5712791dc101ef56dae9f25893ae3e5f2e35bdbdd9b898e28c6cae2636089657

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exe
Size 604KB
Sample240523-degrpsbe77
SHA256 5712791dc101ef56dae9f25893ae3e5f2e35bdbdd9b898e28c6cae2636089657
MD5 7cae9a90d74c77e23f34137d6940a770
SHA1 548204815e5ace136e2d5f9ceda621860cddcd46
SHA512 f4c7aa417f2d799a9beda59e2df3dfc9f4e1b7c93f3ba9c26abedb0d81dc36b07dc6c88e1ef782d67a1ebee7a67421506e4030055b6f3c77e918cb0d8889ec22
SSDEEP 12288:RIL6+oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:yLM2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2700	alg.exe
4496	elevation_service.exe
464	elevation_service.exe
2160	maintenanceservice.exe
404	OSE.EXE
5000	DiagnosticsHub.StandardCollector.Service.exe
4696	fxssvc.exe
448	msdtc.exe
1332	PerceptionSimulationService.exe
2896	perfhost.exe
116	locator.exe
2660	SensorDataService.exe
3904	snmptrap.exe
2100	spectrum.exe
412	ssh-agent.exe
4120	TieringEngineService.exe
1484	AgentService.exe
3736	vds.exe
2460	vssvc.exe
2280	wbengine.exe
4420	WmiApSrv.exe
3668	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\377536038beeeac9.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{F3190C87-06A4-407A-A58A-3F71181B4541}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ab9d9d3bcacda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013b617d4bcacda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099f3f3d3bcacda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000281f9ed3bcacda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a209aad3bcacda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003fe1e0d3bcacda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d806e8d3bcacda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000598227d5bcacda01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4464	7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exe
Token: SeDebugPrivilege	2700	alg.exe
Token: SeDebugPrivilege	2700	alg.exe
Token: SeDebugPrivilege	2700	alg.exe
Token: SeTakeOwnershipPrivilege	4496	elevation_service.exe
Token: SeAuditPrivilege	4696	fxssvc.exe
Token: SeRestorePrivilege	4120	TieringEngineService.exe
Token: SeManageVolumePrivilege	4120	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1484	AgentService.exe
Token: SeBackupPrivilege	2460	vssvc.exe
Token: SeRestorePrivilege	2460	vssvc.exe
Token: SeAuditPrivilege	2460	vssvc.exe
Token: SeBackupPrivilege	2280	wbengine.exe
Token: SeRestorePrivilege	2280	wbengine.exe
Token: SeSecurityPrivilege	2280	wbengine.exe
Token: 33	3668	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeDebugPrivilege	4496	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 2816	3668	SearchIndexer.exe	127
PID 3668 wrote to memory of 2816	3668	SearchIndexer.exe	127
PID 3668 wrote to memory of 4572	3668	SearchIndexer.exe	128
PID 3668 wrote to memory of 4572	3668	SearchIndexer.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2160

