9786b31fc58d8b31f284917145409f8b311162b4327df9ebed780372a9e736b0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
Size

3.1MB
MD5

7f4ca4c48ddb9ec4bbf17f305de42fa0
SHA1

0817ee75a4ef9725d00eedee6887f0a847d4d060
SHA256

9786b31fc58d8b31f284917145409f8b311162b4327df9ebed780372a9e736b0
SHA512

fc749dd141354fa153cbedd9105aa7655471739f9e9c81a224019be6fca170939788d792c0d3a23d640cd219f781a83fddd1bb6f4854cbd3d4e95d49f8664b43
SSDEEP

98304:rHgNDfXQ1veFPk5FaoCRrgGUDx0fFPfUNF:KDfgZeVmCJWlKnU

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 24 IoCs

pid	Process
1916	alg.exe
3276	DiagnosticsHub.StandardCollector.Service.exe
4824	fxssvc.exe
1076	elevation_service.exe
3240	elevation_service.exe
1516	maintenanceservice.exe
2984	msdtc.exe
432	OSE.EXE
5020	PerceptionSimulationService.exe
4104	perfhost.exe
888	locator.exe
1100	SensorDataService.exe
3696	snmptrap.exe
4932	spectrum.exe
3432	ssh-agent.exe
4924	TieringEngineService.exe
4632	AgentService.exe
1960	vds.exe
4572	vssvc.exe
2324	wbengine.exe
212	WmiApSrv.exe
1480	SearchIndexer.exe
3540	VCREDI~1.EXE
2892	msiexec.exe

Loads dropped DLL 1 IoCs

pid	Process
3464	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	VCREDI~1.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\spectrum.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\vssvc.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\AgentService.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c0cd32aa61dacc.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\System32\vds.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_98703\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_98703\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{544CD458-F493-4888-9A56-33661A7F5454}\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{544CD458-F493-4888-9A56-33661A7F5454}\chrome_installer.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.106\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57956e.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320470.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320610.0\8.0.50727.42.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320626.0\8.0.50727.42.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320626.1\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320282.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320470.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.manifest	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240508004320579.0	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A49F249F-0C91-497F-86DF-B2585E8E76B7}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320470.0\mfc80ENU.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320282.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320470.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320173.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320204.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320470.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320642.0\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320470.0\mfc80CHT.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240508004320282.0	msiexec.exe
File created	C:\Windows\Installer\e57956a.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240508004320173.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240508004320204.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240508004320626.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320470.0\mfc80KOR.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240508004320470.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240508004320610.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240508004320626.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320204.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320282.0\mfc80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320470.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320470.0\mfc80JPN.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320470.0\mfc80FRA.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320204.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320657.0\8.0.50727.42.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320204.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320579.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320579.0\vcomp.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320282.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320282.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320282.0\mfcm80u.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9AE9.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320626.0\8.0.50727.42.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320626.1\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240508004320642.0	msiexec.exe
File opened for modification	C:\Windows\Installer\e57956a.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320173.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320642.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240508004320657.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320173.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320204.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320579.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320657.0\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9700.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320470.0\mfc80DEU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240508004320610.0\8.0.50727.42.policy	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000828eb54ef8e6371f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000828eb54e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900828eb54e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d828eb54e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000828eb54e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000688cdebce0a0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070cb7cbce0a0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b5d72bde0a0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e0ac1bde0a0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef2177bde0a0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081c8babce0a0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ce9eeafe0a0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\PackageCode = "FA1F9ADB128EB664EAA9BA3CE244C0B1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F942F94A19C0F79468FD2B85E5E8677B\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F942F94A19C0F79468FD2B85E5E8677B\VC_Redist	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Version = "134268455"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\F942F94A19C0F79468FD2B85E5E8677B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F942F94A19C0F79468FD2B85E5E8677B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\ProductName = "Microsoft Visual C++ 2005 Redistributable"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
2892	msiexec.exe
2892	msiexec.exe
3276	DiagnosticsHub.StandardCollector.Service.exe
3276	DiagnosticsHub.StandardCollector.Service.exe
3276	DiagnosticsHub.StandardCollector.Service.exe
3276	DiagnosticsHub.StandardCollector.Service.exe
3276	DiagnosticsHub.StandardCollector.Service.exe
3276	DiagnosticsHub.StandardCollector.Service.exe
3276	DiagnosticsHub.StandardCollector.Service.exe
1076	elevation_service.exe
1076	elevation_service.exe
1076	elevation_service.exe
1076	elevation_service.exe
1076	elevation_service.exe
1076	elevation_service.exe
1076	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
Token: SeAuditPrivilege	4824	fxssvc.exe
Token: SeRestorePrivilege	4924	TieringEngineService.exe
Token: SeManageVolumePrivilege	4924	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4632	AgentService.exe
Token: SeBackupPrivilege	4572	vssvc.exe
Token: SeRestorePrivilege	4572	vssvc.exe
Token: SeAuditPrivilege	4572	vssvc.exe
Token: SeBackupPrivilege	2324	wbengine.exe
Token: SeRestorePrivilege	2324	wbengine.exe
Token: SeSecurityPrivilege	2324	wbengine.exe
Token: 33	1480	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeShutdownPrivilege	3668	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3668	msiexec.exe
Token: SeSecurityPrivilege	2892	msiexec.exe
Token: SeCreateTokenPrivilege	3668	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3668	msiexec.exe
Token: SeLockMemoryPrivilege	3668	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3668	msiexec.exe
Token: SeMachineAccountPrivilege	3668	msiexec.exe
Token: SeTcbPrivilege	3668	msiexec.exe
Token: SeSecurityPrivilege	3668	msiexec.exe
Token: SeTakeOwnershipPrivilege	3668	msiexec.exe
Token: SeLoadDriverPrivilege	3668	msiexec.exe
Token: SeSystemProfilePrivilege	3668	msiexec.exe
Token: SeSystemtimePrivilege	3668	msiexec.exe
Token: SeProfSingleProcessPrivilege	3668	msiexec.exe
Token: SeIncBasePriorityPrivilege	3668	msiexec.exe
Token: SeCreatePagefilePrivilege	3668	msiexec.exe
Token: SeCreatePermanentPrivilege	3668	msiexec.exe
Token: SeBackupPrivilege	3668	msiexec.exe
Token: SeRestorePrivilege	3668	msiexec.exe
Token: SeShutdownPrivilege	3668	msiexec.exe
Token: SeDebugPrivilege	3668	msiexec.exe
Token: SeAuditPrivilege	3668	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3668	msiexec.exe
Token: SeChangeNotifyPrivilege	3668	msiexec.exe
Token: SeRemoteShutdownPrivilege	3668	msiexec.exe
Token: SeUndockPrivilege	3668	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3668	msiexec.exe
3668	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 4916	1480	SearchIndexer.exe	111
PID 1480 wrote to memory of 4916	1480	SearchIndexer.exe	111
PID 1480 wrote to memory of 1968	1480	SearchIndexer.exe	112
PID 1480 wrote to memory of 1968	1480	SearchIndexer.exe	112
PID 2680 wrote to memory of 3540	2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe	118
PID 2680 wrote to memory of 3540	2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe	118
PID 2680 wrote to memory of 3540	2680	7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe	118
PID 3540 wrote to memory of 3668	3540	VCREDI~1.EXE	119
PID 3540 wrote to memory of 3668	3540	VCREDI~1.EXE	119
PID 3540 wrote to memory of 3668	3540	VCREDI~1.EXE	119
PID 2892 wrote to memory of 6044	2892	msiexec.exe	130
PID 2892 wrote to memory of 6044	2892	msiexec.exe	130
PID 2892 wrote to memory of 3464	2892	msiexec.exe	132
PID 2892 wrote to memory of 3464	2892	msiexec.exe	132
PID 2892 wrote to memory of 3464	2892	msiexec.exe	132

