4268835e36c1a69ce1c2952f6a57012354379a4a7cf3203687af6b20287970c5

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Size 8.3MB
Sample260522-3atcdaaw8x
SHA256 4268835e36c1a69ce1c2952f6a57012354379a4a7cf3203687af6b20287970c5
MD5 507767560bb9a0c0eb251fe612315565
SHA1 c75ea8d6ac811366b5bae0f054f79a50b3876fba
SHA512 ddbe54c8f8405dcdb3430f058042836d92fc4ce28d4d6cddec20770b1e1e59b6916d7612643d6931f7908b4bb0dbb67ac206ea91565d00e4cec54a6689db70cc
SSDEEP 98304:fYOrRn+os45gaHrh/w3D7nTsReRR9KCHngbr:91/w4ReRR9L
TLSH
T1FB96394677F455E5E1B7C2B489B696B1FAB2B8951C34E70F1061821F2F33AB09D2D322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1448	alg.exe
3856	DiagnosticsHub.StandardCollector.Service.exe
2788	fxssvc.exe
3536	elevation_service.exe
2584	elevation_service.exe
2616	maintenanceservice.exe
3960	msdtc.exe
5368	OSE.EXE
3876	PerceptionSimulationService.exe
5068	perfhost.exe
4024	locator.exe
232	SensorDataService.exe
1632	snmptrap.exe
1240	spectrum.exe
4780	ssh-agent.exe
5084	TieringEngineService.exe
752	AgentService.exe
1352	vds.exe
2300	vssvc.exe
3968	wbengine.exe
2432	WmiApSrv.exe
3248	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\781e2043ccebd5c8.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164703\java.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffa2de6d41eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026c9e56d41eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0e25d6d41eadc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fdbf86d41eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
3856	DiagnosticsHub.StandardCollector.Service.exe
3856	DiagnosticsHub.StandardCollector.Service.exe
3856	DiagnosticsHub.StandardCollector.Service.exe
3856	DiagnosticsHub.StandardCollector.Service.exe
3856	DiagnosticsHub.StandardCollector.Service.exe
3856	DiagnosticsHub.StandardCollector.Service.exe
3856	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeAuditPrivilege	4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeAuditPrivilege	2788	fxssvc.exe
Token: SeRestorePrivilege	5084	TieringEngineService.exe
Token: SeManageVolumePrivilege	5084	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	752	AgentService.exe
Token: SeBackupPrivilege	2300	vssvc.exe
Token: SeRestorePrivilege	2300	vssvc.exe
Token: SeAuditPrivilege	2300	vssvc.exe
Token: SeBackupPrivilege	3968	wbengine.exe
Token: SeRestorePrivilege	3968	wbengine.exe
Token: SeSecurityPrivilege	3968	wbengine.exe
Token: 33	3248	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3248	SearchIndexer.exe
Token: SeDebugPrivilege	4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeDebugPrivilege	4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeDebugPrivilege	4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeDebugPrivilege	4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeDebugPrivilege	4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
Token: SeDebugPrivilege	1448	alg.exe
Token: SeDebugPrivilege	1448	alg.exe
Token: SeDebugPrivilege	1448	alg.exe
Token: SeDebugPrivilege	3856	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
4188	2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 2128	3248	SearchIndexer.exe	106
PID 3248 wrote to memory of 4772	3248	SearchIndexer.exe	107
PID 3248 wrote to memory of 4860	3248	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_507767560bb9a0c0eb251fe612315565_glassworm_mespinoza.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4188

