87d2c858f9b7bdf93e9ed83644127ee9597df5edbec7072adbff79ce04e4f48d

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CorkDork.exe
Size 4.5MB
Sample260925-v645rasdph
SHA256 87d2c858f9b7bdf93e9ed83644127ee9597df5edbec7072adbff79ce04e4f48d
MD5 d622d8c02e4da46bbb6e4c3c6b413b02
SHA1 28501cb09a00ed905b572b733b832ef7632faf62
SHA512 b46a5f9ba5f772bbcd6dc635016c550cb43eb4d86c706f226d2c03579fecc732cf52d8af795e888f954cb982b2c6ed070007894f13c63e8ec2caccbfe4eab33e
SSDEEP 49152:wa1CZHN6Js6n0ejMhChyMaNzynymvbb2zGNCE/q4TEJTgoIB8Zw+AHw2Mmq9SASt:GMn/jkkym2gHB+0w2Md9SVN55
TLSH
T11E265B557A4A586DC04AC47082478A335A3138DB1B36BAFF41C4A6353FB9BF06F3D668
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4900	alg.exe
4336	DiagnosticsHub.StandardCollector.Service.exe
2500	fxssvc.exe
4304	elevation_service.exe
4436	elevation_service.exe
2432	maintenanceservice.exe
1436	msdtc.exe
3368	OSE.EXE
1512	PerceptionSimulationService.exe
1140	perfhost.exe
2920	locator.exe
2648	SensorDataService.exe
1452	snmptrap.exe
3700	spectrum.exe
4728	ssh-agent.exe
5052	TieringEngineService.exe
4912	AgentService.exe
4584	vds.exe
2328	vssvc.exe
3812	wbengine.exe
4580	WmiApSrv.exe
1980	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	CorkDork.exe
\??\F:\	alg.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\dllhost.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	CorkDork.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\vssvc.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	CorkDork.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\spectrum.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\AgentService.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	CorkDork.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4cb48dc9288da564.bin	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\locator.exe	CorkDork.exe
File opened for modification	C:\Windows\System32\alg.exe	CorkDork.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	CorkDork.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\wbengine.exe	CorkDork.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	CorkDork.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	CorkDork.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	CorkDork.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	CorkDork.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	CorkDork.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	CorkDork.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	CorkDork.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	CorkDork.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	CorkDork.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	CorkDork.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	CorkDork.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	CorkDork.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	CorkDork.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	CorkDork.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	CorkDork.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	CorkDork.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CorkDork.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CorkDork.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020fb7f93144ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2deeb95144ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de194194144ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe

Modifies registry class 57 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	CorkDork.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	CorkDork.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	CorkDork.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	CorkDork.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	CorkDork.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	CorkDork.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	CorkDork.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	CorkDork.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	CorkDork.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	CorkDork.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
540	CorkDork.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	540	CorkDork.exe
Token: SeAuditPrivilege	2500	fxssvc.exe
Token: SeRestorePrivilege	5052	TieringEngineService.exe
Token: SeManageVolumePrivilege	5052	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4912	AgentService.exe
Token: SeBackupPrivilege	2328	vssvc.exe
Token: SeRestorePrivilege	2328	vssvc.exe
Token: SeAuditPrivilege	2328	vssvc.exe
Token: SeBackupPrivilege	3812	wbengine.exe
Token: SeRestorePrivilege	3812	wbengine.exe
Token: SeSecurityPrivilege	3812	wbengine.exe
Token: 33	1980	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1980	SearchIndexer.exe
Token: SeDebugPrivilege	540	CorkDork.exe
Token: SeDebugPrivilege	540	CorkDork.exe
Token: SeDebugPrivilege	540	CorkDork.exe
Token: SeDebugPrivilege	540	CorkDork.exe
Token: SeDebugPrivilege	540	CorkDork.exe
Token: SeDebugPrivilege	4900	alg.exe
Token: SeDebugPrivilege	4900	alg.exe
Token: SeDebugPrivilege	4900	alg.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe
540	CorkDork.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 4112	1980	SearchIndexer.exe	125
PID 1980 wrote to memory of 2208	1980	SearchIndexer.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\CorkDork.exe
"C:\Users\Admin\AppData\Local\Temp\CorkDork.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:540