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:404

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3560

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:448

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1332

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2896

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:116

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2660

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3904

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2100

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3076

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3736

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4420

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2816
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 acbc12ab8d34ff93511ecb9456a13876439da4a2b4c577abf490f7d557b43bc1
MD5 babc064a6fcd8a1ae728a5671482f0c2
SHA1 0a4b9dd6a2ca3333d8ebc9e4195bfc5b3438ee4f
SHA512 cdfc9c5cceac86923672ad224f9f27492b1a425aec6a4d2de11d7fcf64f752ddb395e255c2961f4c0c5102825066093ce213702de8cc032c96728ae20f66454b
SSDEEP 49152:YuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5YJE3jM2ce:YPfTqi90b4E3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 dc929eab84043576c129982cf8b0364f089e5b25ebd24693e523e2a3c781ec52
MD5 9394e4c5dce68a62cf3ad615d013edcd
SHA1 0f5ce32ec230deff3fe9054640c3f0b6e1af171d
SHA512 6d6112e4b644dcf8c5ae9fe7a3aee52de49f77494d371f2c1daec2ea52378921f3d41be6958fc3048f19cd45eb633e5496f42e2b9d1b23ea4c2737ca1575a1c1
SSDEEP 12288:QcQiQmNJLBsunEHoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:aidnBsuEk2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8b9bb0c7a3a848ac60cf28ea7aefefec04062525ba4c2c51e1360dad922dbd59
MD5 d4b62250046cbda2ae9ee345dd571e95
SHA1 2f6b859177a373aa30f85e525e48c31056a6578b
SHA512 7a8882cd526603ad9b3130f6d004ff403ee77b905cc1a960ea6bb4e0e3321f7cf51bf31cbbd05c761c0d8f0cd99b33ce509af58d42b7ea6119a4691ff7667b0a
SSDEEP 24576:7+gkEVfh4Cow2JOt934J7Z6bQaj1BvUm9J:SgkExSJJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5de24d1a1b2019ec2c35f01d627d8afd0544e0efbbf7e5cf6729a897e12d8fa9
MD5 ebbafaa56328ba0902ff3d9b51d08ebe
SHA1 be22ce309c7e4e48e1ac48e37f368fafa1573f4e
SHA512 54cf00e66aca5b39e260954d48c7014a140c99f7eb24ed2edb8dcb732e12cc1c622537d9b04de3b3e53e608967753aeccc0696489e599624ff3e61c9687f54ab
SSDEEP 24576:zBpDRmi78gkPXlyo0Gxjr52JOt934J7Z6bQaj1BvUm9J:VNRmi78gkPX4o0Gxj4JE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 65a7b8ddd63f2795f992732bd81c0ffa39da5b3dffcf1bef257b2c0ed049501e
MD5 34cfe4b84ef7e15eb9203d22c7907901
SHA1 5d1ee88ae3de51b27ab0c9027faeaa3fed065f90
SHA512 e67bf9cefe3007b8f1a45484977b9c7c982d3e34ba527321e48391e89d040f52b749989ce5d08339c07459fb42e2b92f959f85d2d7f32080fc9c2f5e4fc5e82c
SSDEEP 24576:ALOS2oyPIXVw2JOt934J7Z6bQaj1BvUm9J:4/yQJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 da7a8ed3f8c5fe1490b943f476a65ac4e58b2d21f722c0ca3d4f17947f45600a
MD5 22934d7f09ab3d1e199ebb26eb4ad0f7
SHA1 bdb944c6dc44860f24263275755b3a376229863b
SHA512 1aed983bdeb2a12f437e6364666e7393ba332e73e6bc811c593f997cab24ef3076b9142f075a546eb46646c6f2e65c94338a44765ed54353dd7f1c4d8dbadced
SSDEEP 12288:6fRoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:6fK2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 3e73c98c732e3cc492c4577553f4cc043987b67d065343c617bfecd5ffc8c090