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1676

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2584

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3960

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5368

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3876

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5068

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4024

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:232

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1632

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1240

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1076

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1352

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2300

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2432

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2128
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2912 2900 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4772
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2916 2752 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 469ad25429fa356d9d2a20796289846b49dce6dba6f5d43a6f7d1793109cad39
MD5 8c71f6e1ec9009556ce50a14a47be9c3
SHA1 5164b196d7c998de9d658b9832c0a0001cefe3cd
SHA512 95c947e189e04fb2f3951cc8323b58f9709b20019a22e788b9cb219409cd70c98205f2e5628963726cb3c3581f5fa026e2ab81ae988b0a03fb91b344c788bf68
SSDEEP 49152:wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnRqHCHOqFWMSxfBp:a3q6sjB5CHngbr
TLSH
T14CD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 85de883652132ff7a0275c1a8d85ef6001094bf0114b5d90866a1c3520031389
MD5 b0d5c5c0bef66311bf0148f4ad94e97d
SHA1 5e805f2ebc5525ebb640410d4ba4c94bb1879813
SHA512 7e82960e8c9580e8fde8c2c35ac1defa284c62e0da6fdc65cb4df6e1449208c5ce5795434ccede9f890cd2ea55966364298978157794cd92ec8363c4df5f02bc
SSDEEP 24576:mXYfDtczAwWWquSCHOqk5qWKWMS+I762fiop:Ftc/qHCHOqFWMSxfBp
TLSH
T1C975F12877E408F9EC6B427DC8628512D6737C9147A4F78F03B49A651E332D85E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6a4bd174630ab5e718487255f4dc70ec8d6450defbc093236b64e435127a8e5d
MD5 8b7236b6a27ed89f925671ee96c1bc09
SHA1 6cb51fc38c91f8985bf792587ea54a12b026b886
SHA512 d0929a647c7f1188840f4f8389cbb909e7d0d44012f9bc1a019e68021235c5528fe28b92c1a8c0fd8c64425719a7374ed8502dcbfd438b0242391a579f6860d0
SSDEEP 24576:A0Le5ji0hmxxrMNWWquSCHOqk5qWKWMS+I762fiop:APji0AjKqHCHOqFWMSxfBp
TLSH
T157859E16F5748331D073C0B9C5D2A69EE97230825B308ACB4296D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 52ce3e7dd8afcf5a8949cffa82fb0a43191e55c15de427c949f6acb6679dce2a
MD5 7cff24029ce50f83182c07cd9964e94e
SHA1 269742a50c45f3d03d49620d2854792a18e6c9e1
SHA512 ff3649fa186ebda7e405325d8f4c18f35ce83203d4a92fa6db7f08fc7b54f866c422dd25501afb822df4ec30de0c61bb57b9f3d0dcac567a07bb05bfa7d487a9
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWn6q8wyuLWWquSCHOqk5qWKWMS+I762fiop:3/ezSC6vUzPveHjy2qHCHOqFWMSxfBp
TLSH
T1FF756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 80a7e2c68384acf5bd316cc85c7a851683da9153c3d211882ff473d3b8193926
MD5 537021f148dceaa0282eaaf23149da7f
SHA1 3908b9b231633a0cba11c8915118faac6df56eca
SHA512 01cd1d754f3eb1ef62fe0a3ec075cd06761954d4ee9c2fbad178bd5ce1c8ba2363be169c85a59731e7be6bc1a74f886abbfdbc83796062b9672265a169b6ceeb
SSDEEP 24576:0VbqPb88hv/l+YUWWquSCHOqk5qWKWMS+I762fiop:0VO88hXl+nqHCHOqFWMSxfBp
TLSH
T156559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1096e40855445a4aa4c4981ad5776cab3f6a5897ac0e78178c40de33c7a4aa75
MD5 583ac017bec02235fa30c3f7c79b4e98
SHA1 39b0dd906039258f11030dc438d2012cbe111231
SHA512 6d1999cfffaf69cb30b8949bd21a12850e2f03fbd1af023d074d470d5946aca92a457c08a3dda86ff7d40c3f9ea1eec7c8da285e1cabd935c6eaaecfc5978f5a
SSDEEP 12288:oL+SDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:oLhWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1A9552316959C1042FEFD1A7EB80D39E6C2733FE06ADBB64E8375B74920305B17699138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e639b1cf68dea40b5e214806a850097031a969ed945db325f091597f2a1cbc4e
MD5 0339b130524bed3da898eebf9c1c5194
SHA1 2450abbda949ccd7ffdb9f71e6bc2afa4ada0457
SHA512 de19db9d5067632c65846a4a35ef9b51ac09ab4fefe44f36b64249f66d84352fab1d6132001821d5bb838237153c7bbc6274eee2c1c9e3159e8741640fa4ffc7
SSDEEP 12288:teBNUbTVO86UXSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQo+:tJIUsWWquSCHOqk5qWKWMS+I762fiop
TLSH
T18C75CF3BEE28FCD2C67E4DB95A518640D77278704B62A3CBD175830E9E235E01E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1ad8d51e2154464d836be25aab5e0a947370ca56669ca37e963c0b2589f0d8e2
MD5 f56b4c956152490f2d72d475a245cb27
SHA1 6d05a12d767951a4925171318e995f3e9705f416
SHA512 68226e8ab0be656bb8d8b73922bedb7516e5822b6362dc8f9271b50fd845494440660e234714cfec7e4f2a326afebd04ee46604055477ae4fe3f09f379d99e34
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THx:NQvGAdlCEL8c/DRNw5CQCHngbr
TLSH
T114266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 c4a94820595b91e80752e431d4c101678082e543439f00336803e998f7d16471
MD5 a89485d58301575182c24028582c5e7a
SHA1 979384baabe0d68a962959b702e5efbe43309c1d
SHA512 aaf6b0a7681e509939eaecb1b8d1c8ea551132b947cc66a257591fcd4b6092f491de5115a2a7ae7dafc6b90005a9e791b592215fdeade3f9f79debb84253ca1e
SSDEEP 24576:m0ewsAjiWWquSCHOqk5qWKWMS+I762fiop:3lj6qHCHOqFWMSxfBp
TLSH
T16D75E031FE74D032C6BF0DB61B25D716543D7A604B922AC3E3B89E9D59302D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 98cb1b7bc7040c46fe162b1ef5702ec9230722b5f4cccb8e5c87170ab28a5e0f
MD5 f2171e4efe0fbb466e14d928c8e58db1
SHA1 c71eaec8ef3583164fde6c170b0298a1abf12154
SHA512 c1e1fabcaf47c38dfefcea64dfaf4c19bc9839df36062910c24b479428927c67df41d8cb9bcb8f0eb571a83e021b06672f3732099629d22f69b62dad251c45a3
