Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 03:40
Static task
static1
Behavioral task
behavioral1
Sample
e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exe
-
Size
654KB
-
MD5
e5264505016723c2871b4cac2b4e4ad0
-
SHA1
d6a24af38e30423db1bfa89d7b4d36a621eb0665
-
SHA256
397bdf62dc4169783ad81aa391c8c95c74efb43ec36d47e115f3354dbd7c41a4
-
SHA512
4b1681053746bec5aec61cca70954be08e1e45b09d575055c413efe910406cfc8af879f2947531a68dc6a908c7719e85bd4baad9dedb5016e1169462e99e9e17
-
SSDEEP
12288:YZtY03JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:ctYX1SwPHU8X31PfU17DhZy0lxHZ9/I
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
Processes:
alg.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEDiagnosticsHub.StandardCollector.Service.exefxssvc.exemsdtc.exePerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exesnmptrap.exespectrum.exessh-agent.exeTieringEngineService.exeAgentService.exevds.exevssvc.exewbengine.exeWmiApSrv.exeSearchIndexer.exepid process 2596 alg.exe 3100 elevation_service.exe 3464 elevation_service.exe 3632 maintenanceservice.exe 5028 OSE.EXE 3116 DiagnosticsHub.StandardCollector.Service.exe 4620 fxssvc.exe 1344 msdtc.exe 2780 PerceptionSimulationService.exe 4560 perfhost.exe 3084 locator.exe 880 SensorDataService.exe 976 snmptrap.exe 656 spectrum.exe 3568 ssh-agent.exe 1784 TieringEngineService.exe 1440 AgentService.exe 3516 vds.exe 4852 vssvc.exe 4144 wbengine.exe 2220 WmiApSrv.exe 2620 SearchIndexer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
Processes:
elevation_service.exealg.exee5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exemsdtc.exedescription ioc process File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\52c0c35e293b476c.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\system32\spectrum.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe -
Drops file in Program Files directory 64 IoCs
Processes:
elevation_service.exealg.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\java.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe -
Drops file in Windows directory 2 IoCs
Processes:
elevation_service.exemsdtc.exedescription ioc process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
spectrum.exeSensorDataService.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
TieringEngineService.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
SearchProtocolHost.exeSearchFilterHost.exefxssvc.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a0c4524c3acda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa954e24c3acda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf4a0224c3acda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000a15623c3acda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096a33723c3acda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9027823c3acda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7e9ff23c3acda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
elevation_service.exepid process 3100 elevation_service.exe 3100 elevation_service.exe 3100 elevation_service.exe 3100 elevation_service.exe 3100 elevation_service.exe 3100 elevation_service.exe 3100 elevation_service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 676 676 -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exealg.exeelevation_service.exefxssvc.exeTieringEngineService.exeAgentService.exevssvc.exewbengine.exeSearchIndexer.exedescription pid process Token: SeTakeOwnershipPrivilege 660 e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exe Token: SeDebugPrivilege 2596 alg.exe Token: SeDebugPrivilege 2596 alg.exe Token: SeDebugPrivilege 2596 alg.exe Token: SeTakeOwnershipPrivilege 3100 elevation_service.exe Token: SeAuditPrivilege 4620 fxssvc.exe Token: SeRestorePrivilege 1784 TieringEngineService.exe Token: SeManageVolumePrivilege 1784 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1440 AgentService.exe Token: SeBackupPrivilege 4852 vssvc.exe Token: SeRestorePrivilege 4852 vssvc.exe Token: SeAuditPrivilege 4852 vssvc.exe Token: SeBackupPrivilege 4144 wbengine.exe Token: SeRestorePrivilege 4144 wbengine.exe Token: SeSecurityPrivilege 4144 wbengine.exe Token: 33 2620 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2620 SearchIndexer.exe Token: SeDebugPrivilege 3100 elevation_service.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