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2100

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4436

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2432

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1436

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3368

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1512

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1140

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2920

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2648

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1452

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3700

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4728

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2392

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4580

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4112
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4b22cc001a7ccfd586d87c38d2635a074a92d6bd61d58e39474185d107689cb6
MD5 eb929518964a4db6623adf67016fc3fe
SHA1 d98b170d9a2878d5e079f9a552492c1975d7d78e
SHA512 793c73089b519cf866aaa0f7f2c6e19d187631dde6c418eceb9de8053bb1241b7b037db2fd95d4233fd362317bf1eb730f69592979c3ee7c33eab510e91221b3
SSDEEP 49152:Jb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnVq9SASScpfB5X:f3q6sjBT9SVN55
TLSH
T1AAD58D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 01edddbb2589bd365ede97f68cfcdbfd275604befe62dcfbf2502965a2dc726f
MD5 bca4a2331545f120e279f59cca62379b
SHA1 a9073e116d14658efe549f3361bd9a538a988410
SHA512 79cd987edd9720ef147e5e9eec016afeadb08c88a4b802b43eb96ceb8b41102c35871a63d1980d8849dbf2d37ff564b823043315280a05df72b5c0ed33208e46
SSDEEP 24576:EXYfDtczAWrqUQSAlkSB+pfAOQ+7jXjra:jtc/q9SASScpfB5X
TLSH
T17C65012867D408F9EC578239CDA28411EA73B89547A0F7DB03E48A650F337D95D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2861375478f164dc07fc29f4224bb8f6ff059e644f0df4c0f9f262f7d4b6c13d
MD5 97ef8f67f731f01e9406b7c55d6c95a8
SHA1 ac54d8f09563d3811ef0e2c4724e787a64d396a6
SHA512 5fee2f246795bf616f4d9ddca2a37324f690d646b5ac69bd1fe38f61e67fffd81723455ff13f0da08bc3006774ec331d8edf70fe79e853ad545349f4b6874156
SSDEEP 24576:Z0Le5ji0hmx/rMdrqUQSAlkSB+pfAOQ+7jXjra:ZPji0A9qq9SASScpfB5X
TLSH
T1EE85AE65F6748331D073C0B9C5D2A69AED7130861B308ACB4286D77C6F67BE6893A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 81b94b9ca14584e9ab616c11fbc84343812ebf8939900c73044e798f2b5fe845
MD5 523881edd6d7a77faae2d87bce1e9bc7
SHA1 4798592053e8eb4149af4d89d44b6bcf10b9448c
SHA512 aaff3cbd6d137241b99bc8677fd95e751d6a5a1e23381570d686a0b2d8de87a582ea5a97631a2c3e76ab82f08a9430cb713938c2409dae04f070834ab3baed46
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWn6q8wyubrqUQSAlkSB+pfAOQ+7jXjra:O/ezSC6vUzPveHjyuq9SASScpfB5X
TLSH
T17E756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 14904d695021a3bc69531137729ba957cc51ff38a489de078483fef00bf352ef
MD5 b629bdf34b1e35315569718be4b53090
SHA1 2a0ffafa1402be1301fcd63d1a98402c246dd6e8
SHA512 5fe4f4bd1fcf7723e8e1a00ff81cb0efc87b6a70899b186257364c5c35a063e95b3f44c7c88918d1272a8a8e836af84754d87bc87de216349a5cb8aeb9c50c57
SSDEEP 24576:JVbqPb88hv/l+YSrqUQSAlkSB+pfAOQ+7jXjra:JVO88hXl+3q9SASScpfB5X
TLSH
T180559E66F5748331D073C0BAC5D39A9AEE3234425B318ACB0246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 106cee9ae58a71f468c83d3a74acc23f4b1054a503b58f594301fb83a26d7687
MD5 728f2417ad78e798dc205709beae2c6e
SHA1 b067083f5d7bda71ad8c1c779302d2fc66432389
SHA512 7bb9db961ebd0ad962f4e93125e0497c8da1c7c67194e0836f98d0732cc796671a27703588f01445457a9ec6a6142c804890c1c9524bc6b71e2ebdbf9a001cbb
SSDEEP 12288:dh2eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:dh5rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1714523E54A5434F1D6870631AE4E44E0DA78EED909D27B99CF90EBC08E30A97DC5DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0003a18315e842e068c82aadd5014b6d7616a0fa9bad21155409b8f71e6e6aba
MD5 19e49eec097f39efcc00d56df0320543
SHA1 57307978441963f1d9a4d0288885f1b7cc50cb52
SHA512 cbd6e18a5c54478b06388f0265ae2792b10c3a54eff908259a96c502423fd148343a4deed4e484f92f4fab0ce18f4172832e637406e5ee9d82a485a47f0c7e3b
SSDEEP 12288:MeBNUbTVO86ULeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:MJIUKrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1DC65CF7BAE28FCE2C27A4D785A918640D77278704F62A3CBD265C30ECE235E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e2537d13ca5d310d741f76ad0819f1b92061d3007b1395f8d8cdc7bb379fd0a3
MD5 b9d0bf16d0bcf715a1183f69ac29886f
SHA1 2f51ec967574b2946eba39c21968e398aa4fa889
SHA512 c31bb4011e8bb7d163323277f9c451934efbd9a88c4fa311a498a2f45ed47d20cf384070e0123df28f497767eaedbab544eb548433ad3e2c38e086c636aaf59e
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THc:WQvGAdlCEL8c/DRNw5Cy9SVN55
TLSH
T1EB267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f621379b53158c7bbaddbcc17ebf0e12d0db2b006de53a66952bb03d6d86d404
MD5 9435908ff935d6029ab1d3d6c89e5f32
SHA1 5eb8dec8fd38a6b2e9f2b55b52d209e24bebaa38
SHA512 91f48d1bc8256916a2caad374b20d015da8145290c9a8459d1b737f288f57f0f94e5672fd9c0f7b71e2004810c9476b6e84a667b19cbb737250f40cc3a4f6dd0