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\7f4ca4c48ddb9ec4bbf17f305de42fa0_NEIKI.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i vcredist.msi
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3668

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1916

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:552

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3240

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1516

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2984

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:432

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5020

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4104

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:888

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1100

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3696

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4932

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3432

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3856

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:212

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4916
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1968

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6044
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2EF94F26E313642C95DB0F2AAC88E2B1
  2⤵
  - Loads dropped DLL
  PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57956d.rbs

Filesize
27KB

MD5
8e35fad701f8dc648c46e415b50b7ecd

SHA1
0ed62add3b18062a0373ff6eea6aa0e90227262c

SHA256
8795909daaf775c73dec06715b6a089e67665c6bebd67336c5f4528b6233ec33

SHA512
da3153d50d7c7fb1f733c848abb84161ee9e672d5feee2f8e9fa51962f9fb87b97dd156d2d6630d61ed82875b8a173faff904667d08b5779a2e683fe90fd96fe

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
f22646e846d09ecbd0243282cfffc952

SHA1
1667ad6ef7a1a3e2e320ecd91fc4ac5e5120b53d

SHA256
17fbb3b8b28028ec6fb44731fe99648bbfba79c53c33118b6a026b86277871fb

SHA512
1ca76e0fdf40e7f733662c1cdd6c6b55759bb666dcc8880a5d75905e0a237313e85a297d4e30c962afff37ab33000bd7a79ecaf606d820e4bea49d50e4f2ff08

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
789KB

MD5
385788b935238a02456d72c34b49e76b

SHA1
cf033d41b111aacc0f47b43d82436036106074a9

SHA256
0cb0571ebb72657c7406f0688ed8f850eb03fd0caff98fbc7b75b8b7e3ea49f6

SHA512
df2003ca6f23d8270014f0c04be39db9aed8b3287c4ad14819340977516ffe8bc819b33511961b75876f9f9d949c3cf505b18e7d5761e86ac55deb40170c6f18