SearchIndexer.exedescription pid process target process PID 2620 wrote to memory of 3880 2620 SearchIndexer.exe SearchProtocolHost.exe PID 2620 wrote to memory of 3880 2620 SearchIndexer.exe SearchProtocolHost.exe PID 2620 wrote to memory of 4204 2620 SearchIndexer.exe SearchFilterHost.exe PID 2620 wrote to memory of 4204 2620 SearchIndexer.exe SearchFilterHost.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exeFilesize
2.1MB
MD5f905cec4aac273e8e1342c0fcd58f72a
SHA1e93c3f804375fafc52af02261dd24a076000c140
SHA256ffa2175c1bd630cc65ec9b80714a47f32ffc2cc2f88bf5f074e4f7bf732c79d9
SHA5127802521164183260e86235c0dace342b4d672860eb4fd298854d91571663d8c529de22daa082397b495e9fd2ec449313deb0eb358e4b2b66b9320db625e7cdf4
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exeFilesize
797KB
MD533a8d01fa020d437c54ddf91d97cb127
SHA1b60ee53b28d3b599b5b00ab27edccdc5ddfa2408
SHA256bf9dae54e0892832e2fcaf35266e43bcf61ab970b68195f23596e859217a34ed
SHA512da0c756a8240fe3bca09680f9137313c0f6ea8355015498f48fd860bbd9dc9774ef1633c46c6e65558042ed601d2e15cd45ee9ed706ecc80ff7b2c5572ddec45
-
C:\Program Files\7-Zip\7z.exeFilesize
1.1MB
MD59e19f4c43bc16082faf4745be39e33cd
SHA1deb15f8040a18175761c5bc3c37872bc3990468f
SHA2563edf7da12d8cbc4239328710e6b0855585a3281647986bfb25f0acdfab8fc763
SHA5121357dc68eab380e4fb6efb40b6b635e0c485cf870ee2a1eaa32baa5343c460515a7f9200af8e4d6cb16058d50469b69d35019b201033eef077fbdf08fe913351
-
C:\Program Files\7-Zip\7zFM.exeFilesize
1.5MB
MD5e380570aa791b6dd1b2107956e471760
SHA13ff278a4b5a45949110da1d9965815ecdd6343d2
SHA256a4b917c70aeea872353eb901534c24ea8ad0bf7c7cbbdc48786ce92f55bfe8e8
SHA5124a6fe1dd58219db40312d9258e1f0f917f89643e469b53be64724cadfc6db3bd7e051feca020bd08ef5846d069efcea9b18918efbc98926c9e3382b19a29867f
-
C:\Program Files\7-Zip\7zG.exeFilesize
1.2MB
MD5e07f73803b6fffbefdb707ac8bf18065
SHA1b35816d2348bb8698bc013f8451becb82a5ea2e3
SHA25607cc122fd4ea6fd6a1d9acbdded174f663a996ec676a35f2a27125816bc52b71
SHA5128ef016ceaef4356fc74784873529e2ccd924e610bd61518349c12aabd2ff775e68dc16a07073368b683bc93f1fef76e8eca6d4dc752e4952bd4f0c1f6e703873
-
C:\Program Files\7-Zip\Uninstall.exeFilesize
582KB
MD508d56afb1f71d435f260a25e160c8997
SHA1d7f7fb8202af21bb2f029d45ea2aa8b6bd77b106
SHA256347baf9729ba0e93849b4f7a99be8822c73ff34b42738851b27160e944617f1c
SHA51285f151f193c3e8ad5422d75f1add12887d353c23ff20301f3c77afa48bb3f3318f9675d788b3cee56e435908e617dbd69a051d01006885df29134dd64c56efd6
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exeFilesize
840KB
MD5601aaa093c7d6a64b2f9a681c8801a83
SHA19ed5bd66d044fdf0e16dc9dc6e2c03b1314b95e1
SHA256414621cea250b0e7925dc1c2c06781aa3ca70828189cb0d7a595e65714b616de
SHA5122738b55d5d38e9f59e7591f29559df94efec0864d8c1719809134a077ec038e827f5fd7f41e7e92ad43e4647453cddd4ac357e86c71782d45a960843499b7e01
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exeFilesize
4.6MB
MD5a1dba93152d935b2fcff878975a65eb3
SHA12d0d8af2aa6ca2e562c2fb51c2d5e6f79d14fc9e
SHA2560a4502bd8f106132956a932f75e91c4f15a1f063408afff84371d42cdcc44f15
SHA51251d93941b52140b278988cb6013a3f4ddf18ecf98238912a949f394e5857431a99f6c46400588d6d71eca60a4e02322b547004e0b9c88b4f61470c93537b1de9
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exeFilesize
910KB
MD513c8cf7b5d34ccf8f783be12af5f2158
SHA103fa886ab1079e404dcd3eebd596a151fd9b8348
SHA2569fef9525370e10f201a979d5348a6b3ac60b8efd8cf403286be2c926ddf15359
SHA51293e226c05c738a65439eaffbd9eae528675558f15b04c4908ced3631ed6de8f34df0a560750fa0b9bf95a3ba56aeb779c3d1ebb5e49c8549cfac32f2d3d01b22