SSDEEP 12288:CAwSfxL/2Dc3HDLLmt0LDQewsAj5eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7+:H+ewsAj4rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1EA75E071FE74E432C6BB0DB21B26C715547CB9604B912AC3E3E88E9D49302D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a27beefc727e76e472e5e2d6692a98353f1a57f37fbd9b412a6c349f44bafadf
MD5 db805d4737d3bf3afcaa6526bf143a99
SHA1 5fec71c3e03da2d1424e7954783489628c96f534
SHA512 87b57af39675410534fee39b2872c2d2bddba3b9f2117bf75c66fa0f42b02481e2f117bfe6cf824d80d4f1f72abf244a82aa8cfcfe94b2a500a6db6680b28eba
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHCVL5:rUEtQevvqc2W1cpV2tI32+
TLSH
T1AC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 faa36abcfa8682ea5d59590ee80de95a6f5c0a4a917e1afce88baf45ae96fab0
MD5 fefd0b04d301385e67b6cb430667e974
SHA1 cc12fa124ca85e551227c5c42a4225355ec6d8c7
SHA512 8676a5c26295bcf3e1237ed1258eeaddb450ea86897f27a9020695c8a0b9eb22a4d06b1ee65d6622281064464b32656a21ff2d0dce9277b06ea56b09e95af10d
SSDEEP 49152:hCbRquA/m2yL5zifFiV+XenmE3/zaq9SASScpfB5X:OoqHVjnmG9SVN55
TLSH
T177D58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8c6571d33ef002631aac4ed119eb60a3669c88d3c943b5032202d832d89ed56c
MD5 ce5eee7eb4b193d9f2ec8dcdd850a113
SHA1 570dfe309618be9f9d613c18c7fc37a5ab66a3aa
SHA512 38795c58716bf204f983d219d31dba88370f82e5c0f39476afd6933523d121388f6b3c1e4fa79dc5f1705092e39c28a43e6183450e5b4033c31b40b4898ab7fe
SSDEEP 24576:0AhGL3IFoiwtA5l7S53PrqUQSAlkSB+pfAOQ+7jXjra:0AMUFoiq5jq9SASScpfB5X
TLSH
T130359D80E7F955D4F5B3AA789DB68170EA76BCA65E31D20F2250D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 7f514e8bc55f340256e0970eb1433e1c961414a694ffa64520f308428ae20fa0
MD5 46d9cbff35c55620289224587d5a72ce
SHA1 08ed6697534752e3af205b2badeaff09f4233ed7
SHA512 cd7a04657be25a83978a15951efc7be55ba0e1ce6a33c1bb8e16c3f2dbeff40288d140725cb4015625e6733bdf1e98e4ebb9888f3c96793ee4389176e6080fa3
SSDEEP 12288:dmw5HEjsChNTBFgl0WDm+CweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO+:YwuaOWMrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T12465F18576A41CF9E9A74239CA47C031E7F2BC022A61DB1F4760C65B5F33362AD2DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9c41e36cca576a3f4d46ec5f65c872652447b57ebacd582f12e16eace35d9dbc
MD5 7a2e72c9fbad71deaa48f730807e1e7f
SHA1 d513321a75e4c804858d82b0b620d3141077d9e1
SHA512 54fe4051fdc2e720f2124f1950586d8686796a03362f92e8d0699f84b9a727f359638eedaf713f45ec4d81a9256763659c7a17a191f4cb65852af907b7f629a6
SSDEEP 12288:XAZ1IypeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:QZu1rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1C85512A927A430F5E1930239CDA94580D7B1B8A627B253CF4B6487954F32AD79C3DB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 398a4769a7a5f3fc512710046a1e45c280c139be55c934dbab977f2429021376
MD5 6dc2cb467e77a1da7f65ca7384bb921d
SHA1 fd1380e3ea50e1b2855ed69a363f99c37764aab9
SHA512 9fb79300af15bef21709a59abc270a0046f8170c9b80691b4d65cd137ee4e69abe2d31f37f00ce3d808f71fa56115f796ca90d6e930d8f69db79dc6e85fe09e5
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UI:9QRQyi36YOcPbLvw2gAf+PN3/9SVN55
TLSH
T1D7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ba5b4a2510d84bc50b28370318de9b691f7e1c1187ed9f413c55be9a63576b96
MD5 294d436dc97e4d9773e61d0764e86c63
SHA1 0c102164d3d62aeccb0830186ed40bb4de01f1f5
SHA512 cc7b43b5ae1020c6fc2cb5cb797d1146ab81508621f14cbaa502d4adb8965ff293e27f62d8aa60c48d06205c40f980636a98c31d986ccdf5fccdff7afa6a38c5
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UI:nQRQyi36YOcPbLvw2gAf+PN3/9SVN55
TLSH
T12D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a709044ead7a013da5ce27d796abb067cc1c4a41500c0785751aafa9f468660e
MD5 bdf49ee4d9977589c91b32f8595cce65
SHA1 0f2d2a1405c03bc831d98c7477fcb55ee6784cd2
SHA512 2222801fef148adfdbc40f96e2c233587aa5ed0a87e530ea1e90c7c3a0d9207a412f1e86add50c34142dbfcbd89933a8a350630d6dc051352e297ae721bdc43b
SSDEEP 49152:468Qg55nhceWu7PNU3/qq9SASScpfB5X:CthLRc/R9SVN55
TLSH
T134B54933B2F600A9C44DE1769F4A872196E17C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e665842937d2b2a9cbbd2e52976cd8095351df4ca4d6748996fee9dc0bba0ad2
MD5 b830f10f00c4dda6b8b500f569473f98
SHA1 4e955554f54f1fb1d4b98fb9e555d1938c7e64c9
SHA512 e6b7bf4a929ca027256588f43d7ea9b6e70a2f8d50286edb49a96e44bf83d84cbd28ccace49ed52f46c6c74adbf66478b23a29a2353bddef8f84da2847f1a44a
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99W:Hy5112gYy5azzVvt69nLKnhZA9SVN55
TLSH
T14F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 83e6f379176f6cf96bbc32898485d42c2a894f83869946f806e8d3a24929258c
MD5 9654f8fbfecf9e0e6362a0d979e6ad5d
SHA1 6f23a2aa61bdbb2d9b06217411ace6447f2bfd8b
SHA512 b46dabb21076e22a89e10cb1bba71a7d9584691f196f7c8a55415083ea4e77c3d08903cf9e443625a63c4c0cd86a229f52efeeabb6841bec846131fb0bfb8851
SSDEEP 49152:1B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl8q9SASScpfB5X:7u6Jmdxd2dH9SVN55
TLSH
T156D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9759e520e5904eb60554373318d5bfaf0e770e9412e80224e4ac1f9fbd485069
MD5 a64b2d622483b19bcec951c7d52dc5ab