MD5 58e6b09e2347708e3412f9b4c1adaa2a
SHA1 6b70776f86a42eeb07ae09fc05faa0d6a286cfe6
SHA512 66ba4e86ac85e281d4d4d0289af3a644981d6c66dc46581e406dc140817d7194dccf544b8252b38aab3243c0b864e0c4eb67a25326adbeb0382fb39262989323
SSDEEP 12288:NeBNUbTVO86UAoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:NJIUT2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a912173b2de27dd959d14ac3a5c96ee9c4898c5927ec8eaff1b9b119376e0dd2
MD5 fbbf9a087ff2f296d51c8647af865f25
SHA1 1778235e02b26140bfe01dc629d41c4acf851c4a
SHA512 8cbe58f49e3d6dd330cbaab1dfa42a91e4d2dd6f295d5a8fe0d504ad705b143d45335ca36c118dfe51734ef0730093b0fbb11c4d7c4d839573eebc7ec1969a3a
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:pQvGAdlCEL8c/yRNw5CZE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 f9c8c0ce7950ea8447358301932ba354435ea0868acc76d097fbf520d52438f5
MD5 7c5711eb3da403abcd622b276d52e72f
SHA1 72aae5cfd98e58df9835fbea572e67e238fb632a
SHA512 9cbcdf8ad7499de48773aab8b12d5681442d98e0e5bda1a8362a17cd6c7ac2e620c6bd9e46c6fa4a0ec7cae620901de195792875398a707e1d7164cc64c450c9
SSDEEP 12288:dAwSfxL/2Dc34DLLmt0LDQewsAjCoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712C:OdewsAjx2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bbe65d453253058e00a1205561c9b9411fdde9d07425f7b70960b73668666248
MD5 90859f44ce21f11f92e3ec564c6d4855
SHA1 a2efacadc3d7189ff0a325597b4ed2b07b6a7a07
SHA512 b62fea7eb23591400e82ee133cb0ee3d3ddcf2e27c88ef4ad20148cf002abcc890df6cb1ad97c543e6c8b0eb583720fd5bc8e92c1cc2f1a37af3879af2b2ae72
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHx:eUEtQevvqc2W1cpV2EI32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aadbcc0a8094303e54fbd6722afb0e93aab3c79a950a14310e5c2cb48e2c4384
MD5 0c4baa8f243f39e409191475d2173cdf
SHA1 d150e28d9c08e8f512ec4b4e024aa2e9fedf9d07
SHA512 85b2f02f34f88f0d8fe2b664657a6342da40390a25f3863492b3972e969adff8362cddfb9ed3c67cdda8330db406c8184a503393921545b0f7a762b61afde4d8
SSDEEP 49152:uCbRquA/m2yL5zTfFiV+XenmE3/zsJE3jM2ce:DoquVjnmdE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 420eb8578e88a8560ce21d5d71b2fe94116dcce77d778294c6819ca1dbd9721b
MD5 749073212ddd807afca0d3cb0c8bba77
SHA1 85f4a29dfce37b392a06f78fd3c81981e827b7ee
SHA512 6e5151b660263a73fe193387124b0878bb3d06e6f0bf1dcc764eee2e65757f3ac777bf1e130594fa1436ab035a23d4b714266ba9554ec658e2f78a74e413b622
SSDEEP 24576:oAhGLJIFoiwtA5l7S53g2JOt934J7Z6bQaj1BvUm9J:oAMyFoiq57JE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c77b14f1531e80dda71dd6715a4fb64b26f4ad8203ceb947b16c1416bd0599f3
MD5 6b1fb9ae2d7554846f5be407c720d6a0
SHA1 a103f9f3636a44f010cc9534c65a9b6bab6ead97
SHA512 24ea254b87f2d0230c079a4f40e22582cae94fc70ddd83c86793be219c09fa327ce2321141b7fc66f5f4653f1973a97b01740d3464e8d876de88ef425ec3a719
SSDEEP 12288:smw5HEjsChNVBFgl0WDm+C/oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+511:JwuoOWF2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 25bb3cdac1647fe8cc53fd8e76c255c159b42344e5bd4f47e7bdfa8b72b00f55
MD5 ae102b4a6fd4c447482a2d5049222d87
SHA1 5b79dbcda3fab665023e02e89760ac88203f416b
SHA512 7535b0066bb13f73828f4fc425f8ce197601e9cd6e3734a1960db663298b2650c3ac5025e2742d92891106ce70934803e30fd935ded2714dca76f4fab1e0ff92
SSDEEP 12288:EBZ1IyyoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:iZu22JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 28ad286d35c6bed6d2726bc0959551aaaaf6e8a17d85634cbc10416f13ab371b