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH2:sUEtQevvqc2W1cpV2tI32
TLSH
T108474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 68c12914bfc0d0a91155fa804b509ac96ab2e537e0d81c447173e09cb21faca8
MD5 e2a7f874331f0b3a55d6d7832889ba6c
SHA1 17279c0de43f2cf04e68f0621bffd337e5c790e6
SHA512 8e1f4e4d4e41949732b715cbf027b75011d011f90ad86f8a487f1e021421a9730754264bb7301d1d51f7185741aa6ad627b075e185473ff96fb5ed9e59fef1e0
SSDEEP 49152:uCbRquA/m2yL5zifFiV+XenmE3/zaqHCHOqFWMSxfBp:DoqHVjnmECHngbr
TLSH
T13AD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 218569ab20583fb5680adacd3b69153a2596a451a43693f952631694a7cae29f
MD5 1299633335b1d29055264c89d2dfa857
SHA1 3fb688cc7c0c20bb2bf09a189743aba6f6534868
SHA512 7989efcf6bb5aaa034165c13c87218560cf17899a9a6b7618a6d757af2c5d6ff168aab02cd9c60324a197860a5bc729540c2b3ddc3e6767459dcb1c76d1a1081
SSDEEP 24576:5AhGL3IFoiwtA5l7S53nWWquSCHOqk5qWKWMS+I762fiop:5AMUFoiq5rqHCHOqFWMSxfBp
TLSH
T166359D81E7F945D4F5B3AAB899B69171EA72BCA65E31D20F2160D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2b8f6be1ae85693004c84e945a178f3aed848e030e73fc9ffea9af3814bace1c
MD5 9494312cf6b41f980981d456f45db7e6
SHA1 900ccf6b008b9436ccf303f0ee282e593988c1a5
SHA512 02b7ca6423b7b88901d3ac0f1559401dac44ce62fcb0a95a4605c50281a3ca070a31a6d0ae910780a6e56b1c241e57021682e5d8b189fec540bcfa6967467cd0
SSDEEP 24576:7wu4OWuWWquSCHOqk5qWKWMS+I762fiop:7wvO3qHCHOqFWMSxfBp
TLSH
T17465F14676A80CF9E9A74239C54B8136E7F3BC512A65DB1F0370C65B6F332616E2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2ae94eba6c00b6eef5e90c1865b02e362990c7a8f513d69282dd63347c49275f
MD5 a2016c9b3ae3cbfd46566012a170377d
SHA1 a4a743440bfeaff7ba5baf61f3054422982845d4
SHA512 7c7201307fecec108f2c8181ea4496f22a30d83d715acf3138c39cc037b1e78cc98a82a5e9efae5b7dda4d81331ce8c5cea2906d79e8444a9ba73d169ac90c22
SSDEEP 12288:teZ1IyRSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:IZulWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1B855125A32E820F6E5A7127DD8995A45C3733CE267B653CF027463692E33AD12E39331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5d6ef6da99e19a805c29a0db9422d8e9e04a28be754914b1ef430b31fbc86693
MD5 f87c341e2b0820d7e957137823de07e7
SHA1 bc598cf3f9ffadb6a6e140eab58e1d97b1ea78aa
SHA512 705d5143955e4948918aac26c333d7eb5564a9470c66f791c8080d7272e2d0c3d78a332a9eb281483d68ff6958b923063aa7aba58bb5c96ce42b1a6e32cdd002
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:TQRQyi36YOcPbLvw2gAf+PN31CHngbr
TLSH
T1F2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f5d8616a837cdf70b6348969fa40870f8e209acf6ab4d066d783771353ed77cb
MD5 4eab1bce7a13a8ec653211b378524612
SHA1 c41374e7868d4b69f5885a581b41d0574d83bc76
SHA512 c9167962ccc8e262000d3aa621c2aaf8e754ccdff0abaa18c86f1f804e94339d0310909ef7be7a20aacdc50d6f9f92605ddb839d5588a696e909d0f39b236b91
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:LQRQyi36YOcPbLvw2gAf+PN31CHngbr
TLSH
T189667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9195e311b81e8879fefad85142f17a009128e5fd5a7865f9c72a88c38a0ebdbf
MD5 2cd14818295859ab9ab1f3a2c8b1bf0a
SHA1 789076005b7dfa0b1aed43f06186ba5d99ee2ea0
SHA512 df3852ac1f36506c8878735d6c9945ed96b5ee9409f6b3a152c1e46c95d4ff4f53886c3661e2ed64544e16b35ba7a57ee6aec0a45fe04565b08c3168ff2e3b97
SSDEEP 49152:x68Qg55nhceWu7PNU3/KqHCHOqFWMSxfBp:vthLRc/bCHngbr
TLSH
T1EBB55A33B2F60099C44DE1769F4A973196D27C718FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b99c0df816550207d356278d8b87ce0c9c60e9d363c1f2be72f9d7452eee29b2
MD5 1c2f10300d06f93bc9a75cc20997c4c1
SHA1 16498d582a4af35f7b2565088f16028de4f758a7
SHA512 abe8c235702f974e4b2872299bed929a3dbac207f872c742fa0913034897a02b8bb717e8d280d3513b3af3e044befa63f99af86eaab374ae8eee8b4f90dddbca
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99f:ty5112gYy5azzVvt69nLKnhZaCHngbr
TLSH
T16F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9e2fb70ae483fe3da12995d5f7c91c8282ae876537cb5931fb653117cd23fc88
MD5 82ef31aea69d580c410faba27a7c4fc3
SHA1 99a2d13b473efd774a7ecfb5b6e04303459af2f4
SHA512 7001cfa623b8ce55d0fd8a3e40066e8eb36d02ae8fd6c3b1a7cc7becb3f07b4ba2c8a265cc76fc902fd5cffb0a7eda722addebf60dfb8ebd6f9cf2b1f2ded2ba
SSDEEP 49152:kB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glAqHCHOqFWMSxfBp:+u6Jmdxd2dNCHngbr
TLSH
T197D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8bdab2dffa51b953a476ace1dc256ed7fe1edd3cd2b27bbd3d5d84d5b187a344
MD5 bd26c0e01b0477ec502e6b97245466e5
SHA1 4c245a6acc24389458ce0f2d67b7f2fc4d25f712
SHA512 fc418a047bc977a912e944bd4a6a09a37d5bca40b68cfbe9a96b7cdc724bd4b2db49f81be060cf3ff61259bbe7eec1fbdc2672a738eac6173e91cf75f5a792e5
SSDEEP 49152:E1hpsNoJpF1A63U44CwH7R4xMqHCHOqFWMSxfBp:EmifPWRECHngbr
TLSH
T132B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e8b82bfd02c613400e554dd59bf222ec48dfbd3fe2748437a72b40c1da2944b8
MD5 0422de41347d4465d1317abcc95edbf0
SHA1 3183455d9e6b817b14fb253898d7af6384176cc8
SHA512 dbcf0f4cc87333b63652df6cc56ca32fa74fcc87a248ed047abe8f35fb6fc5a57c6b9b04932081c8596dc564d2f3b66da793c04564fbe5c2d2ffbc791aec0546
SSDEEP 49152:ASuZQIY0Be2KcRVtOnks6NMHqBqHCHOqFWMSxfBp:a5dKii61mCHngbr
TLSH
T13AC5BF13F2E940E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fc3b432103ed5484206c873b5a23b914ad104d90a3e964cb7feb9144d2ed87c5
MD5 f0c61ea61c37e0a679f2c6a333d563f1
SHA1 54586cd7b155d2d12cb01314e94942d25d9a0aea
SHA512 4412bddcecb50927c5fac1c09f77b70f6517e88db5e1df58e877d8325d44a5094be2f81401701d64910d2c513652cc143eafe51dfbbe7cb140f345a577530165
SSDEEP 49152:hhtSn8EApI0fig3giDn0AP5wwqHCHOqFWMSxfBp:wX2imphYCHngbr
TLSH
T18995BE13F2D900E8D06ED178C7468632EA62BC550B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4e2301b23a73ea0b32d45d78547d16783613a394c72e8caeb0acbaa4d3f3b350
MD5 751e65d72342b35edfd3596fe7d2370b
SHA1 775acceb03358e7b10d06829d3f1a981c2c8753e