SHA1 fe0a4a122204a310e7d3fc5a645d814607444407
SHA512 031ae25f82b614ec6583763f2156dda6b4c3d6fc489f231725d16395eb8f9f84849315e93ccf6f5f26ef9ef719ec361ad8d2ec960953d1fbaadfd17e4536fa32
SSDEEP 49152:J1hpsNoJpF1A63U44CwH7R4xQq9SASScpfB5X:JmifPWRG9SVN55
TLSH
T114B5BE13F29900E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BAE45F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5ef6c9395724433ddeb9abfadf999a96134e702e6335c50fa47378b76501abff
MD5 094a70ac9f5950d4c7185ebf1603b05d
SHA1 1cd22b73c850108cd2fb98c8c964f57595009e78
SHA512 e524abeb3a0903051ebba3431f6908d2e484dc005e6ac4b9081b3de7a6213fdb10085939180f0fccbc878e735ab64ffb4ddf373a1a23ee0cad36a23868979e60
SSDEEP 49152:WSuZQIY0Be2KcRVtOnks6NMHqlq9SASScpfB5X:45dKii61c9SVN55
TLSH
T174C5BE13F2E940E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4f6ef3e0a78864d2505b72fc81787b149d8c639a0a8a38ea083a9aae6edde7eb
MD5 6ad47f6782d827a5c859824a1feb03ae
SHA1 b5a61480fd7858a9383aa6651d0968e84b23c2a0
SHA512 8f67326c4a29f1093e86fa5c9c616bd0f89585dc49c5643221855228025edbfb17a1c2a2264d86e8cf3d69d5c186e2b723105b8f2c74e9aaf04973d4da187222
SSDEEP 49152:khtSn8EApI0fig3giDn0AP5wMq9SASScpfB5X:lX2imphK9SVN55
TLSH
T11095BE13F2D900E8D05ED174C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c2abb0fb63381263a3f305468c782bf0294eb1ba17561557f52112a50dcdd46d
MD5 92343023f6c860273980d713c4d45f4a
SHA1 96d29bb9b505703145f8a012a0d6b032015b8d46
SHA512 7e153dcd8f8176dee83fa9be39f160cbbbe3a095bbf3b826d93af17eff4ee18e8c13c39a9490dc05499bb5fd6299183d97c95d48098a54be9fcb46e0741d5167
SSDEEP 12288:JueDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:JRrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1F44523E4495525E1D5420631DE0A44E0D97CAEDB2AE337EEDF88DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9ce737be47e72a7a0051ed2e1c9046c47b080da4cc8715a41d8923acb6e4882c
MD5 1a3801f1d3d5d01bd0b5785bbb06efcd
SHA1 f66860c9c37624c5ede47a89833a1093f6be2b4a
SHA512 363d50e9090c5b26ecf1a3359e90d3c706af6bbcaee6de61277f235cc03315e9f43ed1559ec13c414b95f6604edf2dc460e3119a0b4bf50a9dcf0b77ad8d4d2a
SSDEEP 12288:IdeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:IUrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T17F4523E4595525E1D5460631DE0A40E0D97CAEDB2AE337EEDF84CA808F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c6074aa1464154ddf0eb7b0449fd990f063f7ef6f7a98f310419c36a2b4ffb8a
MD5 f6e2892878b823c44c63453abe8fde15
SHA1 b1549abd382ede83fc27c8e8c77578c6f511b5bc
SHA512 31d61b50c1f8bfd7866c28e07bd9d195f3d4fe33431f38111602e08469b3f5c8bdc5fc46fd4903eb5367b4b8f704279133fae0478d8b00747d04913fd35caebb
SSDEEP 12288:hjeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:hCrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1B14523E4495525E1D5860631DE0A40E0D97CAEDB2AE337EEDF84DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 1fb163b8d15c44c9af9fb96bc1c985f1ef58368b00037e2be3066a788ea47234
MD5 58ba27e1fc6b359ae755ad5678e61d91
SHA1 d62e4fcb2de5896f3f7fd7f706f35540391cf5c9
SHA512 9f0cdf341acdadd3a9e5f0070101eddce832dfab12db0d626a806b2bb32d9a54693c6464468c7afa9fce9bcf8147129765ffddf238f70c3d43a23feec0359ab5
SSDEEP 12288:WVseDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:ArqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1C94523E51B6925E1D4874235CE1A40E0D6B8BDDA5BB267DF8B404A854F30BD6AC28F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d281703779485d1d813e859da8680401109a7665561968682621aa550cb8bed8
MD5 19914c936f0f6eab901c92c3f18dfe07
SHA1 790ff812a581f38141ab61cfe07536af05eb22ac
SHA512 0a56c1c1e76c52cc5e8835f61cb783f39c57b206f8be9235b6a55282ac2922a84c2af469bc19e2c3aacb03365e14ae34155df85b262b6370cdf7192adb0258b4
SSDEEP 12288:U0eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:UXrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1104523E4595525E1D4460631DE0A40E0D97CAEDB2AE337EEDF88DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 938eb4c98d01b86ef5c5d3e74628f3fd1c1fee92729d58d354b4cf84a9e662d6
MD5 04daae143ec08e4e9164e77df95a2459
SHA1 103c2cede2f3460360cd51e25993c3698119acf4
SHA512 494d44992831d8901a41e6b337d9b310224af048ecb97469894746109a3c93bd3fc42e7dac9c0426cda777ed3d3587bf91ba0c2854c4ba79bb08e0853c105466
SSDEEP 12288:mxeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:mQrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1844523E4595525E1D5470631DE0A40E0D97CAEDB2AE337EE9F84CA408F30AEB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e0c8c76ac7f548c1c96cbe21f25cc80458d487ca4286691b33ddc8b5ec03680f
MD5 07ccd2fe2460ff788f48084943588a3e
SHA1 1b60ff05bafdd028523b7013f2251d008af67162
SHA512 9a0929aa7a95d5aee3cabe10bda9410e48dbb4223b018286e126655da6d2d442d2a24181ce207234870534efc6b383514ab85c085ad5fb365e4b0594b52658ab
SSDEEP 12288:LleDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:L8rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1524523E4595525E1D5470631DE0A44E0C97CAEDB2AE337DEDF84CA808F30AAB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 758c043d2f264465ea9941695449d8e0e364ad4c47c69f3bf1f2ceec7d439361
MD5 e5338699a202df19661e9f877618fb4c
SHA1 53d21a61a65ab6eed6e6e66783d3c3a6db9ef033