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exeFilesize
24.0MB
MD5d12ab1803ba8a5fe0d3f20f4aa434fe6
SHA177042d715518dbf3fc2e07510ab2289daf6d2746
SHA256dd549d57d4159afd2189266d412b12fd1a58507226ae1017fe0c544dee565a8f
SHA5122b5f12493add76e67aeb266f95f541f71af6a76cb37de979464b78ca49cab91485ba8e0f57e5b2162ffe93f5b18673a71ee9db0882f3b7c817f2cb2346f913fb
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeFilesize
2.7MB
MD5ad41f583f1ece95468b540524bbdee61
SHA1e6e1100e24a7849eac3670582395ce446931ae2b
SHA25692538b5411be74ac4e0f560fbc7485e9ab1e07660e235c229a005e84c3ce2269
SHA5121dbe6537232cee55fbca3f3b95586d211d926a1687189f3ed62f74619726431afc3cac820daf4ef0e70130b4dbf4bad1c671a7ecd5662a7cb201d49c575ed509
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXEFilesize
1.1MB
MD5948669fb441275157eb9176db54ad132
SHA116e1a87af4475a7c803efba80084a88fdcc8170d
SHA256d27c10cf2bbed9e8f78be1e207a8152930a7dbde87beb32f66f9f6d4e145cc7a
SHA5129363c6153c2d361072c12e8afc63f64707efc1a44bc1d178cdf03f1e4dc2e1b6b0d306448b3119a6dc822b9e1b8f863cde923ec0ae5513f85a01dba3113e5df2
-
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXEFilesize
805KB
MD561cfb99871dfba9c5f46b0183528ff42
SHA1e8b23874d2f2ea33309790855776f6ab43003456
SHA256c07ca7b3d3e868bbcfc56820ef9ea4e83577664d83dc64aafdfb2d86b5b7f7a1
SHA512f0e6580faeeb98312db75f236ca7d4b715dc71aa68414034ee748458903c8f0eb27f027c0350afb6d6e02fff14c709df134ebc88c9a3e1d1f7ec5925157854ec
-
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exeFilesize
656KB
MD590d155058ea4921ae7e76fdc9f0eae93
SHA1187bc35fb7c96d063acfaf66e286e445f629dbc4
SHA256b480f0350923521e55458847f883a2824a368ba711b527dbea8ad08a36f06cde
SHA5126e1f06c7e894c65bb845254ba1b26d927efcd62e981526bd690b7e7c6e40043385520aec7a791f3d15cc830bc67f7ba8f786f149a91060394bd290eaa916707e
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exeFilesize
5.4MB
MD5f10014addefea652713077bb6351dd5a
SHA19d768d5dc2204e8321d03537f3e38b36163412cc
SHA256466b7bc274f8da44728e1cda6f8b79e3d1c336c07c6929aa600f9fbafa16d3ec
SHA512afd7a402c5fc2a8f70b0ec574192848a1c983f0a009a1d8f8885587dcc296cbed69be7330fa46f00602d3d1b1edee54c83ac00da6973ecf08fe383366668bbb4
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exeFilesize
5.4MB
MD5b2977b02654f6aa46b39dfc83766c0f6
SHA11d9705e1299b4a9fbae319e9aa4c8a912f6d4aaa
SHA25620d195cf5954c19e1f766f9011a18ed7803d76081df1dab0162d7822326aafb1
SHA5127feeb9aebf6ffbb941cd73d476bb90c4f6ace915c7e836af3b10943c68d778859c86868d23f83a52e356b3664cde3a9638b2b1e1889790c079dfc257f455726c
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exeFilesize
2.0MB
MD51661b3bbae8ddd845b857e2dfac96214
SHA1f33b7005ac03fc088c02921220b36c38c39321ee
SHA2561b3e8be357078f20e65cf31b66182c86350836b76f59ee88f26dfdc1952f6e54
SHA512c23f3741c53adbb559eda670ee3b7144d533eff63c17ab6289d5cb27906e1eaa9da2a41ef54a7580a84f18ebe43f0edb9604acd67927b5a2fde69184352e794c
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exeFilesize
2.2MB
MD5f40f8ba7f3d83fb6cdf85313070a0b95
SHA13105cd337380151f99e5b2fdb8ec6884ba911274
SHA256e1c5f71be354a9c4e922f88fd81be81d1ecdf4f6c4d085b51a96b5b73638f5db
SHA512c63f6ac49560ff93eb0532b212aade12a32a443c58675642b4db5eeae12a15ed11937720e2db38ac3dfa09206aaf730299255277abf1b225b11980cf5520f22b
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exeFilesize
1.8MB
MD55032efbd5e9570dab855202bdda9112b
SHA12f740f56f47dd0b123c558036f7764ebcf2292c9
SHA256a318fd66540b7866f587ed41b0bb6b3891f2a3704c85b389075af7218d60ce7b
SHA512868ff7cf3887bb23a14a48d9120c783ea9b496dcc4e705038ea380a2de4d74a7f7ca61e07e97d4c4033f7be0ed11171124340db8e26cc3957ae9513f82fb9415
-
C:\Program Files\Google\Chrome\Application\chrome_proxy.exeFilesize
1.7MB
MD5813d9be40ef4c9d4bf372fb44862cd90
SHA1b287fe7401a2daffdc14c71c3fd10425643ee327
SHA256b4c5e5da9caf21326579e8451c685584a93f03d121641adaf72d3a7bf6371e64
SHA512ecc3af5f7ca1465af546fa447bad6fce4cdc7e85e53d5f57e600dcf8f9320f9a5ee57a659809d4b771027db3ca5bd63c147438664ce8fbaca928c9d10d0e9b3e