SHA512 fcb0bea2f91756c3e6a5beff13cd1200b56bf88d094bcb3a11b6f164f2c27a305efa87b256618c90aa56b073f5e1d1ccacddc1e24be6906fe8a5d1364aca08b5
SSDEEP 12288:JmSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:JZWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1A1552316A8AC0443FDA816BEE80D35EAC1733FE1BBDB724E9379B21560315B1369913C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 510a1097d42f783fbc4c6195c22f3a5f1c2fd221beaaab5057c695f5e5c53043
MD5 ff91ce432b4e2df03536be48eb2156d7
SHA1 28cf32c9365a064699c7b5c4a6460ee81a9ada67
SHA512 83ae42f39e961354133a475210a53d7c58ca68f933e2f7d940fa40fb67c42c544444ca2d2e8fc6fe80d97e2aaab5b0200873684e5f7d6d4d687621dd7a1b027f
SSDEEP 12288:d1SDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:d2WWquSCHOqk5qWKWMS+I762fiop
TLSH
T145552316A8AC0443FDA816BEE80D25E9C1733FE2BBDB724E9379B21570315B1369953C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f4e9f2d8a63492c7689c156c5d7faf805c9efb80f4b0a3e7cec7aa4e12c6e513
MD5 3edd7f18c1effd44e68691602ef7b512
SHA1 54e5d198cba8552669754e346adfe5bdfe9057ae
SHA512 323ec8424c792dbbe4943bd4338dd42f19a7587b1a483cea215ae06f878a04774f74735bd7715a7dd450779360e6fecfc27733d6f02460edde94d3a637a70a85
SSDEEP 12288:M/SDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:MEWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1AA552316A8AC0443FCA816BEE80D25E9C1733FE1BBDB728E9379B21570315B1369917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 e3922a23b1ac4e006f501de5125c69c73c035c146e8f34ace7ccb2b6e9b7e3dd
MD5 16fbcd86381ee6a0a5b1d2dd21c00658
SHA1 50be51336a2fd3648809e19cf5bdf9d1df2b42d3
SHA512 990e85eea2864e92b620cbca015f9fafd174ad60086e42a0a9b31a7c8c4a246f6d387fbbb23ac4a92f6f7ed13c2846c885ecc5bc8069ff13f8b6a82da496ace5
SSDEEP 12288:6VYSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:2WWquSCHOqk5qWKWMS+I762fiop
TLSH
T10E55231665AC00C2FCB9577DD80A25A5C2B37EE1BBF7739F8320764918317A03A79638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 44071a251b6329948b83b70d80fe7239297e92db3781bfb6455dd1d2fc872509
MD5 7b86604f3102107cc4d0da6193593f8f
SHA1 1ce7e390670e8928930a4750b3edc782aba996fb
SHA512 f881d2b6ec09f9791c5ec29223758ad5746eceacebb474ebbea6dac82ecdecee582ca66983ba9f01d20fb141dc7283f06e55dd15106526246446c50ed4a9d7c9
SSDEEP 12288:fQSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:fPWWquSCHOqk5qWKWMS+I762fiop
TLSH
T10B552316A8AC0443FCA816BEE80D25E9C1733FE1BBDB728E9379B21574315B1369917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1d26dbebc3be53d0c5cdd423a36d771c08ceb4396da56b34aa05635f0e783e02
MD5 9ca9159d121c9e718200436aa17cca3e
SHA1 e8873c4356b6117de640c255fb6e337ad810b846
SHA512 2de6a3a9364d3181b5c965fcc1a0117a0a434353ac29fc20ee0804ba1df9b34da974eebce374d56b4671744febdbafcdcaefcc99d619729bc33b4a2b25712786
SSDEEP 12288:0pSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:06WWquSCHOqk5qWKWMS+I762fiop
TLSH
T1C1552316A8AC0443FDA816BEE80D25EAC1733FE1BBDB724E9379B21570315B1369917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1b06710eb0cb7ffd5b0c2baa1fbf9ee416a80f0967f550e875a0c0c5af26b762
MD5 44fa4d56b6410db9d06cac89afb43b6b
SHA1 3569950eeec66667334f5f0d8390db99636a059b
SHA512 ddc1a76dc67fcad00d6baae9d3e4d2bd5233d938f3de98d3a712dbec74c92d0b4d178ecf6395dbbfdd8255c63b5d6c635f73e9f3c1a4362328f310018d260a23
SSDEEP 12288:etSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:eeWWquSCHOqk5qWKWMS+I762fiop
TLSH
T173552316A8AC0443FDA816BEE80D25E9C1733FE1BBEB724E9379B21570315B1369953C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 64b39a010267c67e3321ae1268a1527cd37ba836ba3f42aa6e4b7073ba809f09
MD5 11ae1e2d11cbdc542bac10fd12e9adee
SHA1 f21cb761dc69095369397200bd91f90ec79d8fc4
SHA512 bf3b05cc196dcef6e0405eda1d2d3d8c5513633038e3c52cdb280633c7e11cfdb70e2c26059865e4f027f5dfedf00bd46146ab8f8c58d00f26ee563aeee4576b
SSDEEP 24576:5ZMRzFVSOWWWquSCHOqk5qWKWMS+I762fiop:5ZMRzfyqHCHOqFWMSxfBp
TLSH
T13A750195B39418F5ECA7423EC8155916D2B37CAA1BB0C61F03B4362A5F333A11D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 00535b4e30594dfac7b8ed9d75877503972c59340f862679a1dc7d5607be44c7
MD5 9759eda33d4d9431658a60f40f93ff58
SHA1 802b0ade9c97501ce205bf6a918a134faf68d0d9
SHA512 d610be606e9bfeab111204294f28653bba9872c1ea3a0a95e9a1510ae1ab02e616e9d8b859c724cd1ec59d205a0899e754f90c760fe5379958b01a36d8ec0c0e
SSDEEP 12288:TySDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:T1WWquSCHOqk5qWKWMS+I762fiop
TLSH
T1C2552316A8AC0442FDB816BEF80D25E9C1733FE1BBDB728E9379B21570315B1269917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 257e23bf75737f6b3d1301a9f3fd2ff7fdd4ca00a42b10269c1d7a7bab679d8d
MD5 bdf4cc4f0a3f0b894ebc10240ed262e9
SHA1 29855e18f766f64e595ccf16ce74200cddf7b9be
SHA512 bbe025cdc4c19b20233e99ba51332fc42dae286ce884e21709ea0db517ec002c86c0c0c20d264ca9a3f3c7108213c8d558fded774ab752f81e0016c8d5e42073
SSDEEP 12288:PuSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:PxWWquSCHOqk5qWKWMS+I762fiop
TLSH
T1C3552316A8AC0442FDB816BEE80D25E9C5733FE1BBDB728E9379B21570315B1369913C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 6aa2e2603e10605ee90a39105511bf356759fcb321920a7a44e714b89f82a86f
MD5 5a8ef36755d4ff916a01de2c5a5ea206
SHA1 92ac762e191a8e17b80022f0d3b74b2f4ea745e9
SHA512 28d5894fb796e78bc7a2be94bd7faa5719dacf17b4ee2087005b6fa9435ba18400a34eacd49bc35475b898fd262251fd8007990f5c2e4baf8968c43fe67733e9
SSDEEP 12288:GyPz5L8RSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:7zyyWWquSCHOqk5qWKWMS+I762fiop
TLSH
T16265120772A430F9E4765239C8561A52E3737CB21B619BAF536453762E336E06E3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f2916012d85899155459d6612a27439aaa31a2c890ccd030e9fe1fc19539ade2
MD5 a88cd9ba1aa1af1a7ced26528c235728
SHA1 74934456cdda2881f92aee345faf568e1b6c5b74