MD5 788409c5e9120aed89920033a158f9e8
SHA1 cc567b77865aa31184ddb5472fde1ddb52d78bd8
SHA512 520e5b4af73fd9ab955b89bfb75b31f69cd165ea6d2dbab8bb3ea5dbb4f4944d04ba90e429897877cde977e8b34a3e70d98662cd589e1e15805cae66e6340bca
SSDEEP 49152:y0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLN:EwfhY7g/rLd7yYA3awr341gVE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 c845436c38792d89f573b7cab6355f5f0bfda5b8e92ffa87d62b33c5ba775d45
MD5 63d70e1fdc91f5de9761ed8bda3cd26f
SHA1 4b43db4bdefa7b0d11a644a8a4adc5259f614a50
SHA512 ad3b0f1e758eedcef070f166d212b4f92c069ebe138971b78410dc0b6e7bd715080645916eb13431d8315acb5af9e08444ef81dcb425b37edd21375d4696acbd
SSDEEP 49152:x0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLN:BwfhY7g/rLd7yYA3awr341gVE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 c2b10859d9d96e7cb0be3c8b891de9f35cb42c36e04ab6bd135a2ed663565468
MD5 e1ac7c039d5c5e2dbbcd702bdbe1b349
SHA1 a6e7410caf24843dab65797f2d9244cb6a20beef
SHA512 93bc4c81741f78245830103a044f9dbbcb9b546efe7481377b94d666cf979246bfe38c95c9891da80d642f92591863f36541c738715bd37c96dad5ddadb219c4
SSDEEP 24576:hcTyYv0FteQU+5I2kjgD6iQacAF2JOt934J7Z6bQaj1BvUm9J:huXv0Ftpn5606zOQJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 16551f3ef66ed7233c0a5b6984f32e0c7a03669b76eba46cedf61646dddd5930
MD5 4de9d3ffdd9f9c093a918a9537d630db
SHA1 ad52c5ba54c721bd9bf8023fbd9f68607621fe42
SHA512 c0c501dc6b85f48fc2547b479682e149d73908eb1750988eabae7af59526f10f8b314a4470e3d2e5230e729bec9e48294a0b2e1c6cb07695c717b0fe616cda4a
SSDEEP 49152:uy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxMJE3jM2ce:lmYeyxHjWjMT4E3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 3016fd5224bd12a53824abf307e9c0ad2dfc7f776996fe4226abcfa37db76225
MD5 f5cf5a9c5c880e5fec85b44fbf34bd71
SHA1 8368c1255bc916bf8c89b3f90a209a25ab003a31
SHA512 a84584221619b3424b9cae407abaeb1c307b041e0dd4de19755aad950fbfc8e3bdd32b6e2a2e475383de861f653736b5b76a3abd2b3197a7f41b86bec5f89398
SSDEEP 24576:86drZn1WEci182IEUeNbJeRgUebgW816O2JOt934J7Z6bQaj1BvUm9J:8WnDci18yNNUgbYYJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 68c23494487484616622a20f7d4cb1d0f13c654b74f62a0aef9a1f4af5806816
MD5 ee478ad0169f871ea73641530408481f
SHA1 0b67098e9e7fcb4b2ac1b2e060ee083a3c12b01a
SHA512 47b1b8dac30a41322f7cb871326f2908702eae7f5cf7b9b92def7b5d5a33c102cccebfd28d14a5715f8e33fea810f4a3be91da39d8f9ebf02df58f0c56ab2505
SSDEEP 24576:mk5lHW5EzMZupO80G2reD+melRgTTv/1nyP2JOt934J7Z6bQaj1BvUm9J:gizMZm0GhamSoVJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 2be80f993462225ff25564f6fd84f071d039aa9da6470d54e1eadf33650c138a
MD5 496d2852c3a27d7fbd0e0bb77b148121
SHA1 d17fa7ea2be5d38ec868d838f2585f7fa2108d5a
SHA512 30f35a3cf85889a2fa0fea32631fbb04f1cc308db50cdf4907cd330be5bcc5df4917186b4ef1a883a12402e6b6fdd73aeecd6b67d4e72319775720ad524f6520
SSDEEP 12288:kpoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:ky2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ce565da44bd2719d6c57094176643fcd276ba651bf5dd25a03ba96fcf04d41e8
MD5 7a6583ed0c5b6fa7ae3d5e568ba662c4
SHA1 2e765d7c177e9d94b33cc3bac771df98b46fc7e5
SHA512 88beb265eafb76a0d07be47864cc20e936093a18761dbd591879f734ae52e1703979c9e916a41b3a45c2caa62f74a7a1d5665ef290aa8470c5c5b21ff30f4d4e
SSDEEP 12288:XWoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Xd2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 21a65007ccd9caf3dc0dc295b1eb2e783dc781f3a4ddcd1aac99e7d6fd805220