SHA512 4acb8245358c0b8d5c58306888a1cd6eec25cb85113feacaafb55ce88c33bee85cc8b57403bcbc175ef89b3037b1999f6163afd5013cf84979aa92f3b27af148
SSDEEP 24576:ZZM3zFVSO0rqUQSAlkSB+pfAOQ+7jXjra:ZZM3zfiq9SASScpfB5X
TLSH
T1156501A5B39018F4EC67823ECD158855D6B2BC5A0BB0C65F07E436664F333A25C2EF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7535cb94854f8b5ef83c6510692c2fea0d9b4a92fca2c695bb7532afefc3a85b
MD5 b5bf04b4bea9b7339cdf1bac2b6e5710
SHA1 90077837ceacc22db5e202153b04e72fb0423c99
SHA512 18cc628d0ca88c6fcbbe6d37f0ce7d5db94faff91e7430f98bb0c2bb92c2741c480d5c54d86014cb72cb6d2b8e9af627c24c0741b49f2e3b61b2318fcaa177a9
SSDEEP 12288:KqeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:KFrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1314523E4595525E1D5460631DE0A44E0C97CAEDB2AE337DEDF88CA808F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 be3559d89f14680ef3f5bdec4aad19dfe7788538fa73e0632e73daea28f28bd6
MD5 db9cecef7efdacdc8d747ef7e4ac83ce
SHA1 c80228d12ad016f0abf3046ef4f12dbd2be3837f
SHA512 dcdd8f83574aeee33fb44227c99aef31ef7ad401d11cfe4352d5ea923b4730375d8e5b17c6ba2ae567465bae8d3c67dccddf6050bbd00ed2a6a15df6f837f37a
SSDEEP 12288:rmeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:rJrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1834523E4595529E1D5460231DE0A44E0C97CAEDB2AD337DEDF89CA808F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ec036ec4ac8a5db502e57b9670d6e0f8b58097ed3603b57bcbf782c9f9002623
MD5 5b12cccd342978196619cb193dcdd125
SHA1 e216c352513631193243237442581e492980c232
SHA512 48911f0144d71fbbebde629de1f99fe83469f9b43e12c6be4e5becb5a4e27fc78b5f507a97e7de1d2c1d5241c3ef3ca9ab568c53f4b4f574531e6c7e921c685b
SSDEEP 12288:9yPz5L8peDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:0zyIrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1D355019767A130F9D0678238CD560980F775B8760B619BAF57A047B60F326E29C3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8251315e29c00448dfbbfaa300fffb684cca26994a7820665983ae74520c8442
MD5 df69f29a9d5684a7311d9d38c7d40f4c
SHA1 39d0538840c31830f859c161eaa298b182c7427a
SHA512 77037f968e24bf9641fd932576ad560965b80708cbc0de77bf9ca70e7b7043a954ce833b64572280197349a29da1ef829a8b144d1ae43638ce0a78861bdb82d3
SSDEEP 12288:QqeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:QFrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1434523E4595525E1D5460631DE0A44E0C97CAEDB2AE337DEDF88CA808F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 88d3a58b3d4c7000142c8001cbc7930f95d4a7f093d4cdf7ac4b55f51a425e6e
MD5 90cda69e593ce9d94ef35c722f89cbbb
SHA1 6812618b5875bed6dedc9035333ff8f20cffbee5
SHA512 e76967c38fc76ef4eb0ec28fff6ec743770404e5eaa7b834b4f04931cb01f536fbea2d5a4a5a50520ecb057b1eb008c7a3708d88c8ab5816cdb5152f09586289
SSDEEP 12288:cqeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:cFrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1174523E4595525E1D5460631DE0A44E0C97CAEDB2AE337DEDF88CA808F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d9bd11b5d0734a6274d42b312115ff2b63d5c724f4f62543c9941f3f722f7f8a
MD5 637b8b2099a14177c105d09251f81c2a
SHA1 44069617b7f70b1a116b8d65575a3782ab4979c1
SHA512 fb727180f3545ccc70224306445f512e3e3a61ae4b879c0846e288d550a17074caa54a1b3a2647667daef409d7d1e74551369f24b0ec43ccdff8e4549b6e0b42
SSDEEP 12288:4yPz5L8peDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:ZzyIrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1B155019767A130F9D0678238CD560980F775B8760B619BAF57A047B60F326E29C3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 282329a2a4c422acf8c2b526731c9ee6032563c345526e2e3e37bd908cd5c0a3
MD5 a2ea5af0c27ba8b3c3292cc7051377bb
SHA1 f5ba8cc61316b9dbc6ea40a16084995f10794eaf
SHA512 06e6d49ce6d4a8bc50c3f2213bbfedd86bbe1d41efa77141058412645ccfc8161de0a0d213f67b67a3373ea1ae698087a8fefd20ab90ce8e01bb9a3fca938bd3
SSDEEP 24576:ZcP4mcvIjkGOxhKP2l71SNKbrh/8KBNrqUQSAlkSB+pfAOQ+7jXjra:uP4m4IpOO67N8Kfq9SASScpfB5X
TLSH
T12065AE2DABDC0096D0BB917886658A49FAB1742E1F3286CF1160933C6F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e95bdc16e22319c182f06c38a28e607da808201bf53af72b551bf9a71db1505e
MD5 23b941774bbbda55535d689050c1843c
SHA1 27bfb4bc695276c1dd7863607839eb2350a1713c
SHA512 06eec54177a406f67252a46593ba14fa5895a5af5f0b6426b807158ab49c6563978e096fd14d1932d9337e9fd82f943cedc506b922a5405c885931b7fd6d18e4
SSDEEP 12288:TZsf6eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:c1rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T16455F059D29812E8C05E5235CB464A80F7377C6647E2A3CB57C0FA7E0F356919CEAB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 37c824cdb4fb0b76efca224e4700aaf813200465249a92a5b94f9c650701f8c9
MD5 b34eab05b587d67948ba42844acdb4db
SHA1 c1e2b0619b6e15cf3f892f474bd5b39eb2c2898f
SHA512 7e8f80cf32ff7ee59940dfcc832ce67b5c16eaeefe83e2a90749658b01ff77edea35673b29c4658c8309696f099f7e00fa6a16ddac3a5581c47b2923f7f0ee87
SSDEEP 12288:waeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:wVrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1994523E5475829A2E48706319E0A80F0D93DBEA91F9266DFDB4497804E30ED7DC6DB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 55d2fc314160c972b511534181f0ea8ed0a94a806f9dc3bc8e9e45b60959c163