SHA512 c4bf40be7d72dfd77207c0a1089acb92d24912c486e7a75d18218786cd9a6db723eca1519e175fe8bff98015dd2d0e3719763a2c83d28aac4941b5965e512509
SSDEEP 12288:bySDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:b1WWquSCHOqk5qWKWMS+I762fiop
TLSH
T10B552316A8AC0442FDB816BDE80D25E9C1733FE1BBDB728E9379B21570315B1269917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5ce1f0426af889acb88055a06b73c6726c2f6f30cdf60ec81c31a6e161e08c8f
MD5 fc5b9620575c3d2f9f0a879c74011939
SHA1 c1d76b8f7898af193207ac3dda878cdc8cc14837
SHA512 1ae04643d70653b58e7fcdb38ff2f44694621e3dac3634989b066e815f4b57e18c2447d88ba5b0740f95faa2df9b7275e8c077dc7ef173c2ed8ceb5ef860bb68
SSDEEP 12288:vySDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:v1WWquSCHOqk5qWKWMS+I762fiop
TLSH
T12B552316A8AC0442FDB816BEE80D25E9C1733FE1BBDB728E9379B20574315B1369917C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 79d84f6fbd2527a9ffa9e62d5749f7d1131798cba54d6a99cf3c4ae40ade801b
MD5 3acee70b51cc8cfdb623620986a62699
SHA1 c148e0de14b0cf42a9ecebf1eb8f8aa080b7f92e
SHA512 f0be031bb2fe34c0d906a225719c00247913ecee60024a763f5482afcbbd01ee33ad980928ed69ca6a4576bf2a5533ba7c60a5a6abf9954fbcae36a5159f53ed
SSDEEP 24576:RCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA4WWquSCHOqk5qWKWMS+I7623:RCUZPTY+8Wg2lIL8lrIUJLWwTqHCHOqK
TLSH
T17265AE1EA3EC0896D4BB813589518A16EB727C2A1B22D6CF1170C33D6F27EE55E39F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0028ec5d8bc5248aaa1af009afcab1310de2fccdeefb76d00eacc3efb7056ff9
MD5 4365aae3f48b673af54cbb1cb1462028
SHA1 bb61d71db7087f7e32fa3241112723566e1f43e6
SHA512 8402003ddd06ff89126ca34674cc1151fa6c53db3af87a009fe13b3d2fc2cc6c6a62cdd0e754b2315adf63d3ef2d6cc1d579d6a704b692241a78a4d306ba508c
SSDEEP 12288:YbsfCSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:/lWWquSCHOqk5qWKWMS+I762fiop
TLSH
T12865F01AD29801D9D4AE2279CB065A41F3333DA197E2E3CB53D0F53E1F366906DEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 24d5e26f5a23c714c843f8d978de8b2a0308a252d5f67675e094d5dab7de8692
MD5 b341f295b474b99430775ed791419e45
SHA1 0f782b0d32462798177a26336ff1aeba3a8dc6ef
SHA512 47ad385345dead50402538d232883a787d5f7a6497bfd3425131c325f61334d92fe941475f28f96c3cd89a91590aeba6d87d7a67ca0b2952bb48e839fc61b5f3
SSDEEP 12288:ifSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:ikWWquSCHOqk5qWKWMS+I762fiop
TLSH
T191552312959C5402FCFD27B9A80E6575C2273FE06FD6B1CFA325734960309E12EB9639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0bdc8363b571f9c8da8f1c1160b4cc8dcbd2f886d8d87db8da3095cb1857340a
MD5 12875e47450a7031c757d903b73b36ea
SHA1 a3fa7ff211f3332bce89cb53f3f6a7c5bfeea230
SHA512 8a5f882a431c1e6662cf44b1eb706954dce88f6f495e384fc587963ae8d1a01f1b02bc205288fbccd504252811fb7f7922d9eef793925524cbbce619446f8300
SSDEEP 49152:+RZwQCyiHiQEaiPnM5qHCHOqFWMSxfBp:U9xPP3CHngbr
TLSH
T18B85B01E62DC46A5E0BAD2B8CD674407E6B278165731A7CF0290C27D1F27EF45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 e9f401cc91b8b15b5e7062399b95588ae5f462cbd0433b78148ae38a27699edc
MD5 d5e5e0065eb712e5fef621ca73f0d0fb
SHA1 de23affbc20b5bd2dcd7c980da510b24b6af5261
SHA512 9fcef23b077bc615d5040fcfafc4f4df8c74af0570538b975df430c76e693bc0e4f64758529b0b09184de961b3b66dd379ae1ed9ee65b141a902ceb2184a1e93
SSDEEP 24576:HbxA1UG0WWquSCHOqk5qWKWMS+I762fiop:HbxA1U1qHCHOqFWMSxfBp
TLSH
T13955122E65AC14E1F4B9663D98864106C3337CA62762A3DF11A0D37E1E37EF02D39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d4951be846498c34bd9cab4a4c25c39c5bf899edd1a4477432244208f6f15756
MD5 f2e9b4a6a66fe528d54aa9f223be2eb0
SHA1 4e5858848c0d2a00c7a009021b8e1756634a9025
SHA512 20af6dfac5a6248bb02ad5f739a12a5e1494f2054d4f965d93ab7e24d1c4401f54c181f37667ea8f3222bb444430a3d42e91f7b81e02efadeca255395c1a9fe8
SSDEEP 24576:tjsmP0yHaqrVqHra44KDzMsrnXWWquSCHOqk5qWKWMS+I762fiop:tjRP0yHfVqzlAsrnrqHCHOqFWMSxfBp
TLSH
T1E945BF2EF2B910B9D8AAD136450507B5EB71782D1F219ACB0170C634AF0AEE85F39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 9f18bfd1063723c642c207fd2c0aae642bfafe61279d5a722c92b032b6520d82
MD5 774f1248c95239d3c18fb22fb0cec697
SHA1 33961e9f8435997970f96b68df80d0204c516054
SHA512 fc23c2e7902d688ba6de72bd8af87d2ac44060979f0b181dbfd75b25192ddf1da177a0a7720f00f05ce31234ee51688beb1e508355d5a712264b84a2b34ff129
SSDEEP 12288:MJSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:MaWWquSCHOqk5qWKWMS+I762fiop
TLSH
T159552315A49C1442FCB92BBDB80D25A5C2733FE16BEB73CF9275B21560315F22AB9138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 b8087ee652c12d584b369053fd5ed3dd51440bcf6eb24abfc157a821671c25fd
MD5 c283468dae559761b8c21d8c8fed1f14
SHA1 a48a0d8bd47e8e1fca653fc8216033626b5fae81
SHA512 a7a584e3e3745164678848d1a0edebd95be9efe1d56686569237f97173d08a3df1330a73f8b06920d50d668065937a58426e24429a59e7cacba9d75f5e44bbae
SSDEEP 24576:ibLBUTwWWquSCHOqk5qWKWMS+I762fiop:ibLBUsqHCHOqFWMSxfBp
TLSH
T143750115F7A400F9EC7B923CC8669A16D272789D1764E7DF03A84B651E237E24E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7352670a80ee8be7520f0a6e64cc2fb5e4c31e06dd71793edb866cb1da020ace
MD5 0dde2d316065ab6a10f86c873c000f4d
SHA1 0c0bf8c31f122a603a6dc2211a65c87e6a0c20af
SHA512 3f06a649d17aa709500834f60c893ac680e377639783692915917f7d7a3e3ca468e383f37a361ab748d04680054fedaeba5d232c999cba6bbb3896902be1c11a
SSDEEP 24576:opYNHTWWquSCHOqk5qWKWMS+I762fiop:opYtHqHCHOqFWMSxfBp
TLSH
T1F065F12F61AC08E5E57B617DC9878209E27378A61751A3CF01B0C27A1E23EE97D3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 60fd5f67a77c07bed80eb60ccddd0b5b8d5272fd92332df6d3390fc8886beb33
MD5 dc0c04e2b65f43abb410e00af9ecca56
SHA1 eb22bf95aeae9808ccad535f15ec918611a4f0b8
SHA512 ebb33c74b7f4a630e7ea441f262732c2335a61ee3d7ecf4abca9c10fc0fdc28c6249ac9794c1238fff1a6e878e3e38e9d24e094edc01bc185e14fd4440fb136f
SSDEEP 24576:rnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKD:rnXoJJYH84VVS6AmEOJas+cHBjSSKHPz
