21380000-memory.dmp

Download

memory/5004-575-0x00007FFE612F0000-0x00007FFE614E5000-memory.dmp

Download

memory/5004-614-0x00007FFE612F0000-0x00007FFE614E5000-memory.dmp

Download

memory/5004-12-0x00007FFE1F0A0000-0x00007FFE1F0B0000-memory.dmp

Download

memory/5004-474-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/5004-30-0x00007FFE6138D000-0x00007FFE6138E000-memory.dmp

Download

memory/5004-42-0x00007FFE612F0000-0x00007FFE614E5000-memory.dmp

Download

memory/5004-79-0x00007FFE612F0000-0x00007FFE614E5000-memory.dmp

Download

memory/5004-35-0x00007FFE612F0000-0x00007FFE614E5000-memory.dmp

Download

memory/5004-47-0x00007FFE612F0000-0x00007FFE614E5000-memory.dmp

Download

memory/5004-33-0x00007FFE612F0000-0x00007FFE614E5000-memory.dmp

Download

memory/5004-29-0x00007FFE21370000-0x00007FFE21380000-memory.dmp

Download

memory/5004-31-0x00007FFE21370000-0x00007FFE21380000-memory.dmp

Download

memory/5004-32-0x00007FFE21370000-0x00007FFE21380000-memory.dmp

Download

memory/5040-207-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5040-213-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5040-216-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5040-218-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/6008-475-0x0000022876180000-0x0000022876190000-memory.dmp

Download

memory/6008-478-0x0000022876180000-0x0000022876190000-memory.dmp

Download

memory/6008-480-0x0000022876180000-0x0000022876190000-memory.dmp

Download

memory/6008-479-0x0000022876180000-0x0000022876190000-memory.dmp

Download

memory/6008-476-0x0000022876180000-0x0000022876190000-memory.dmp

Download

memory/6008-481-0x0000022876180000-0x0000022876190000-memory.dmp

Download

memory/6008-477-0x0000022876180000-0x0000022876190000-memory.dmp

Download