MD5 275cf7ce77482bdd540e6cae3e1a2574
SHA1 cc79850d5460d05aa2cf3bc9b6abea9e5ada9104
SHA512 5adfa565c0397a843e5bbe20e68b69c41110b0dfbf9b7e01fff259606dd7c4b556569998866bed131eb6b570db34db51b36250b847128902287064dcaed9a396
SSDEEP 49152:Ia0h2GEkuAe73q3pp46zwwQbq9SASScpfB5X:Ia0hNYG4JwZ9SVN55
TLSH
T12785AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 4312c0c739e2cefc7152340c42ae0159b45e912f3cbcf8e6f87bda0550fadfc4
MD5 ea349e8d1267a68abf4aab2b06982801
SHA1 18b535973f5c2a1d3837b3ac4f272cd3cbe3e9d1
SHA512 a2e772a8f4b5c65a1427265fcf0e789c71e69920fb46273b906241663a3bd313a2179091e28a963e98cb11527648db181ee8f06b595460de52fbc5d75c0a4e20
SSDEEP 12288:ZhbHjfXteDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:ZhbHjPErqUQSAlkSB+pfAOQ+7jXjra
TLSH
T14B5512BD16AC20E5E162923D8E468485C730BC661B22A3EF57C1C2794F37EE55C39F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 538d3e0816d0df605da62fea59866320115b5870edcfee51712379765e0012f3
MD5 70ef52df4b029a22f94a5fc2e385dec4
SHA1 65b9a3cd8fe824ef3b36f43d1b884de9929a58c0
SHA512 cf9e9397d6948d3a9b0eac1011005e1557e50553d198ef5c0664ccccd158464c37e933a53e0fe18615d8d5e8d73007091a7293a8749ba6dfa68779faaa669009
SSDEEP 24576:Z3YgnJcRTk4yti+R5dpR/MrqUQSAlkSB+pfAOQ+7jXjra:ZIgnaTk46ppR/Oq9SASScpfB5X
TLSH
T16D45BF2DF2B910F9D8A6D236450147B5FB71782D1F209ACB0170C538AF16EE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 afc7740529540de220518dcac23b09b410dddb2222936cf95dd011e0bfb6d029
MD5 1d054842df3cd8a1bb40d164803cc1cb
SHA1 5b58f746a083e520be0debe7ce516809ab76cf98
SHA512 32f4666328136e488055759e2f48a73f693438b9afb7dc2af5bf6fbe1a6e32f557e43ad7ec84ee7179057e94ec5fbb30c260ea59274955b2202c2729958fdfa2
SSDEEP 12288:ZWeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:ZZrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1D04523E4465529E1D48606719E0A44E0D97CBF9A1BA337DB9F84D6804F30AEB9C7CA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 9438dc7f5dbe2614c5f705af00f1f29d782210460030e6f6d9f4ecf3173f125b
MD5 7bb26a63aeb090bc5def5dd5906cf414
SHA1 89ab22c839ddbbea03fec990a7a5e02b9a9d5d8d
SHA512 6818f0f5800bb335caaa686669f91b2cc50663e902fd1d25e8bb6685d47619fb49592c21168fa831086d25c18ccb76ccb6dfaf77242bef6c12fa848f2544003c
SSDEEP 12288:vOblA4LWOsvAYFTPeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:wRL3UTWrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T11B750255F7A400F5E86B813CCD668912D672B89D0764E7DF07A88B650F237E24E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 81a708dc99aaa900f360b78e844f82794d421729eab080d5e7bcc740c0fa513f
MD5 e28f8a1105b38a603a42304df9fd2782
SHA1 353274cc80e33cc942cf2e0bfb144b7b69480c03
SHA512 f1e445b4092580ba5a5e269632f7ccebb0d82601e2cc8808a7735bdbf69a2853a1916a827c416c52168c3adbf5d58d4d42b797a243c2d77f30ee814d093f255b
SSDEEP 12288:xpFt+OreDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:WOqrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T15C55126936EC20E5D066513D8E464248D771B8A60B6227EF47D081BD4F73FF8AC39B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bbc664df9e7a7355549b9b63394b90e4614947e25f6bf93419735f359f8f8713
MD5 2d66233ad62bbc37b97762342f1abb0a
SHA1 3d84939b04194a544bb575ac897d00e8e94e2239
SHA512 1e1647e9446303471b46fb7eebbff64ef70c876ce84b97099a1613319a9b457a454e8d1d91aa6303b08582c13f50c0c1c6120883c7d61d6290a77645dbfd1d91
SSDEEP 24576:q7NM9YmZqmWMUkPjZM48Mv6bEhsFrqUQSAlkSB+pfAOQ+7jXjra:q7cBWMpPjN8DbEhmq9SASScpfB5X
TLSH
T1CF65AE2E6BAC81E5D477D13DC9A28245F6F1B4611B318ACF1252833E6F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3523f6bed48c48073e31638094cc1ac8b284debd36f2ffad1e4db2563c3cc55e
MD5 b7dcf9fdfaad99af06bf34dff9a76d97
SHA1 e55ed99457d2efd6f933d337d8c80df88e43fbb5
SHA512 f9792e964adb85b1acea6321ad1489edc0bbd9d3a08c93855f8b725091086c28075bf97b640ae006c07b67cf63e119ab8cd08efca7123dadb5bbadd0ab8e7b4a
SSDEEP 49152:VF2YuHNETovcvNYf8kmVq9SASScpfB5X:w6tCf8kr9SVN55
TLSH
T1B2858E6927ED80A4E0BBD27D45B6D186FAB2B8511B3056CF4255862E1F33AF44C3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7f97331126ca08cfcf511982daaf69a4fb761b5e10863aa7b736eddbc5d8bbca
MD5 92296d2bdebff3c34b20c47c527aa874
SHA1 829cb6e5d88caad39db2a626fabb257df5076c83
SHA512 0e14c4252879403f453d5832d3629c51a89bd1e5036536f40dfdda11db1ec875f317892a8b2306acece3d0585b9e377a942f6f00c6192e3a1d42bf8c0f63dbd2
SSDEEP 24576:qAFs06+OmlfkNXEbTourqUQSAlkSB+pfAOQ+7jXjra:zFs060lwXu7q9SASScpfB5X
TLSH
T18965AF2F62AC00D5D07ED17D8A97C91AF6B1746307215ACB0260C67E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 91af5b1db2d8dc2226a049e92eb196c9c4d3007c8cb350c401a05256eb4ab30c
MD5 bb5986302b8a2f538a7da6db01d4545b
SHA1 ebe8fb38726137826c2d67ad07dd5bd773b2405d
SHA512 994a0e5c60f74fb45f37869fab4b43f1a6501a31f5794c7caaaa0efbaa6103bd0b41f3830f9d89655bc59305567d4df4a27c761b2f4c4b30dc2ba6362a9988e9
SSDEEP 24576:QJnJ5D3Wn3rqUQSAlkSB+pfAOQ+7jXjra:QJnJ5DGn7q9SASScpfB5X
TLSH
T1C475D02CD2A810F4D4B7C274864A1695FE72387D2F226ACB28B4D5353F22FE09979F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4fadca10231698efc7b36d1df6592e01e2c535af0feb8c8ccc76496a0b8c7225