TLSH
T1D165BF6EA2BC04D8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF56E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f9404a32f94cbd30618924b05086dd1f408ac8f2cf8c4ce06ce35d47e2d03eb1
MD5 b818df4d83713d7778df08b78f452f9a
SHA1 0b9e5ae1283917eca013df2acd0c4f4dd46ff89c
SHA512 a4e2ef28e9ab7ac244b31d01e1f9d33c9e310401777b4eb29068e92685f05c5f7fa7ac658ae41277bb681de6a23c9073352d82bd636669e0a860366af0e38b8a
SSDEEP 24576:Yv7Xbxd9Tuycf8M/TYlSuxrr2PCBWWquSCHOqk5qWKWMS+I762fiop:YDLL9TuJ0M/TYj2PCqHCHOqFWMSxfBp
TLSH
T1DF858D1EA2EC42D4E4BBD6BD85A79047FAB2B895173091CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 77f229a5d9db243a16d1d5ef32dabd1566b3e51043d9ad3da2ea9b1340317c0a
MD5 fdb3b757b6599acc040965607b128e30
SHA1 0a6fa25ce1440061996bad0b3ebb1e04297ec8ce
SHA512 a3815ff31e203028be952f26b71a9ee316a08eb5a37c380ec7483e7d6c47a0c8a2f5dcc9004b2ef659b44c96ad7fe334fd3af7aa54b0453b42b8d896fc49e6c0
SSDEEP 24576:vegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wwWWquSCHOqk5qWKWMS+I762fiop:vngOJOmPOHzwqHCHOqFWMSxfBp
TLSH
T10355CF3FA7BC15D5E07EC17D89968916F6B1782213265ACF0160827E5F2BEF42E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 a1b4c4fc67c49988681b18983e4bbabe4b752d69a37c7c4d18b4fa8d33619009
MD5 8662e87f105d02232d50670cbae9446d
SHA1 69719ea087147814a1c6e78598705cb1a6044517
SHA512 cacdcbd80437c745f4b60eb1a5614ec61d9146df9bff7bfc7205ea155ed83b2a5643ca110c5a51ff936f9527f37af9e109dd25d416f76c9e23e5c9947b568522
SSDEEP 24576:FLJnJiTk3R3waE4JrO6WWquSCHOqk5qWKWMS+I762fiop:FLJnJK8R304l7qHCHOqFWMSxfBp
TLSH
T12875D02DD1A810E8E4B7C2B4815A1756FF32387C2B2669CB59B4D5313F12FE06A79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 47e88f434d63cf2792f0c6749737f818f64af6c9d4800ade9079134ea51f7e87
MD5 cfb6acaf7314b0e803e7525414816a63
SHA1 a9127614d927fd04de2b6364c81d4c9b0349d47c
SHA512 e978ea7eaa8ae1213f831855f06df7860cb225ffd619aff81753923b9d50bb35e14d6a2016a8540f6cd04f0b6ad296a7e35ddff2dad37e0ed26426e7772d68b5
SSDEEP 49152:o9mqCzDScAZmlvTcFg8Ph6mqHCHOqFWMSxfBp:6oCHngbr
TLSH
T1E6955C05F7EA5298E8B3CAF1C96694159B337C409B34F7DF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 aed49313051e88a61bd8a5838923480b4e77d82c1fef69a1858e22d0e0f2886b
MD5 21019e2c04b277b9815d9dc347402a64
SHA1 fa8eda3260d12014e7e29ec4ffd8e43a46c78a42
SHA512 36fcd59d753a92edf3a03295a03a3a9af2413994a11b9ab629f180f6e59bf1d65a045fc2726cd0ff9fa95c1b3f8e3a3c95f19dbba017c39eb3cd9674d9dcf117
SSDEEP 24576:vlYJeXm5jUuEAWWquSCHOqk5qWKWMS+I762fiop:vlYJeXmRUuEgqHCHOqFWMSxfBp
TLSH
T1F655125D75AC30E1E57E517ED8460A54C373B8F1279263EF42F0D27A4E32AE22E39A50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 993e3cd53e8e0578cdc96b9ca9c59efb2e38e3e18ea74e8061f1693ac70408c5
MD5 981044fec0e80ca4b77628b52fd0226d
SHA1 d96ab9c079c32f2ccb908c61b5e7e1642ea0592c
SHA512 1b684e5d848df1ceec51040cd5d5b0a3e005f0d242c6327316deecd722970b46536b86a3dabfb1fcd1f5a1db8e7c48a5501cb26888851643d11e602fa3c93027
SSDEEP 12288:Hmu6kyoSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:H7ty3WWquSCHOqk5qWKWMS+I762fiop
TLSH
T18565120562E85085F9B9167CE91741A4CB327DB06F62A3DF52A0F33E2D32BE07974B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 50a696883e4cd0587b4c5c68324384aac7abcd85b6be77a37a3d8fecbb4e4ef4
MD5 3f32ec736f2553fce0b9e3f3fe4fa0fc
SHA1 df86333f8ac4d42fc6d5cd1fbde32fc65d20a537
SHA512 a31ef5e9524518a44d4a8232905e8a805f0eb9b34619872b592f7a99da0f060518d601ab8be0e0da94d2c0f8306a83354d313111c3daefa50a879114c9e71ff2
SSDEEP 12288:bPbSDWpLtqIPuSCi0nOnqneUPo554GV4WKWbwKbWJI7Z02tFe9MQoW20:DwWWquSCHOqk5qWKWMS+I762fiop
TLSH
T13755231954AC2042FCB916BDA40E25A5C1733FF06BE772EF52B4F235A4315E136B9938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6e478dbc24a7c8389f07a5b34398bcd2ff5821f42f4a09cdb6fd31b3efbece96
MD5 30cb8b17152010126b65b91db45f1bce
SHA1 c273b9363ae6c14668d41dbec77c6e97512caf6d
SHA512 326547ef8438ad59146620a5a1d3d907d0bce2556245a9bb10d94af4ba518fc5b7c83a0d146849856b74eae92d99343a200fcd67224bf111f84409fb757962c7
SSDEEP 24576:fC+TyQIu93VAumZr7jmFWWquSCHOqk5qWKWMS+I762fiop:f/TfIq+YhqHCHOqFWMSxfBp
TLSH
T1AD558D1DA7E91DCAE276C675C8A34493E633B872137196CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 5967b590ff3ae3826c4923ccc83fdd5af2f91d2aacbddc86d33468168cc7e148
MD5 3d88456ccb64b445ef0f9e7ee37fe006
SHA1 3afdbc5914fec86c29ee7011191addbbabd9bae6
SHA512 ef0992254269ef0a72684e3e3138d3f067e7b037b9b2fbcf136c3bc215c53116bb6d4b1640a7800513335647e250bd15d3a02847de5c9df5e70b5ddaff448a8e
SSDEEP 24576:cLQikZcWWquSCHOqk5qWKWMS+I762fiop:yQik6qHCHOqFWMSxfBp
TLSH
T1CC65F10FB2AE0096E4BB823CC8494156F6B378B0575263DF42A0C7791B776EA7D38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 de1a3bf86e3b938e7b240375912298bc68abdb77055cf95c0f5e69ded71ca33e
MD5 66e3228b54ef66e5ab715361febd42b6
SHA1 9826262351f242d92ee8ef697fcb9e8c0f6576ce
SHA512 7ac79fea11f556974bbed4633b9ea407aa309846a8f4a9c08bf089efb78cdc107982ec516e8585c7da650fa537aebba7a5bba63afefafc5bd41ff7285bc75cd6
SSDEEP 49152:QpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPLqHCHOqFWp:BpC7b4+80GTkXCHngbr
TLSH
T176A57C3DE2F810ADD8AA8775C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dfd4bfeb3d1cb0e1450e0f58541c7f613137694b8693273050f47951d8b8df67
MD5 ae37d1d204c286cee635e81676251625
SHA1 751ba3f73829e9b8687f48bd588498b132328ed7
SHA512 5751bfc9b601bb60da6a5f1760fd67fa4842a43cd0775107b02081771b21127fb229754df2549dfa6cd2d572efcafa57fe979a30706f9ca8fa117624823e2e98
SSDEEP 24576:5SAwJPE1IDAo+4Kt+l4413JUQvWWquSCHOqk5qWKWMS+I762fiop:5qPCIo4Kol4vQzqHCHOqFWMSxfBp
TLSH
T12A55B02AA7F946E5E17ACBB4D663C511FB733822133163CF5290913E0E269E85E79F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 a83f0ded454fc4b4238212a83251352b602252da95371453c16473fd61341e90
MD5 45a5f740a0dbf962f785d25c01f6538c