-
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exeFilesize
581KB
MD5b24b53f8ebad574d26194f1194f327b2
SHA194741e9677914516ffc282304acf27ee2dacb707
SHA256047a9f512162ec138d4b02fcec5dbbbea0f1c0f9d1a72e2774dc43ab51e13df5
SHA51292c7b3005bc06eb76ba9a7ea0ba53d156b3876dc8ccf6ba652db24137eb62867f76790b2e36d87af0a491cc623f0a916a7ab873508b4db9988244b63b8b9a42c
-
C:\Program Files\Java\jdk-1.8\bin\extcheck.exeFilesize
581KB
MD53777a07b86e33455a7fbee3f7b5f1e1a
SHA13176171286c9854891a1acda49e6ee143e93b5ec
SHA2569003717f70998b69656dba9f4790595298f07614fd2b63c0be7b62ccef0751f4
SHA512e7c0d5e0aa48ebc8be59e7a2162f58bb4f71e907153d94be9603b08e9ba2070c2d16e02c15f699c78fa089d6a7a69ce53ff4012a6726d24bae5928bd5ed2beb7
-
C:\Program Files\Java\jdk-1.8\bin\idlj.exeFilesize
581KB
MD5f0cde2fb8440d5571a6d43c32d812b0c
SHA17ba60dbbd3dcbe8a6f6be705705d8038c4172cb2
SHA256ec8ae50f8e4d3138e9aca6c6b990844bb01d829c97308ce3d601ab02bcf7e571
SHA51215a0af237e8636cc058686d78fc3f20a295976425ab3309b3a11ec95c34e404704d3d811100d101e09c099b0fa35eec80bc4e21ccbbf8b878aa538b922917ab0
-
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exeFilesize
601KB
MD56041ae5c3bb1e2c31dbe7a955503a398
SHA1777c03d2821af5a19f45a91ed1e157b10a6e23f3
SHA2563f6927353aa7bf9ebeecf4c7283f3fa98b509cb39644154e84ce03925f980df4
SHA5121ef44580953ccd6d77fa6b0e257fabf47abd671cf461287af7229b5471a9c84cbd4eeacdc66ea23d4626dffad74123daa4bac5a38af1fc49eb6a26080e7cbe0f
-
C:\Program Files\Java\jdk-1.8\bin\jar.exeFilesize
581KB
MD5da25d3fde40d803b1bcafcc25f4b3051
SHA12dd3ccc83a0a5ccf3b4e78184225ab79f837e529
SHA256b41dc7c72dd4513f227dfbbcbe6e46f963b7e58ac1ca376edb9496f8c2b07aaa
SHA512bfbc022cf1f4ad9f86f1901707bac4352f8537b2ef5ef53171c3581e563afebdea0957338977b2d9d869292a8088b23c8766d019ae01eca1025a6e167611329f
-
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exeFilesize
581KB
MD5e29a0ec961f6609deb32ef5fc3e3eb63
SHA10ec9f9b36ba1584f341635f44600d0f967f3a7de
SHA256072ed2e69fcb128cb46a4800e6e2a897159a7d20213f05f23d092ba784369bd4
SHA512e974db8ccec84d1486ac4b96f7a46df6fd8c2b49b41ed2c0b5001c5a7c7ad53365f38b696088bae536296072b535e0a756c7534be922e9676b03ab9b57234bd8
-
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exeFilesize
581KB
MD5eab43a59ad9663772d2a248d4a03b440
SHA17faf872746472fa7e23fd39ba589ac9b5e6130a5
SHA256b645a24d482128e124421ce910708554db7e0fcb43cd703a23a5b7f8743fb852
SHA5127af7a77af6d169e8c20b7387ca55b0c39e7a0796a42b74cb38809f101e6f5f7a135f4b59a9311d7c8675afc36280e455faf2da803fa5165d2656441a739e49c2
-
C:\Program Files\Java\jdk-1.8\bin\java.exeFilesize
841KB
MD500a945cc44e7142880357124ecf8932e
SHA1f0948ea9f832335ef1c013a7f556639b637d29e3
SHA2564b6f9a44ef964708e9831b395dfe61c19c20cb73c1882ed11c60b3a9cdc125d5
SHA512046a1be4bf9e8c076669747d88fd6fddb0c8ddcb1cf19c9d79486421db129ae848698523c85eac3bfd0934c0092bac220b39202af7642af6aca3ffd508543530
-
C:\Program Files\Java\jdk-1.8\bin\javac.exeFilesize
581KB
MD54160a4de095106233d67e24ea49727c4
SHA1e4787008fed51f6dc06ad0971df3c439b71ad0d5
SHA25630d7cc91a938e314cc34996a107393fec3bb39b81742b359fe9bd87805d15967
SHA5126cd279ffa0aa294ca7fc60a7cdb0001cb68c35529cc169baf7a2c82ac62096d5d6a3ee38440ddef9bdc20c7f854a420acebca38164c9bbd584d3af620eda51b0
-
C:\Program Files\Java\jdk-1.8\bin\javadoc.exeFilesize
581KB
MD5daca635af6b14ba2fae2ce347f1ec3c7
SHA1088c2d8bb6863b8fc3438febb86448ab734d8705
SHA2566f0a55da63ee7b569e0e8086ca9ff96a6089f37602fd436c161a75a4cce709c4
SHA512ff24853f90435d0ee6da5e487b7dbea07d8f6412fbf04f235fd18286e98b105bb10f7dc8f15bbe1eb696109e8e43ccca9f2c8773127e9dc1f600ed2220efbba0
-
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exeFilesize
717KB
MD53cb65b54687fd2e32e43f89ac73da521
SHA124d827418215f48b47e851dd429f8d8e1b960a83
SHA256da1f4d2e747a32dc3932444e44e25c09eb41a3ad3d4289d18e991f4eafe57146
SHA512d11116bca2a3b93fcaec5fc8b4954a9794d14f775eb563e092cfe099338d768e4f596e6490c23244717e48b85093a56db05106910d7929790d754a0fa124734e
-