MD5 2da5bcd20af84213525136cfb30c73d2
SHA1 a61d2f15b0611aad01f95db26f414f3a370b50b8
SHA512 e13721ceb3908ffe8455d70a7c4dbac96261a8b369d3c8159f6bab55c3154b382080cae9fca4f2e91eb4d7a54509d33d27b84f3bc8c9a1880009d66812c6fe2a
SSDEEP 49152:Do06DIKdwc+eQnSt65aVxq9SASScpfB5X:8a9SVN55
TLSH
T138956C15BBEA5294E8B3CAB1CA6291159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 29e3734f8a8838f7063425ec54866685ef3b18db25f2950d14fa8e948c50a53a
MD5 c9eb89d7eb8e997187d268f37c9a51bd
SHA1 c7cb2b287faa7df721fa4c8cc226ab1b81608f1d
SHA512 9fcf3a00bd422491ad8f0b4e4cec7b764afa6bc75401991e1f6ff3e0f68dd9c59b44e6ca3876d43894c7c2dc0de7c9ee44be8ed83bf0317348bfeab421590374
SSDEEP 12288:uEP3RVweDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:NV7rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1165512AD2BAC30E5D056913D89518584D375F4B52BA227EF47D0C27D4F32AEA6C3CB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 1d900c3689098caae685024c53d0251c54a0a6b785eef188d3789b9645f3fa70
MD5 97f82b443f1b2c575c3957c195c88e5a
SHA1 64466befbab263911e2f34e6ff9fb7575bca3972
SHA512 023e3dc9b6b4314bfc4acfd5a10d350ff646d3ed6fcc3855059bb0ffeddbb2a0abd58a98ab661fde629d8424d59e158504c05ecdfffb3203277174453a33efb4
SSDEEP 12288:MjkydeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:MIyUrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T152551254539824D4E5A60638DE6780E0DA78BC611F2267DF9680E73E4F31BD6AC38F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 94189802d89a09196752ac8516d39b823297668e73bd1500e46aaa655e218e64
MD5 84dff126d3d8f0a3dcc69ae770ca9ee0
SHA1 bb8e1b60a9ccaffe51b423920b8af8499a0e3526
SHA512 6acb8b894f425efcd36c69546fb6c39104a5e88d99e9657ff2922aca7b7d60a93ec771c85ee24bac5015f563bea237ec9038038759744f7ed854664e0b7ddc43
SSDEEP 12288:mXbeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:+6rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1684523EC165534E1D94306318E0A44D0D678B9AA1BA236FF9BD4D6B08F30AD79C7DE23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 bfab9f37f9b26566dddb3228f23dac12ab9c57cb2efb1af24fc6852314afa919
MD5 feb7308817c3c3bea285c42b95602c48
SHA1 2cf31661366f970d1b0650c768da85b8d5ce654a
SHA512 dc6bc28f2e29a4863a5fe65753d0f6c6ac17a5c53465535ef5cd913e65ac111a038fde9a5c29cb37c223814c13632df103e06a5e31a29e578122e24b5051d160
SSDEEP 24576:oQ9MxZKdcz97w39rqUQSAlkSB+pfAOQ+7jXjra:oVKXtq9SASScpfB5X
TLSH
T1A1558D2DABE905DAE177D23595A240C3A673B4311B31D6CF2448D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 e906a85ee43560e2abb3aa8eab5967ca04dedb8db116c1d4bcc2ad5c505c89aa
MD5 91362b5a0c1a291a314ad92e2404c11b
SHA1 7f7a98c5f2ae86b13b182c7da9659c29a0281fda
SHA512 44e16adbad217474c98a75bad92b601f9fc9378d536c7877ce11d6cf7566c067f8c16ea8ab1ecdafe64299dd5b611481101d27422a31e2252999b9660fc300cc
SSDEEP 12288:FyoKo2NRple9p5eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:FyocPAp4rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1AD65E05F7B6900E2E166813C8D858684E773B4701B6267DB5691C73D8F33AE9BC38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 593808c6daece4c686a9bdea826924c8a287f41aa34077aeb5cbf970d30ef718
MD5 48d9b318e92689d7049e76c825af0f67
SHA1 41d27c1c998fb781b039eef9f309341298ee2518
SHA512 59861191a1142b6971f39d83ed4156973635b73cb54f3e79900e9bc3ed4d0a722c4daf530458e2b10894dc620ff67930eedc42ed04adcc74f261cea7c34607fc
SSDEEP 49152:FWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK6q9SASScpfB5X:10zuNIl9SVN55
TLSH
T164A57B3DA2BC00A9D8AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e0ee662290554f9e32d9982d7ddb371a26f4cb98ce5ef50ed0b9ad48ecde2393
MD5 b678f10471884d64420b4ef1f603c04b
SHA1 48376a05cb4f7fe9f705e4b6da72ee3212436433
SHA512 18747dc2a39feaf22f34ea560a3096177ae78443d9e6df0cd238a718119f9bef58d81d961789f0c1605a45fc80e92f4dcbf51aeca60238a36a54dabc61ff8b83
SSDEEP 24576:m1QT7EcpfxR+N5AWAz3ooiYujMqb7rqUQSAlkSB+pfAOQ+7jXjra:rTDxR+N5YzT4jMwq9SASScpfB5X
TLSH
T12355B02EA7F815E9D1BE85799A23C512FA727821033193CB42A0C17E0F779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 4b4fd7e671f4c0a17a2f97b65ed23de79e7887affefe9a82cf7489b7e0cab08f
MD5 3cbab7361aea65b95fc5048ad51c1b50
SHA1 012541acb323160d89f214950a4b6059ba543207
SHA512 bd32fb013742a48d94997c08aac4ebd3b44372408ba73cc33a15074a9a93cb21b2ebcc734a6552b499c4aef50fea81a6be10862fb4e3293d82cbb0bb15600a81
SSDEEP 24576:0TMdOz0FFS+NmSLvrqUQSAlkSB+pfAOQ+7jXjra:80K+NmSLTq9SASScpfB5X
TLSH
T1D175E17EA3AD14E5E47BC27CDA438906E6723462032266DB06D0C1B92F67FE4793DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 79cccb924ad9ebadc1cb379b692b3bde8cc1611e945915004685547656bbd810
MD5 e2bb5b689ef12bd39e9dbb8d275c9cd9
SHA1 6f62f31d7fc9a8fa50acf46a30de899afa9c4df0
SHA512 40e4daf58d16997b4cbdbf9417a653f94618f1f5e6633f1746017e281ef74f82ccc5e114515aa5494cda0c531f573a18c1eb16930000deba68b577410131c02c
SSDEEP 12288:l4tPeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:GWrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T15555129C17E834E0E4625235DE2A4194C674BC76176127FF2AD0CAB94F32AD6DC39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-76-0x0000000140000000-0x0000000140486000-memory.dmp