SHA1 d619dd24462e1676e00e1023d183948c4c7f8317
SHA512 d5b7a269359edf27aba6a62668ed3e48ca4b108618f92fc386e6a01253f9ec1dd67c1d45b08ad2bc7fb096c0e56d69ed5878f62e1328d7908a5ebc8b47bee433
SSDEEP 24576:iyLXPLcw94t/WWquSCHOqk5qWKWMS+I762fiop:iy7PoXtjqHCHOqFWMSxfBp
TLSH
T17075E03EE66C04E5E47AC27CD6638906F6723CAD037166CB15A091792F2BFF46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 2c4c7f06fa218d610aa2d840a1187115cbe1b8bea7c424156b4dfcadf503e537
MD5 0a5fd1e80f0d9211dad3882f26eb65bf
SHA1 f70103e8a42e92680874e5eacb818587ce1ce209
SHA512 548508e011f680a09769b5315226ce71106c631dc04051e24128c71dc0ab8237e4cce142ac3b68256c2e2a3e496fc3245b852c8dbf0c7543c3c824f307415fdc
SSDEEP 24576:7Wv8qjpMWWquSCHOqk5qWKWMS+I762fiop:7Wv8bqHCHOqFWMSxfBp
TLSH
T1D465221E56E824C4F4790378E41A4165C1737DF227A6BAEF71D8E67A0B31AD0A53EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-169-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/232-556-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/232-163-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/232-194-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/752-238-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/752-228-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/752-234-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/752-236-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/752-240-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1240-184-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1240-396-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1240-196-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1240-190-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1352-251-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1352-486-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1352-242-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/1352-248-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/1448-14-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1448-20-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1448-24-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1448-129-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1632-174-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1632-180-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1632-195-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/2300-263-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2300-487-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2300-260-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2300-254-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2432-283-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2432-590-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/2432-277-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2432-285-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/2584-262-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2584-77-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2584-83-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2584-86-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2616-101-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2616-99-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2616-88-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2616-94-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2616-96-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2788-114-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2788-58-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2788-52-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2788-60-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2788-128-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3248-591-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3248-352-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3248-298-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3248-295-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3248-307-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3248-289-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3248-323-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3536-250-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3536-72-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3536-70-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3536-64-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3856-212-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/3856-49-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3856-48-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/3856-37-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3856-43-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3876-137-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3876-192-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3876-131-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3960-103-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3960-126-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3960-109-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3968-266-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3968-589-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3968-273-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3968-272-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4024-159-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4024-193-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/4024-153-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4188-45-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/4188-629-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/4188-36-0x00007FFC8DD90000-0x00007FFC8DDA0000-memory.dmp