C:\Program Files\Java\jdk-1.8\bin\javah.exeFilesize
581KB
MD53ed31010d2827cf1ab602d6f3f4f0b2c
SHA1180850878a21315ef8f4e9d1cd1216ec9c724066
SHA256639c70a651e2dda113e3d267332332ab3d3771b4b2585e10285259e18f0b0848
SHA51233160f9f1e4ff0b7a7d5ed3c462442b16e7763d3d719195cd42a37eea30a742ec7d45935a1d9a6952f13f603eee36a654769da4d243916ad813447ddd9461345
-
C:\Program Files\Java\jdk-1.8\bin\javap.exeFilesize
581KB
MD5b914d0679fbc1cefbc796e33a81c0a9f
SHA1e002b5351bdf9c79c378d69ece1f8c61c0fe3934
SHA2563d0ae9deb5c29da235e8a5e6053ab7ec67eaa5e0494b938bfcd346d4d76ea1fd
SHA512cc9099de36b086834e19082d589f2cc8f3f32deb4586e3521c309d1709d8b7e9e30647f7561d1e044c37c17507701d5f86f0227dc99e95e5cea9d2e67354fc07
-
C:\Program Files\Java\jdk-1.8\bin\javapackager.exeFilesize
717KB
MD5cf4f34814c257f1f596f7dd7314bca19
SHA12f166fa9c302a00f7e99e20b26ef1253a0904907
SHA2566864a36e0a39c96e4013561ec8a961d3c6ac7216fec76a79006ac52c11cea88b
SHA51284fd92cfad341c8aaf078c5e21868ec9340a35d5de2babc646fd5275632a0aab5f3d77731931d8c04cf4bfffd7339fd0e60c0ad7f2d7ed03844aef85c622f62b
-
C:\Program Files\Java\jdk-1.8\bin\javaw.exeFilesize
841KB
MD55148d8a7047002245114686e9209d741
SHA19844349cce716c38eff8f51062e0ced411f1dac8
SHA256334dbaede9a1aeb39d89c384e60e506bfbba72307e911efe18a610c72cac9be5
SHA512b02511aac82999c37adff1cf5b277cfd130d451d0a9484c64e2b9dd9f84b8085cdb1d6d9278664425116294ad2c636f9432a91dad2380711300b91d5ca4a6aa1
-
C:\Program Files\Java\jdk-1.8\bin\javaws.exeFilesize
1020KB
MD58d489babed7132ee013befceab87fd97
SHA1df22dcb162d9dec5b00d2abeadd7523efd914b29
SHA256abc28ebcd25f17decf0999d6fad9fb913a93d098a6470664a7222129cafa0db4
SHA512b8e5d5f0b9140d36c50d4234137c585cbcf79ef816c6d9357391304dd4c3b0391e04eeb93f33662ed202b9227419821bab00ec6afe3e481c30fa8145cfbf76e1
-
C:\Program Files\Java\jdk-1.8\bin\jcmd.exeFilesize
581KB
MD557c33de074e4371b5f6bbcfd4601a1c3
SHA13c54113d6901a067fd5a654a7ad287d6e73b5a93
SHA2561367b2ecff8eddcf5ee5448e753e44122f488477acff7dcce94ac6f72018befc
SHA512ac44080590b370eb03f5c456f2027c6a696c19dad9991611a77dc5be23472a8996a43a92fdf80fb9353c4d26e53a515c81720687834ee5ee3ed01ab6324404b6
-
C:\Program Files\Java\jdk-1.8\bin\jconsole.exeFilesize
581KB
MD5f193c3c04c4f22520e52f191447cb806
SHA1e5d0b65f942d2dad2e0314c4f491f9c10e1414e4
SHA256462cf5431869bd0489164e1ed8cba33cbc0b91cd8547298235db0f4a137eac1a
SHA5124b8cbb88cdd82b529c038307f1e6a9859078ec89eab4e6f503b51e22d51ecd64ec8cfd1b3cd4760aea766fedde3f3f7c88d0e0fffeb0069189f407b4feeda710
-
C:\Program Files\Java\jdk-1.8\bin\jdb.exeFilesize
581KB
MD554ceb25ef89d054be6f25fe0428f73dc
SHA1e1e62374d2e9c67e322e46313dd7a787969f18f6
SHA2562fd93151117669d4a88b3a132eb0954090c01904b6b6518113118731d173d678
SHA512c60dc730a184fa0eabe35364e6491f2826be043667278b1bfc74cbe2167cea13b01dfc19c7eebbc09fc734199787be6cfe2a28969a5fc3eb6c77bdda6bd12ccd
-
C:\Program Files\Java\jdk-1.8\bin\jdeps.exeFilesize
581KB
MD50c35255382b33c40d5ae37c994efe69c
SHA11c9060cad30670483a6604508f96782571f68eab
SHA2564245fe3bcfc46f708b2f775a2e0434580df08f2f09e64799374f0312d566104c
SHA5125d4f5958f2419802f7de79f40d4a562dfee569348280a3e9c401c782d5a3ce75a1ee6a8c8d85e832d838d378b7e36df31c8761e47b8cac64e66a505a2f5f5db8
-
C:\Program Files\Java\jdk-1.8\bin\jhat.exeFilesize
581KB
MD523942cecfddc0f8a732a826bd9cf8fd8
SHA12c14439c45375569b02e858626f9121474cc097f
SHA2568e6d35e462512d0c66e9b1fb8299ed1f7132738163a57535048f5343e661e933
SHA512eca3441b7f9b1ffff043d64cc0077e9ef14f3bd4ec780460a3473e47c0c1d4bf4f6a9576cfcff0c5f9d3aaa60b88637d6b1fb3a66926dcf057f5dadf65847ac3
-
C:\Program Files\Java\jdk-1.8\bin\jinfo.exeFilesize
581KB
MD5df8049bbed1ef5530eb1205458a6d1e9
SHA13bb396d0d4bbd20c07afeaea7f1a2b9d019a08a5
SHA2562002c89c0b73fd94b3414147d0c52d478c66486146b5f254149fd29a1b97092f
SHA512d50c1d9fc690609f9323d6d605b9994a6ad279597440670720b4c31802a9ad7f5711aea489fd0977fab792b1503606c29e4910e94c01e918819cc1624813100a
-
C:\Program Files\Java\jdk-1.8\bin\jjs.exeFilesize
581KB
MD52ed6d88571b2fae254c39a2b50ed39c8