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.1MB

MD5
4f8219b3607f1cbc5540319b0e1df508

SHA1
1f899517510a9e7c38d0f3e2e22cd3d0c830317a

SHA256
e54485221a00376cbe473a5f86d7b2955b01e34f861343926f2d5da71505fe51

SHA512
dac279d12032bacf002ec03df9a8703a43f8a735267df832554b47837356f028bc779b9d1e4d2447349a0c8de47101e03a5f14221ae0b9fb8850eb4404c28b97

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
0ce06a4201fb910b74dd33b2adfb1077

SHA1
6d7d680ce27b2b7d04e2846d83ad6aac42fc5631

SHA256
572516848efafed6c20f90d6f662541c078fb693e7b25f9dc33563c3172e7eb4

SHA512
31187dd762c01e7d612f2066a53a50fcb0d5cc9bbb7d0eb6b4757e022ae7f7e43e5c11698398a1d4362cc269ef83c45e111bb21e1f96392f227b2547e90fc54f

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
fb8ec16a5d5a67012aac29726783945d

SHA1
0b73e03e35252a9427f76d09da809d15326dc194

SHA256
76bacd209243b992d5b142e8173952951cf0e2962714674111c3fb5be8c9ae8d

SHA512
80194e99fc5e634b83faa616fac6df884f2b757c151e04ac93ce03294c62ab4002c038233d4a502d75bc3ea30a3d230203bdb670faae2508b307c61738f1e538

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
582KB

MD5
bf68b587affe7a0abddfbac16afba8eb

SHA1
ce9c4957070805ee42519f66604182659aec1042

SHA256
2205ff0c518d7513ab5514ce8fc4a5edbf307415db213293b53c2b8acecc2f0a

SHA512
3807c32a232266a8aed87a751f3d7ee0225907baa36c5188173966012d2961286a25609782d1ae434b57d96433f17c75d6c4ba7e85136d5a752efa2231edb6ba

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
840KB

MD5
2b79887593b083c154690ce60d5aebc9

SHA1
c97e5eabd1d2a56822cb8bd1769dc3d4cbab7486

SHA256
92a73ac525df915f93775f6437e0b8c6aa4603f22053064b4920f1f660174d98

SHA512
4835f14f951fc5546e877404ae7fa504d06fc97c0688d84a0be656102713d613c14f7d5670996fc5ce6d7c8e9161b1718478e2076973a53bc14f6cbe657a7a56

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
8d613c1130aa8cad042ba8a47aebe9dc

SHA1
eb2c1b3a8cc4e370b44c854199f38431cf173fc3

SHA256
ae6b93d4c5dd09ca08f8c5ab3d6e3805f7800dce36a33649bf90a4348d472dfd

SHA512
f5cc94c1462a31266602468a7bf29562b378cee94e124378b34ec4038815f114def2ae1d992d1598ff32d693772b1a88199edd6ee6b6ecb34b58fd574de4f775

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
910KB

MD5
c1fa35b136740e0e3f2d17be4a2dc938

SHA1
0649d63a1fda22f00ccf10a39663947753db8054

SHA256
534843d6b1f6f6b58db57a934e9eed0944c73d897ba1fe70377380c3e9c7bac4

SHA512
39a0e5806049dc57b75cc3a92e69538c88414ed8616a8e20a2c13b642568556a49121b029a6b29185233b4d5c69c126f55b02000a8fafc233d94a4f1d8ae9bcd

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
5006cb723feca9e3cbd68a720afa200b

SHA1
72018eac0dae5ab43fae15b3513d770e58941a39

SHA256
44d5ba5fa22c52b8174f9d6c1bfadaa02ab8bca6e48d3c380463ff21aff34fe0

SHA512
d62482a43812585918fe4e419125bdecfabaf3d844657cab3b42508d0f870a8ce3027e13632eb095accb9d61c062053af0ec1b5b45f6bf2d7eeb7934cd6add1b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
c6182dbbb30578d6ccd33bc2a599b96d

SHA1
964857fb7d7a253de9f9d42fa980a83bb79afd66

SHA256
3b26ca71061716173fb3c12661b7d46ba8e4a3795cb0cecb2f995f72b677594e

SHA512
a50920f232e3df3eb0fc53a34c2a854d51557a42587c7c72214bcc03946b1b9041c2bcfee184e6d51022fbd18f6cd3838a636274af437382e5b8bfa7d99b61b8

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
8910daf93a246c331fd76adabe943e53

SHA1
3a3f05633eea1d3d59417727485a31a450e69dfa

SHA256
8c07ef94bf9f1168382ff89c6257fbc1db7ddba93358fa2eb8839027a9cd672b

SHA512
bfeb46ce9a2d9e49db2b384a0010efb603a2f3dac482cd2ef08d9d0f2bc9f61e7e67d2701db6004914a3ea3aa5949454d14f7b10399a07f247d2ce8c06bd05c3