Download

memory/4188-46-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/4188-33-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/4188-34-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/4188-32-0x00007FFC8DD90000-0x00007FFC8DDA0000-memory.dmp

Download

memory/4188-29-0x00007FFCCDDA4000-0x00007FFCCDDA5000-memory.dmp

Download

memory/4188-31-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/4188-27-0x00007FFC8DD90000-0x00007FFC8DDA0000-memory.dmp

Download

memory/4188-26-0x00007FFC8DD90000-0x00007FFC8DDA0000-memory.dmp

Download

memory/4188-628-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4188-28-0x00007FFC8DD90000-0x00007FFC8DDA0000-memory.dmp

Download

memory/4188-22-0x00007FFC8B5F0000-0x00007FFC8B600000-memory.dmp

Download

memory/4188-9-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4188-50-0x00007FFC8BB70000-0x00007FFC8BB80000-memory.dmp

Download

memory/4188-197-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/4188-1-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4188-0-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/4188-111-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/4188-210-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/4188-627-0x0000000140000000-0x0000000140852000-memory.dmp

Download

memory/4772-490-0x00000179B8010000-0x00000179B8020000-memory.dmp

Download

memory/4772-493-0x00000179B8010000-0x00000179B8020000-memory.dmp

Download

memory/4772-492-0x00000179B8010000-0x00000179B8020000-memory.dmp

Download

memory/4772-491-0x00000179B8010000-0x00000179B8020000-memory.dmp

Download

memory/4772-489-0x00000179B8010000-0x00000179B8020000-memory.dmp

Download

memory/4772-488-0x00000179B8010000-0x00000179B8020000-memory.dmp

Download

memory/4780-213-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4780-202-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4780-208-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5068-144-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/5068-198-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5068-149-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/5084-224-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/5084-216-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5084-485-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/5084-222-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5368-127-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5368-123-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5368-297-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5368-117-0x0000000000870000-0x00000000008D0000-memory.dmp

Download