MD5 a7e50e057ce51c1e47e505fd1c20c52b
SHA1 f3e8de458162e167d6571d9d350e5a018e5fe233
SHA512 26a40243c87daae93ca5b53ce3ff2957242c0662f75e708a2f6bc125b6ff54dda59fed3562088a822b606617cff0b38a8cadeb2a5a75cd0835a98190a84ad0d2
SSDEEP 12288:AYoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:A72JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a79a594047645a2048d6f8e5ef0bf65a1920684cbe2f836671023034619815e4
MD5 c7a21a1f0b23c5fadd52de13ebf4f02a
SHA1 55a777f4433df432894c4d30e35df1d09f1019df
SHA512 9eb01bccb732ccc4aa010138d9eb3daeb5c6a56b0aba43efcdb6b02135c32e217fb0d2b2d6490fce2c5b0fd35be2f55191a1e8bf991572d34968f209be9a7473
SSDEEP 12288:8V7oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:f2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 33386ad58bb672c9064481cfae8f58aa1af7d18a580ca364aba35fcb03246c4f
MD5 9cf90f47b25f0f8fbdf2f504e58ec880
SHA1 7f7fbd6888143a9a6e3dc9dbe0b536131bf8095e
SHA512 34a544964ae4319eda80cd0938fb2a5f1bf587e58b5fb43edb40c9952d79193063c9a4ae43cb45ba406ab32bb9cc320c99fb37652c303f7573375b83978a6de7
SSDEEP 12288:LDoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:L42JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 37135f861332124e3e957487a4a86bd3dcd239a124f831aad4955cdfe5bb1ac7
MD5 1b486b887d4221761aa55c989d3e9d37
SHA1 abe81d656500301918664e6f86a846347c4d8446
SHA512 d06b395eb990b603276a88137702e4ad16752988d54e3f4bd96f57fe397ce4b3d1e32bb45ac4b8bc88f9c77c3160c2d249fb08a1d1ef900e6b825afa9da6a46e
SSDEEP 12288:8aoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:852JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 37614b6bebde98c46077990cb83b1ea6439f04e09d17a063605b20fbadbe49ac
MD5 1a1c95a6cac103f4ba9b7dc65aaba09e
SHA1 d97653d3d9740e94c5fcaaff7aaee20f74ba15eb
SHA512 9d29c4d818814ed6ec33bba5ae9214431e8b5c6627482bc33e20281da9edef1b2dcf4ddf3ab5372425e197a0263cc0b5cf847105ee66ca0f9cc62520b74a031f
SSDEEP 12288:weoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:w12JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d18d63bc5020983dbb8842d55a71d26665ad09bc9c8987f2b7763fe354e3f6cb
MD5 58973355fa066e351b1f9d89a5a11f4d
SHA1 f6ca673a1c7a4b792ae47e9a2ac853a1b5c7c364
SHA512 1ddce3b403acf0b08e4daae0ed5f0d33a184479867d8cafdb1170ecb66d25bd2425740881799dc5821136a89eae682c60c74d62ab5c962d44c5556598d2beb6a
SSDEEP 24576:8ZMSzFVSO92JOt934J7Z6bQaj1BvUm9J:8ZMSzfEJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c3d2fa0e94b95ea71327bec37b21768c4e0d580bc2ee0c1660a9fa22db4aba1d
MD5 0132b95edbc997ef2fc0c1a7994cfed8
SHA1 c929bc02d7a1dc0aadaf8556b1d7e38deb1d00c2
SHA512 f98d747e445fbcfb267dacf882a5a43d5b4a9a366e49ee0cf1dad21afc5fc7cfd90d24ae68cb2e9eee0c68f2800316357cc0983009dac4df4be2e213cf76c666
SSDEEP 12288:jFoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:jG2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c92f6a99ec7d499c555bfe2b64a0a4301828efd31f33813c04ee4d5ecd8b95a5
MD5 8eaf9f0561dca113050276ba6dbfd7da
SHA1 9931484f3bb7ea32764e1d94ec9a8f5e0025fe6d
SHA512 0884c581e0f19575733028796e15fcc09c7bef6f6c2bc1d3bd6ee27dcb977e45826f164229b1e5a42f61c84fb0bdd14c2b10e05f3a1ad8d99e8f268bdef3cab5
SSDEEP 12288:FBoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Fa2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 75b9e2789f8304b78777ad0d80b907a3920887d0d62d07097c87acb1a04d98d1