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
f8052a3319752f37b5ee73c64cb00926

SHA1
abab84ca4873767f64bd6d41ba066d82217e8041

SHA256
c1468f5918efba9525d9c0d804d41517a1fbc94a8e0ad1914f049136314fd415

SHA512
9bcf9dfa1d1ac312cd628a4d6e7e39ef88f58d11ead4ab1ff5355a57cc2b68a844930dd5e46c92acfa6a63671916253d4331302a103a7d4e75aaa26546428cb7

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
656KB

MD5
cf8b4b91203927701094413199c9c135

SHA1
dcbb8c601d03a2f252892299b60ac61cb45212fa

SHA256
71aaaccf0d01f758dbf49185f02e5ab53a351c9709747225c669f8ce04c711b8

SHA512
2d139780f1c9c917aed2530bcd1db866fd2338a332137184250e4241c14310371468acba7515fb1d5384de543574eb78c838563133ba9c1a0ed9cd00bf3525f6

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe

Filesize
4.6MB

MD5
21fa37c9ca4523f1ed2a70af963108de

SHA1
b6ac0020b259ff474d15e5c1efc022fda0f3a589

SHA256
bf774bc2a877ff0bc52a78b47dcb5b201463778f0d1b6269ce56e74992ac1cbf

SHA512
c77bb3c3234c8b5a2809ba9364e22746a26a6bb7e342b0fef5cfc11a5df39898e93204231b3a3c01cac8dd2e891364177eac923bc08bf75129ee7822193c777b

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe

Filesize
4.6MB

MD5
97afd95e8fd95049b7de2c2f9cb096f3

SHA1
f1df240af8b21df3766a97f14452f1978aea0eda

SHA256
d6829f1c1a056e824972074a795f5e604f1da2e71156e8189d35cdb7c77a3058

SHA512
334dd1399a0edfbac5be5964b70e263e6b481d579f6b0d39de2b5fae13ca26a5667b92655d1d570803e4440ad19c800c48241206dca81df30fd4c3dbc9889474

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.exe

Filesize
1.9MB

MD5
c979dc7f91b0ec2ef80ab27db1263c3d

SHA1
852df93341eb72b8f36fc479faf4057b03583a19

SHA256
67ad5b3729b165a62b9311712ccdbdc0007f9d3bc7ffff7bec4e67c12b39a33f

SHA512
64b12cfbe35bbe824bec91a9180e8ad9a01579a1fa70f7fb461497d0e590ed478b93ff134660d3e5806f106e56f95af4d5668d973b1dcd395d838a5eb75ccd6d

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe

Filesize
2.1MB

MD5
c037c4c20ff77b4a4b11134817429cdf

SHA1
79de01e10c53986f972b86b455a34a297a03a57b

SHA256
7691f2eaf4b6f661bf3cfa213cffc4e905a4541b253676f4731067645f185368

SHA512
eff5fea1dabe319f9002f5abaa9d8ebb56c46d99da693ddfbf08ed8e5325e4d3fc4dd8afb30a0ece1aaf7ee24bcd2ca84366112d744eb4c706fc0f8105305f28

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.106\notification_helper.exe

Filesize
1.8MB

MD5
8a0ba801c98ddb1cea8744e7343d7208

SHA1
681880bd774682173e1b88160515950a2be0bde5

SHA256
6d9aa24782f567c8ad81c3e0da1c53898d975b5258434cf19d648dde76b01d3e

SHA512
8361f6e014cc3ff405297cc77219da5da8014aa02bebb0ae8c4a5bd234a9f8de1fa169705f3379f410a93cd2c65f689f0ef5bdf079b6a8d48abd3d30cbde2877

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.6MB

MD5
750e92d9643478203e3d449e02a8cc18

SHA1
9b08835c48cc20fe7fc2a874efb760de3d1462a3

SHA256
0ea4e1f916000676597825ff4e45296f10d004db923382db76e9c4789bce897a

SHA512
f62b96a07e44698ddc6f5a68aeca9d24c0e3e808115f4c096fa2519d61e9b8ff81fcdba0313450c9419893ee8b674e41e2dc8118ebc577fc7062a38f22f5da97

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
581KB

MD5
1f97b925713dda9ac0549d9c698f3dd3

SHA1
1fd51f8a3cc98707bdc236360275e79c572726ad

SHA256
94b27e2e51ffe850d84a0cf44060b04d9100e62c1c44bc2a482a48604cd3a91e

SHA512
2233f00a2f1e90eb4708684356e26699a723de289d6525c39aeb25999587fad117fbb228a3c86484226b203195ac1a5660dbf0cca4042f3d9707054b33e4cc24