SHA10854072c24e517968f86bd3c44cca9d6179482ba
SHA256db55305bbaa1ddf9626ea9baebb853b69970a19808914748be1f0b0cc8d58f7c
SHA512e0e1303080d0f96b52a77f45a473afb5051ff097236eaef21e64efdc4cddef9a3c1e2eb0f5bde5eb1e63688c3ef912f4036cbf6fcfc5e4267676446dfa5ea6be
-
C:\Program Files\dotnet\dotnet.exeFilesize
701KB
MD548077c3a17f04c0785875c6e46cabbcd
SHA1d205b71cda89418e44a478b9b6a4b0ba7a5a39c3
SHA256ea95f8ca3af4d09628e4c3c213f18d926b6d7e1439fa35c41f72f4fe42d10032
SHA512c4e4a36fad44d517bf625a8e7d2d6a0622827c7ca6370af2e03bbe52dab529fc272a297abf8c68bf465668d2cbceec033ef1aef6b4131c5634d7827821fa7c77
-
C:\Windows\SysWOW64\perfhost.exeFilesize
588KB
MD5127fca49ff71ee9a7571ece88e085615
SHA10b617780937f20bde2cb5596b3997e716cebd457
SHA256c19389523a0e589a8e0fa49e043ba34311dcf5628d48942789b0e395510e7d22
SHA51249cc60c4a896f7ce9f44b4613865fa5b7b9b41f785493e81ebd4b5af9db5ba3aa8e4a43f84310077f7e571665bb27f33e2cdb24e47e51f0967e27ab01304d049
-
C:\Windows\System32\AgentService.exeFilesize
1.7MB
MD5017acba3a4b1e4fcc8c55ff92b455587
SHA18068ff8de3e6d75fe4d0972f2298519d040b0bb3
SHA256590f88c961e5d8ec3ee28eb5bc61554bbfe652de90fe478d229b4bbf749ebb7a
SHA51227798e3020e3851bb1565af50235bf4e632ae71da24094f58041eea8e2785f1568ff1bb5f597b3a94e23adf4b87d4bea352bdffdcf2dc48989cdd26dfb648b36
-
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeFilesize
659KB
MD54dbbbc209d597d0d87bc169c86efedf7
SHA192a9e8364106697bf6c42d5f2511d5bb4e4a011a
SHA256cb9e42ef5f5cf30689c088d1344cac5afb1eb01b44bdd3df2e54b7692e273080
SHA5122573b03cf802d846d0281dfd07f884e5cff96dae8061fddbea092f041cf8abf2c2c00710e3dc48014761981852955cdc2d11a3147f7d8580c6fcd8f90ea2f504
-
C:\Windows\System32\FXSSVC.exeFilesize
1.2MB
MD518d4b400783bd1195e66fa32420a5a8d
SHA13229def5ac2c35d7adae264268bdce92dc99c66d
SHA2568bd11f0537f727b0990158e87022511011560d84a07776492efccb5831637b55
SHA5121b8909fdb5d526947d01a9a56149a6d8a7ced241015f98e1e39b0e94560b095313a3c3e5ac37271fc8c94bb141717e090bc13569032a1452a46459f3d9aef36e
-
C:\Windows\System32\Locator.exeFilesize
578KB
MD572e182b832ec798ac033baafe6c46af1
SHA166802ab39ce4ff41ff5c91531baaf8a07ed42e89
SHA256a596eebd8e27a1402bdcadc3c9d01bd57d630e78a51c4c87078f758477f4682b
SHA51243c891584aa46914edc5ec696d6d04f83690f54784a212f9350b52941b24fa21d7182fa81f2dfcb103ca4258f402b87e23da767f562f79530cd6078a493802b0
-
C:\Windows\System32\OpenSSH\ssh-agent.exeFilesize
940KB
MD51ce63692f989a46e945228f10ef2c531
SHA1c692a68b75bdbe12deb8bd5d9479609578c663c9
SHA256478d0a19139a5002961fd38e513d8078ae74690fde6509689cdd7910c9a6fcfb
SHA512d85ed2958ebf7447d7fcd7a3fb83ec6a40fdf5e69587704499c745c38f5436fb93b90e7ace6cb3b52606496bf3fe37706f950e9b4ea8ec54d5a17c81725cf50b
-
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exeFilesize
671KB
MD5ce9acd9ee6cfef5c401294c5242d2346
SHA176889e3180088d84529dbd3244f8fea6b2dc02aa
SHA256346af9f45ebbb1e8dafbf89e148901dcffe1748cf43b9693070a153b4e34f280
SHA5125798a94919030903e2b8bd1c65d2557d4310567c9357a6a2b01ebcae0a7241a2437f7f74aaf8b203d5f373b286a6d7593c337221d1122ba56e3e3bb584024b1b
-
C:\Windows\System32\SearchIndexer.exeFilesize
1.4MB
MD54bbfc24ef0ecafbde11d0790fde29ab6
SHA172615b0bdecb9ca304d918bd2e555c3427a8e2b1
SHA256d60a47636dcadd959ffecf1a97f95bc15201bf2a0b7215952af3c2154d7db010
SHA512c9210bd544ed69aec32651bb00263805799a0cbf3ae9f4e59103a206bdb03696974b67e3f59414d39ef31917a4ff62d6eb5f1e9c49dda22223192909b5b8ad26
-
C:\Windows\System32\SensorDataService.exeFilesize
1.8MB
MD5db0d3715714a5f6b9d09a30cdf96f63f
SHA1557ff5130b785fa1cd93555e260042833979b084
SHA256bc3e707e9df0081ee6d5965e70fe14daf811412e9fc6d759052fe701e6176566
SHA512bb98d114f61b331bbc7151511355207fdf656a4632779d5257b71386396e76b1943263011fb6ab9596924d0a7717a1c3c56a716ea2b5a272e5d1796f20756954
-
C:\Windows\System32\Spectrum.exeFilesize
1.4MB
MD5816b36629aa4354996effc650b2c4ba8
SHA13471ec3420477b93ff3cd63b383e5fe8708bfbc3
SHA25682310aadb2c6bc7558555d96755bb1f557f7441e8118c2444782583d6a19cbf9