MD5 26337b99561a802e180bd33a6a80dd63
SHA1 0d5fb1af90decb934a00533f71a93d07cd71628b
SHA512 9205f5d7466e55dcdf88d37747551d0e9115b5793fd2aea02128f1cf6a134a2a765df2a2f10b00237f098b745ccc08647e10d18424d805ac588104b04fc7b274
SSDEEP 12288:pyPz5L8yoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:IzyB2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 bcaf62f5a1b0d31b8117ac376660932fab286104a710bf8d72b14d15c979cbde
MD5 3d6f7c74756d58113386affd51415ebc
SHA1 22d4bcaa31a745628824db7210d9c93ff5c25612
SHA512 e60de0da0371f3a472689d7ee994837e1d32cba05d4156ed8259349bf163d8774164c220bf55027a774b65d47d7ad4d215c4aefe7a774ac27a6d3c96a5d9c7e8
SSDEEP 12288:sFoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:sG2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 b69dd2f32eb78d5cd83a95eb414f8d88f3c2fc542d679401c123d3061d787405
MD5 47a4394b0162921533f6070e5628c418
SHA1 e640f21390a7bea5992f91aaf4485b75067ac6ec
SHA512 6a3102e87144ad1da8d730659aae89f7c4c14ef85d23c0c6b92f49e58b349cc1c63b4ff6425f611be6536a793ed5ad0adf9b6b4253fe2de39d154d5fa73b95f7
SSDEEP 12288:bFoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:bG2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 0e31442b3e4bed30a90aa82c98e6feaaaacb476b7387aa4f640d3c20b99c79cc
MD5 32aaffaffa04c9943f2b522647099ceb
SHA1 8b115c4933cfa96a59a823b476d28e961b7efeb0
SHA512 6af07d3b452ce5d28ba694f1f5545b6eea43ebfc1daa405cd287a267b18f7e005ba2d466e8e48205853d5fc9ed28f293420886b8f91c0d858a2d11a47fe463a0
SSDEEP 12288:+yPz5L8yoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:jzyB2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8927876068ca0f36743c3c6de9bfa0d943be646b72e353f714bb2ce5a4b32dc5
MD5 d316c22e35a1d8247316901b0930f6ed
SHA1 eac267e0cca4035234ce48ad23b66b6d056591a5
SHA512 34261248f36e627df661d1862f043e0ebc6e7f953985767e0f4068c9dc0d7ce09658bb6c006ed051a4ebc4640a1ba51c46d17c6966a1e712196331bc5043f5db
SSDEEP 24576:7THaLl3z0zDr2JOt934J7Z6bQaj1BvUm9J:7T6LljHJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 efe4d48346e46004822379be6850959ab51bf12f9833c237b667cecfaa74701c
MD5 d2cbc93ab4ea0f4322eb2b112cc4434e
SHA1 0f05be38ac4bc35232c966a0d1f94f245dc545ad
SHA512 1387e6604666bea00a690f763d3b86d0dda8f439ccfe1d58db91a7cc6779ad6c011c0e02666860437ce0038e9eaee17d2cdb5bc3e3abb4283eccf37adfe6f88b
SSDEEP 24576:h37d9CHKy7GZn2JOt934J7Z6bQaj1BvUm9J:R7d9CHKyaEJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 5f50a8770167a667442dd0c91a641424075b1f51dd6b1df42579c884e575a104
MD5 95984744f184df308a4d5d2e02de225c
SHA1 0152d9979c6edf01f13da023de55f4d6d77f11bf
SHA512 df8c28d60c3558a74ded70934af71a076446266ccaddc75be0a8ab15cab3849d9a5e882deb55d238829c9c9c116a56163031f11768576e0bc43d6126cc24b54a
SSDEEP 12288:74oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:7b2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 e067ef40e9a6a8d4c82b065663d347e3ff838e7ab0181596258dc24451326c8b
MD5 81863c016cd00bbf9595e4ad2a97b90c
SHA1 c52915a9ffe23b9a85a37bf837e9386cbc60506d
SHA512 b31bad24a0b772c841d5f45c3ca1ed92dfe849661b37f7f3458d20a899870f73147c01d34a3e1a151e6f387a6342c62a3dc8d12b28e707b7998eb837fdbb1bcc
SSDEEP 12288:eSoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:eh2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 85c108bcdeba10ce15da90e82c8d99d589487d483c5b35ccf73fa857832fcf30
MD5 96b9937bd895c61890b00bcd466eb67e
SHA1 73f386a7a134f49e1e4f67b0af4802196bc42ef2