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
581KB

MD5
f3d1fafe912852222e2bf2848b60abfd

SHA1
0839f5d32f9607d21f7a2481e596713b431cfc6e

SHA256
8cc48472565146fca7226c14628ed0fc6d8ba102f3b4d32947868687f56aac5f

SHA512
5c71375bb27a555f41a1a67b52de6e846dee72ea2bd91141baddb3d66aded80a93bfb23d08f93b4383f43ecf1fe132b5880fffe26347be4054edde3a4810b203

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
581KB

MD5
258c0a1e5c4dc5555c26df81ba00fd86

SHA1
dd6f784cb29671b669f11aec085a7bc0bbca09ff

SHA256
a9078f977b12100e1d730759df2574549cb7d068d3e75bb818c64915a4f24d59

SHA512
3f719ee53ce0819ae17175e4e907836132351eac86687503e00dad601eacf72aba4923ffa50c4977b9403d0cdd28b3052453f00d7db6fe0120d56622e6f2d329

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
601KB

MD5
58e0c81404144da730a42c38278f0f94

SHA1
0b2e473bb74f5764ed641299fd194975ca217bf1

SHA256
8ff90b56097ee76a1392a19408ee4c3ff37e949b5b469b240f9cb4d477f8c970

SHA512
e286f6eadef851fbe19734babc2c76cd7023e67064978387bf290b8ee9858c92768dc0f176863b17c7617f26103233492337c9267905005d95162e272f4b7642

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
581KB

MD5
be902422f2e0e3b9ca9be65d89b89dff

SHA1
8e807c1aad5d46f1048a006d10db1b372db3bc94

SHA256
f3cc3bb45ba4e5b72183f83fc5968298e6390678d5056d4b9bdd8aab955b8f94

SHA512
5075fd940701a6dc3b869c4fa76b59f3f77c3965d9d0db78fe2c846b34fc94af2e63268515828d7ed9c36f8053132c5862284a94b70defdc1fa3f6967ba0c280

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
581KB

MD5
0864d40c12e22ebde613a6113b96657e

SHA1
02fd310a96919f40c69e22591adab51dd23613c9

SHA256
f4d86673009ae764928e547db77607e5c4e2c3d7258a06ad15a087a22b96613b

SHA512
3b297f374d6d703938cbeb8f0d8ff828719c4274d07f98aed7617f7398319fd71d9c8caf25a996c8028ab8b08e6583931aef9ee63495ee0d0a715a8838d31f5d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
581KB

MD5
f2de9114fc9f4ce0996454839e63cc23

SHA1
30c93e3e317f7a227df1647beac87f92a559a483

SHA256
7f13f18011d0b2c26288738677667665c3327b5ad374cd4c1b27a288603c82a5

SHA512
f7e0304f538c1fb4bfdd153a50031fcfa66e895ecc4ce887c5953a8ce2de3ad4d04fb3c993cc38222063475d58942fd734d48710f368e6f94943e37275b77fc0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
841KB

MD5
ad9a72b754458ca81a0c269c3830d2f2

SHA1
7783b29811ed29615e7c5a426b381cd0dc3470e0

SHA256
5941c5946316dc315611766301bd512b54fea81f7e678d2de660855c38fd4c85

SHA512
32b4b23c979f4d1bc440f036fcc91ab95b94f571af0320eafbd3dfa8713119b8b4985e691f769ba9f487296f683058618f8b55fd6a791aa0391cc224c03a458d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
581KB

MD5
cbab4529d268f387039747a5f911dd66

SHA1
e01e2d72ff60c3fca8e8b26fb0839e41a27db033

SHA256
ec0382f3a285c0e6e36e76f53cd99159f04e91c14d78515a97208e57fba75835

SHA512
8d71870a9ccdc4f24e3d5db57e75ea777ba7fdf37903aed592a4e7fa9af635fd46e3891d31148b2745a9731d4cb1abee5623afca1ad3eac6641149495bf9955b

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
fedd1438a2bff08b996cb23daba72341

SHA1
acaf2b3b40d8bdb9deec17155d2a39a87d234e21

SHA256
a7190275441294d20cacc1f86618611afdd46e811b850c76471fede8aec65fca

SHA512
17fd97c2a46ced4ecccdf8e934c2d722fc3454b0069a6acb747bf073d5ecbc27e2cee8f600739ffd469a72fb7155801294fe70d0ee073f06d0dffbd0787df1aa

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
701KB

MD5
a6ed3635b7cedb5925a46c47702c1b74

SHA1
5d64309234fcd0f737d0f89e9b84c85b2198dae8

SHA256
0203d2fc7ff058290b266a495164d54f1c3253b613cd850507de883d20582b46

SHA512
ee236fd19256c5c9a14365d286532e5bdde45cd19977d666d9f54e72631454bf440cb8068d455a0f7acc354448b7c8756f36b5c3f0dc828888e1af62aed4fd7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE

Filesize
2.5MB

MD5
f031c0d2b460209b47b91c46a3d202fe

SHA1
95040f80b0d203e1abaec4e06e0ec0e01c507d03

SHA256
492826e1aacd984a00dd67a438386e4de883cc923cb1f25e265525a4cf70ed7b

SHA512
18840649d19c5310d274bac69010514872a554bb5ecadb4af5fa3667ad1a6bf9d644b31393edbc1b60ace6eff907c79c078f8213948cf90fa4d1529c68ccc629

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab

Filesize
245KB

MD5
00d3bf1c1e82eee48fdf3361dd860e19

SHA1
b2f45cd2791ce178b45b06a95e7f58f298512d6d

SHA256
f2ce7873a39f7f8a2a2cd888a6b2f0a25f62bb3c475ee73cfe54988982ef65de

SHA512
cf5c06c4052b103d0a339d5535db2d8a9f069e928ee8c985f03e321b7e1977ff2f2200ad15671d6e93b9c706bea7586cd3df11fdbaaaf8c63a0ea4291431bca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi

Filesize
2.4MB

MD5
b31b234cb0f534069ba32aaaeacd7b2d

SHA1
d6f90459f8bdbf7e75cc85affe9b137dc5e304e2

SHA256
b5a652a1025f194f59e1349a1f26709d7ff7760067439b2d52d988a55d9340f0

SHA512
138cb14f6018d3bddd78012c5b36a591fe70d1b2b7f9d3774230639302401be57e1a4d6098c66a83c47e67138ac6dbe79f64548e4c317bb804a4e9a3ffdf94ea

Download Submit
C:\Windows\Installer\MSI9700.tmp

Filesize
24KB

MD5
7bfa56d222ecc4267e10c01462c6d0d9

SHA1
9b3236a45673ff3bb89df3e690784b673ae02038

SHA256
6eeb255e1d5333a7b4f1b62e36afa1bea5cfd6c7e32058bb3a9efebc4d9f2ad6

SHA512
10cec6bfd08a8b7cac1acbc3627cb014554ba71f44eb4bfe5b1471b81d6d292fd83a352d553af0de75fc1668a1f13d7f6f6c7bf1c6524117f363a3a7fc9b09e9

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
a62e1ba3fa5d8e807856f61f278f7819

SHA1
317b49566d6f6a6d6bfbffbed632cb5b37224479

SHA256
811884c14c4fdaac13a04a255f77c081a97f22f52aee6c21b4aafceca6ed4fea

SHA512
e2cfb374b3108536d231b40a584f1aed983508b830711714d2a72c6b13a0977e62343685fde332735e9d17c1f91999d6c37a260d59360f275322c1b3cd197c78

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
9bbec39f3325d1dafec1b2d40803673b

SHA1
0728641cbcc0304d27cf21dbdb99e60da2ed7a5d

SHA256
eec87a65410d7f1bd2a609897ccd4e1334ecb9cff3484917d91c2dd90cee3017

SHA512
aa41f303350f35e361f959b056b7525da166c6b706662a79aaddf1552edd0c8a00a278dce825660c8f67cb287da5b046d8c538757c852bd9ac73aeaafae26b26

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
754fd2d8561c6f019028295ada80cd04

SHA1
88d52a5cb7be32a60a0a9b844a0c4691339261eb

SHA256
399946eb1f51260f8bafb993ad2161f1c5f20c3f439dd17af9ae130d60acd0ba

SHA512
ae8ce09121602aa476fb79188c1f816eac519e4ee945f28f297b81259434cbf11fdc4217dd1010a18b6f73479e78d9ab8a71aba6aeb06830b35d4a37940d3dc4

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
5b8b3e546f22a03308619475e2723d23

SHA1
3a76224a5f70c3be536d9c3ad5c6270699b5beb9

SHA256
d363d7f1758cd40e049dd3a1d96d1329f7248741a71d31e7b45bf6b31c03046b

SHA512
cc767f743a092836ec15100060aa957b6ee8a89aa9bcdc49629a4dd1ed6140c814fdf77aa2c9db7073bd9035c953e8fb7e2c2bf54533c8cb091b1dcad61f5ca7

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
3cbbdaf24a087c66ae87bfb9ee0456af

SHA1
43cdecaf1ec4790a43b12794b05e597c23650762

SHA256
78ef29bd626317842e2c153fff323e4cde3475442aef7897071883174eab8e74

SHA512
dfd193de7cd82ba168c2d502248a23401cf281b273809065d7cbf95af027e6c7eb99013908871b8588987df1cf6e274756b46cc1f003278225a51b96bede17be

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
3ed4d7e825a6d4fd49e7f9940a014184

SHA1
be429d5d421d735785e54e8d02fd6bb1b3af7399

SHA256
d3299506808b92e53224ab7609279a00b76f68bfe0225a16f1451f0b22a1dd08

SHA512
4e670771b4e2196ec63774360019654d11c4d6fe3e4a8082b3a385836d7b927a28552ac75a610718819a7f383809a3db375b0d1b710e8529717c648fda073fb9