SHA512fda298fd1cfc4c7dddbc8576633ab3dacfea3a19c2dcf87167ae90fcb1320ac3aeb114b81ea08b0a138852863b6d2fd1701ef1ee6a9c1b63baa7f86302178ebc
-
C:\Windows\System32\TieringEngineService.exeFilesize
885KB
MD5df694869ed8397a65c3bf5e3f9501937
SHA19e0522264c2210281787600bfb77ca0b5ad76063
SHA2566ddc241fe6f23c3759ebec7a863865e1bddc46bf59275671136ce23840032198
SHA51229c9dba2cdb4f8ab98ecd3581fe0358d6c7d8e6e6587160119609ec10e287af1b9927c709dbf3e9c891736269896bd389de94422c8f60684fe755feda7d34098
-
C:\Windows\System32\VSSVC.exeFilesize
2.0MB
MD5e5f32e864631d8a414d4fc841afdd0ed
SHA11d70c1f2010ec64e856b7af020efc40794dfec56
SHA2564b995ce52e114cf1cd03e9b906cd8715c7a894e7070da5c00f08e34bace04f24
SHA512ced0a3e96931bd29f844c6e932163e17f9c8502b24dfb3299d31f950385591b74216aeae8b301fb2e56cdc11f576ba9d10d74f9d5f1cc620b9e2fa3079109e09
-
C:\Windows\System32\alg.exeFilesize
661KB
MD5f101c6c59481945e501d8750c6ddba35
SHA16c8a136e04e99c98308257c65050c7ad0f007ca3
SHA256060344e41e6d14ac5bce781543be49017a0da328684e75dbc2aa9e6827eead0d
SHA5121934f17c4f99f032fdf6363d63f68eb68bab1c1d274cb3b71cdd55e1439997fb47e09c5ab0a578e599217832428eba65d7d15343253059b7584f9ed77b924605
-
C:\Windows\System32\msdtc.exeFilesize
712KB
MD537acae9ee407b54ba40f6821a8659f61
SHA1b6d4ed0b3122a24e45edf1ea553465064517a3e9
SHA25666bb61ca4b181e3f74025e3ac99b98f5b536c1a6dac405ea3b4cbe0e9ad29b3c
SHA51214ccbd8273a12dcde60bf1896f22d82cc0cc7a80a2e5de85c0d2345a90ea6d1a864d506805d1117b07c0a9c031d63ba035299546560041058431047c4060c5fc
-
C:\Windows\System32\snmptrap.exeFilesize
584KB
MD5417c006d339d444cec7715a2ad3eea1a
SHA14313369855baa365cc046104f3ecc2141969ff70
SHA256b59956ddf9431b30161b5b12c0ed15b2bb4209afe31f31cceca7025d8d73b634
SHA512bb5897a92817d4eac5bc30ccf64678ab45fc8f20db75a35993fc990ce20066f718661eba253d35b9d4b16f5708b45744ad47360b1722d98ff194b1e7dd03269f
-
C:\Windows\System32\vds.exeFilesize
1.3MB
MD57fe025c0ad8f283599b299559de46a7b
SHA14c395d3ff4cca58d05c854e2038dd201562e6604
SHA256b62b3aae95a3897a6f6491d772952feb3cacb50a4c6c0a7371216c9e99785e3a
SHA5124253800f2ea39509853f77c70209c2746995c4941285d9b4a2d5f26d0fa2228460cca3d335ba7f0d15168067f357b1d0df5ffe44f2210c2e997ad61de4bbb8b7
-
C:\Windows\System32\wbem\WmiApSrv.exeFilesize
772KB
MD50b2ac044bcb83bbef114052502e5a20d
SHA12e6b236143bd2238f57955648672376d3b9527c7
SHA2560ce3e58ae207848138658998a96b7db1c4def16ef00a45aa62ba1119647cc9a9
SHA5129c5f1bf586e0721fbbfc115dc5b26a062095130828080c1ad81fafe838f46cfd48e0762f415e274bd3a17d8e237b3b8706043f5e6f1167f3b515431fe593417c
-
C:\Windows\System32\wbengine.exeFilesize
2.1MB
MD5b984eb22b982c97a00c9f2308726bac1
SHA1eed79c86ceb41dacd4766674ca7dd272d51b1f0c
SHA25672f43cbf900acb61513f471e9dd65f4bf7c1202146216baffd3137a99780741a
SHA512ec0625740323f848a87e83f77c748d71dcd027ada7d30d3c7827bf86ef9d7573f0be5361b276aef289268e00505c5fd0be64dc01c9d0855431378b13fe12b3b7
-
memory/656-333-0x0000000140000000-0x0000000140169000-memory.dmpFilesize
1.4MB
-
memory/656-662-0x0000000140000000-0x0000000140169000-memory.dmpFilesize
1.4MB
-
memory/660-0-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/660-1-0x0000000000700000-0x0000000000767000-memory.dmpFilesize
412KB
-
memory/660-15-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/660-8-0x0000000000700000-0x0000000000767000-memory.dmpFilesize
412KB
-
memory/880-319-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/880-665-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/880-431-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/976-661-0x0000000140000000-0x0000000140096000-memory.dmpFilesize
600KB
-
memory/976-322-0x0000000140000000-0x0000000140096000-memory.dmpFilesize
600KB
-
memory/1344-382-0x0000000140000000-0x00000001400B9000-memory.dmpFilesize
740KB
-
memory/1344-270-0x0000000140000000-0x00000001400B9000-memory.dmpFilesize
740KB
-
memory/1440-376-0x0000000140000000-0x00000001401C0000-memory.dmpFilesize
1.8MB
-
memory/1440-380-0x0000000140000000-0x00000001401C0000-memory.dmpFilesize
1.8MB
-