Download

memory/540-0-0x0000000140000000-0x0000000140486000-memory.dmp

Download

memory/540-1-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/540-11-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1140-258-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/1140-131-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1140-138-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/1140-136-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1436-95-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1436-219-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/1436-94-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/1436-101-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1452-170-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1452-173-0x0000000140000000-0x0000000140137000-memory.dmp

Download

memory/1452-164-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1452-408-0x0000000140000000-0x0000000140137000-memory.dmp

Download

memory/1512-123-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1512-246-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/1512-117-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1512-126-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/1980-293-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/1980-309-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/1980-284-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1980-326-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/1980-481-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1980-281-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1980-484-0x000000000D300000-0x000000000D308000-memory.dmp

Download

memory/2208-497-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-494-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-488-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-489-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-491-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-490-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-487-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-486-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-493-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-495-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-496-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-500-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-492-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-501-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-499-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2208-498-0x0000019B7FB30000-0x0000019B7FB40000-memory.dmp

Download

memory/2328-478-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2328-247-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2328-244-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/2328-238-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/2432-88-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/2432-84-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/2432-78-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/2432-91-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2500-42-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2500-50-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2500-64-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2500-62-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2500-41-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2648-160-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2648-152-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/2648-158-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/2648-475-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2648-474-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/2648-283-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2920-147-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2920-141-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2920-149-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2920-270-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3368-114-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/3368-234-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/3368-112-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3368-106-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3700-443-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3700-182-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3700-185-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3812-479-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3812-250-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3812-256-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3812-259-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4304-59-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4304-172-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4304-61-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4304-53-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4336-29-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4336-38-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4336-37-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4436-184-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4436-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4436-73-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4436-87-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4580-268-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4580-271-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4580-480-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4580-262-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4584-235-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4584-232-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4584-477-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4584-226-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4728-458-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/4728-197-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/4728-189-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4728-195-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4900-24-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/4900-90-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/4900-21-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/4900-15-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/4912-224-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4912-211-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4912-217-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4912-220-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4912-222-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5052-200-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5052-206-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5052-208-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/5052-476-0x0000000140000000-0x0000000140183000-memory.dmp

Download