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
b6461c8c9a2f5b1b36933bd109784967

SHA1
903c66e86b7758dbae0ba47977af48809b620903

SHA256
885888617aef138676af3aa9d3d411e06fd1bcbaba383b9b75f08ac9d1352aed

SHA512
659fdcaf8fc43202a816119a84ac1a14f5ab468e9afece15aa6b0fd442e6d25e5c1d172a2ba93d32616a87a21f3c3cfdf4e62755d7ccf6249e1249d58f50fdad

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
146ad828dc1c0f02a69febb8043c9c99

SHA1
499fd75be0011ffff263e82c24ddd0b6b8a261c4

SHA256
46565d761ac0d9bf982dce629be591dd14af973e974ec164053bdc737c6b7438

SHA512
78680495bae32ce10dc1cfa4053bf712a5951461c806728d7bfce8d53b7b388622199a90bcf20e36f2a9625ec437ba082de3aa5e3a91698db21cbdcc777a49cb

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
797f7f7bcbb54b79c06bc00f286a632a

SHA1
deb49fe2d908c9fe5b120f8c8fff060142168dac

SHA256
0906d1ecda56d85917fcc2febe5b09d904d0d9da9857caa23f3eae5989e0b484

SHA512
6ce33941f5343433ffd1608a8558f5ab35b9cc092a613ec645426e27ad69b1abff084814da8a7d974c9c8265d4f447095e95e7c9941f73ef46eafd62873e4226

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
b1309ea7d463204a1def877d00eae239

SHA1
930930dfc140cea3e5e207c9d2218f69ae42ab09

SHA256
0cea8b9eb8b304fb780c43dc649cf636c63b9096860b8093a239a1df4d511e3c

SHA512
3e25da317d5419709ad46773201eeff2218acc19cc102f96c29eba3ff3026644c9dfe4768a27ca097cec7f09e7008ec1b67968d1242323f668db5f550feb10a2

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
20cfaf116507747a3d43c08e729a0a1b

SHA1
79bde8680916a82e1862d10cadef21f5dc501ea8

SHA256
60f7a9e3f52e346d9b78d22b73597adc375673d79ca6be16de4c02f646773bb9

SHA512
fa5f2475a1c1347541c57d907b02d9ed995196289bfcfac21e19a303e35444b1c49621035479313b5b5bcb6c08ec1efc74d2ca678950d62a2326365e3b6689d8

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
bd6f5b6480434d8f4ca90ffd2c7e8a41

SHA1
db344d656d8f08d01cd7a4e40ae4402b03100407

SHA256
81e09d84bc2d75ce0129a391eaf1f25fc2b35698f3e45728b380c7c33e768e99

SHA512
bbc6ac230a67b3fff80ba3683390b1a22cb1fb1f369ce02447fdb30df4d1824299b94b14d1e5ecfac3352b8e003b14c58245ef426fe6fd132b9c005274507e72

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
129c96452a983aeaec9064eb36cc1f9d

SHA1
d3e728e70e7aeaaf9457479b746d646d49d87662

SHA256
d66cd4505ed8178c18aaa70302476891d23348b41e7125497496609e88b935e3

SHA512
cfb137e10193f637321244a1087e3c859b3c2fce4019299b19867ce4db007a92014f21c0d25a9a94a02c2a6c50d65fe8c2c149ee00d84579280606cf7049bf5e

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
be94f0c43d411f81bf213139e212c7f4

SHA1
7cdb31605188b6c34cac22b7a9dfee5c1acf3ae8

SHA256
db159a37e01ad1bfab44a48db6bbf41df78214e28119b78f3628fa0e93f59202

SHA512
3496fc41acd187ee5f62bc6054d6f86466448c3866903a393f29229a48d073d6b27f46a00a9d897d568f1a277b69e5af6642700a96bfb69cc52190c8f6908665

Download Submit
C:\Windows\System32\msiexec.exe

Filesize
635KB

MD5
34e6d824629bd99529da1f81a883fc13

SHA1
525c80ae165c15f9e88ec37a27da70a5a6cd671a

SHA256
3fb51a16be16d90f1a2b55e42d8191d487bf2cd9a53c56d1babd224234c2a026

SHA512
59430ca7705746f8361b51963123d2981bae26f4f026e4a31a2e0aef2de2c7c9136a1efb61f019c96364cf78563eb5eee7e436c4efff28d087993bbf1a1dd2b4

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
746d293986b4c53f3c11a647a7edaad6

SHA1
6d7dd4582ca798375a195d649edfdb12518ef07b

SHA256
3136a4ee80f4cc867e8da6afa2d119b53b1e8bd155a662f29a4bdbd090223b33

SHA512
6ac1da329e1d14bfe6dd9bf6bf0ea9acaed2ea38f32febcee82fb057fa721e000122a331b0e77f911d32ed2ba229e1f07979a77782c37630875add4bdc85a064