memory/1784-669-0x0000000140000000-0x00000001400E2000-memory.dmpFilesize
904KB
-
memory/1784-365-0x0000000140000000-0x00000001400E2000-memory.dmpFilesize
904KB
-
memory/2220-675-0x0000000140000000-0x00000001400C6000-memory.dmpFilesize
792KB
-
memory/2220-419-0x0000000140000000-0x00000001400C6000-memory.dmpFilesize
792KB
-
memory/2596-12-0x0000000140000000-0x00000001400AA000-memory.dmpFilesize
680KB
-
memory/2596-234-0x0000000140000000-0x00000001400AA000-memory.dmpFilesize
680KB
-
memory/2596-16-0x0000000000500000-0x0000000000560000-memory.dmpFilesize
384KB
-
memory/2596-24-0x0000000000500000-0x0000000000560000-memory.dmpFilesize
384KB
-
memory/2620-676-0x0000000140000000-0x0000000140179000-memory.dmpFilesize
1.5MB
-
memory/2620-432-0x0000000140000000-0x0000000140179000-memory.dmpFilesize
1.5MB
-
memory/2780-394-0x0000000140000000-0x00000001400AB000-memory.dmpFilesize
684KB
-
memory/2780-293-0x0000000140000000-0x00000001400AB000-memory.dmpFilesize
684KB
-
memory/3084-299-0x0000000140000000-0x0000000140095000-memory.dmpFilesize
596KB
-
memory/3084-418-0x0000000140000000-0x0000000140095000-memory.dmpFilesize
596KB
-
memory/3100-34-0x0000000000440000-0x00000000004A0000-memory.dmpFilesize
384KB
-
memory/3100-235-0x0000000140000000-0x000000014024B000-memory.dmpFilesize
2.3MB
-
memory/3100-36-0x0000000140000000-0x000000014024B000-memory.dmpFilesize
2.3MB
-
memory/3100-28-0x0000000000440000-0x00000000004A0000-memory.dmpFilesize
384KB
-
memory/3116-244-0x0000000140000000-0x00000001400A9000-memory.dmpFilesize
676KB
-
memory/3116-245-0x0000000000730000-0x0000000000790000-memory.dmpFilesize
384KB
-
memory/3116-356-0x0000000140000000-0x00000001400A9000-memory.dmpFilesize
676KB
-
memory/3116-251-0x0000000000730000-0x0000000000790000-memory.dmpFilesize
384KB
-
memory/3464-46-0x00000000001A0000-0x0000000000200000-memory.dmpFilesize
384KB
-
memory/3464-236-0x0000000140000000-0x000000014022B000-memory.dmpFilesize
2.2MB
-
memory/3464-39-0x0000000140000000-0x000000014022B000-memory.dmpFilesize
2.2MB
-
memory/3464-40-0x00000000001A0000-0x0000000000200000-memory.dmpFilesize
384KB
-
memory/3464-47-0x00000000001A0000-0x0000000000200000-memory.dmpFilesize
384KB
-
memory/3516-383-0x0000000140000000-0x0000000140147000-memory.dmpFilesize
1.3MB
-
memory/3516-672-0x0000000140000000-0x0000000140147000-memory.dmpFilesize
1.3MB
-
memory/3568-668-0x0000000140000000-0x0000000140102000-memory.dmpFilesize
1.0MB
-
memory/3568-345-0x0000000140000000-0x0000000140102000-memory.dmpFilesize
1.0MB
-
memory/3632-51-0x0000000140000000-0x00000001400CF000-memory.dmpFilesize
828KB
-
memory/3632-52-0x0000000002270000-0x00000000022D0000-memory.dmpFilesize
384KB
-
memory/3632-58-0x0000000002270000-0x00000000022D0000-memory.dmpFilesize
384KB
-
memory/3632-65-0x0000000002270000-0x00000000022D0000-memory.dmpFilesize
384KB
-
memory/3632-64-0x0000000140000000-0x00000001400CF000-memory.dmpFilesize
828KB
-
memory/4144-407-0x0000000140000000-0x0000000140216000-memory.dmpFilesize
2.1MB
-
memory/4144-674-0x0000000140000000-0x0000000140216000-memory.dmpFilesize
2.1MB
-
memory/4560-406-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/4560-296-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/4620-255-0x0000000140000000-0x0000000140135000-memory.dmpFilesize
1.2MB
-
memory/4620-268-0x0000000140000000-0x0000000140135000-memory.dmpFilesize
1.2MB
-
memory/4620-256-0x0000000000A10000-0x0000000000A70000-memory.dmpFilesize
384KB
-
memory/4852-395-0x0000000140000000-0x00000001401FC000-memory.dmpFilesize
2.0MB
-
memory/4852-673-0x0000000140000000-0x00000001401FC000-memory.dmpFilesize
2.0MB
-
memory/5028-239-0x0000000140000000-0x00000001400CF000-memory.dmpFilesize
828KB
-
memory/5028-73-0x0000000140000000-0x00000001400CF000-memory.dmpFilesize
828KB
-
memory/5028-74-0x00000000007D0000-0x0000000000830000-memory.dmpFilesize
384KB
-
memory/5028-67-0x00000000007D0000-0x0000000000830000-memory.dmpFilesize
384KB