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
818e7d0b6c9e828a7f35bbfbdc2547af

SHA1
fdac3e3fb5d7aebe2ca6e103ad8e00f508842e6b

SHA256
b94c3de6f729e42aad04bac36d836e6fb6e003ff81cf97e947202fc97905fe2d

SHA512
439b73787fbffa5aee41b73e04990731d90efe351bd5f2578b5dfeaa823d426e2780bba6e018c90444abd4879e6371d45836f201adbe3cb963eb3df4d5ccbc9b

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
34bafbecbd996862d0dde523f6765890

SHA1
f3e0acca75d89a6851425013e27556bdad9f2bfd

SHA256
07719ac215d39b7c4f650810f0e227671573b9ba3c74ac82c212fefd009dd949

SHA512
4544be2faa92ffe7002b00342dfce37295b2688e9d92c724f31a5310cbb83e8ce5a53c539e4590c01efa6ceeb90a094a891eecfcaaeb15885a06d5d63546d174

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
a06ff69dd44b14a9919c8fabe62a5f1a

SHA1
591577afc89cd1378629e071e64bcdcd0729245f

SHA256
20ea66401b223beb221c41a8ab3a9c189eb3ff56056da6b1430270814edb2340

SHA512
9a4c8801710d91561f477e5d3a81f7acbac7a11ce92d32b5a7fcf37048032ee37512f2c91f69a919760bd2b2c52a43937371105fbb773ccffe5972d8618cc8b5

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
1d50ba551dd0de530dede5bcdad4ad4d

SHA1
b4e5ee17777a66a23b191135fd976bc576442da2

SHA256
1a17fa1da81933fbb204a49480b92aa3720b171ebc94f4c9463e93c311f9c561

SHA512
0ed2a0144b3d8f609abade8954ce10ec1895ebbc9fda4c4213b0e0fc929d9eac3b23229459f73ce8bfacb0b955c7c03fbf669a857a55e195f39f2360df1b3c7b

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
877KB

MD5
e1d5135f68df58db569a3e7bc2a3f9b3

SHA1
f18977b79f96b12fe3b2336418c5dc4fe9e5e0ee

SHA256
4538522c9d5ef6456d0db54eeb8ce9453ae868d4878a6300500aa5c028b6cc19

SHA512
3fe0b56fe0cb91fd6afcea9c0c4f4131aa9aaad359c97eb9a844ea4f433dd343e32092e6f0c6ce00ada10a676a17516ae22c349a878668bf3fd340f11e22e2e7

Download Submit
memory/212-438-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/212-165-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/432-79-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/432-75-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/432-380-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/432-86-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/888-151-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/1076-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Filesize
384KB

Download
memory/1076-41-0x0000000140000000-0x0000000140234000-memory.dmp

Filesize
2.2MB

Download
memory/1076-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Filesize
384KB

Download
memory/1076-372-0x0000000140000000-0x0000000140234000-memory.dmp

Filesize
2.2MB

Download
memory/1100-371-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/1100-152-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/1480-442-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/1480-168-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/1516-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/1516-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/1516-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/1516-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/1516-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/1916-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/1916-166-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/1960-157-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2324-164-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/2680-500-0x0000000001000000-0x0000000001320000-memory.dmp

Filesize
3.1MB

Download
memory/2680-0-0x0000000001000000-0x0000000001320000-memory.dmp

Filesize
3.1MB

Download
memory/2680-70-0x0000000001000000-0x0000000001320000-memory.dmp

Filesize
3.1MB

Download
memory/2680-8-0x0000000000680000-0x00000000006E7000-memory.dmp

Filesize
412KB

Download
memory/2680-1-0x0000000000680000-0x00000000006E7000-memory.dmp

Filesize
412KB

Download
memory/2892-367-0x0000000140000000-0x00000001400A5000-memory.dmp

Filesize
660KB

Download
memory/2892-546-0x0000000140000000-0x00000001400A5000-memory.dmp

Filesize
660KB

Download
memory/2984-71-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/2984-377-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/3240-54-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3240-50-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3240-44-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3240-373-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3276-24-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/3276-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/3276-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/3276-167-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/3432-155-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/3696-153-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/4104-150-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4104-99-0x0000000000570000-0x00000000005D7000-memory.dmp

Filesize
412KB

Download
memory/4104-104-0x0000000000570000-0x00000000005D7000-memory.dmp

Filesize
412KB

Download
memory/4572-436-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4572-163-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4632-139-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4824-32-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4824-29-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4924-156-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/4932-115-0x0000000000700000-0x0000000000760000-memory.dmp

Filesize
384KB

Download
memory/4932-154-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/5020-95-0x0000000000600000-0x0000000000660000-memory.dmp

Filesize
384KB

Download
memory/5020-149-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/5020-89-0x0000000000600000-0x0000000000660000-memory.dmp

Filesize
384KB

Download