SHA512 10cddeb67c988a2398687ab44ee06c0cd9847245fc4b282ff05242376cab8711541cd1dcd8219bf86421e720c63dd2718986fd774ff3a4de0a0ab5b64aa9c4e6
SSDEEP 12288:sHoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:sk2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 9dd5dcbf433249e92984bee47f3e6f1ca23415868ef7ee6e313f4916cf3a0f65
MD5 e2301fd3fce47e12caed02f05e0c7382
SHA1 7e312dc4b6fe170bc259a4d4c940d5ccd4c9787c
SHA512 a0c1678b57eac6528af967234b0666195a88d1911a1d436b6e497a47a5f35968c3900d9c749c0efe202e3f144773d83485557a79119a3ebfb877e6a95e10899d
SSDEEP 12288:pFoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:pG2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 1d1c38599e2894f688446cac45afd40db63321aee566f6e665bf049f39abeb24
MD5 f9665f79f2c05d8b9aa52b3dd209da36
SHA1 47183537801c3b5b4561e0df3752df6c92617c9f
SHA512 d5e7b4185633e36b38102658385f9af8b8b5d8da4fedc373e9ee154f41a5ee4e7d15a0a89542a58abf023de955c7a802fca3b1be6aeedf6048af3b8d458a7b19
SSDEEP 12288:s4oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:sb2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 9768b4301feffad2ab50256e5d02b19109befb11e2a522bc9f2f79757a0d192c
MD5 ca706b2acc1ede8935c283e9dc91a037
SHA1 de07ab987f5da401a76ade2f261b06c01cb87b0b
SHA512 5f609ca1ed0eaee1466a5b7db2e89d8575a16b5736551ad6bda5635f5830e372ef078acd076c1e53ffb478c189ebd07dea18803180f8ca3cca74c7457f13daba
SSDEEP 12288:ltoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:l+2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 4b0d30d29e285b9287eeba8d8ed3f5123363395e22ac73c2c93d42ac15c908f2
MD5 e81caf384f6be8cea6b98b4ea90f956c
SHA1 0e5be400fa26d06a5a5b15dbbe3e77b2c6a59437
SHA512 6d451176a5c281982d7f644252b8a4ddd2b2186bb357adfb9dd2a309bd1be55ff454985534a1d27635610ee6a8965c706f3673b23f8a3d9cabe99654b531e31d
SSDEEP 12288:JDoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:J42JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 7e90c60d04c3abb9e0f126bf44f36adef196f478090bb28eb018d41654b6409d
MD5 af7675c0a858f548306405f6ad1bbf8b
SHA1 47dc819823645f25b75b7216e8705ae70192fd9a
SHA512 0ea7d6dfa3d21f5644845315f42f6ff2fbed9f22898a2c13cd200cf2ff41fd24fb4aa20d537c58b3037d826742071be688c29f35c6a2aa729c9577e766cedd2b
SSDEEP 12288:+UFmDDL8oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:EX2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 e217f8a4614571dc98df7956e51c888eaa842dab1bd41fe019617c4e357df2aa
MD5 d4a6f6bcd0de833934449b403aff4bfd
SHA1 08d4350b07eb9e41b1f5b6777ae04d1686d5d360
SHA512 27ffa1997fea05b703ae6196a1f40660e572acf71e1edcb60a31e232bd863cab700e819a851918f2e780c5e73ef85e8efc83d980eef3e05a491b3280357ad658
SSDEEP 12288:SBoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Sa2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 de232d0347a1f52e16a5e36f7bc098ae80ed7323a36344a1456c9d6494e7dc5e
MD5 94547f87f11befaacf071e66292649f5
SHA1 eef5f00545bd4a1eb06d422fa674175fd5aa247d
SHA512 0933e7d7a8aba5d63a176f6b558ea8dd55c76d27c3d6f28e219c1e36df881540f9edb6dfc4c9e0c30a9a311eaa1ccaeb6fac633cfec060a49230c9ab232a4389
SSDEEP 49152:Ra0h2GEkuAe73q3pp46zwwQrJE3jM2ce:Ra0hNYG4JwAE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 0756c545e886fdfa25c39a237b5dca9ad1e72cca833614cd0773e8eba005009f
MD5 0f9257c47379bab595427d016adf5fba
SHA1 5971740590fc1377d9535fda19f972fc2ab52833
SHA512 ff5edc59f72f05e2182d1e4446eb4417f318a262ae367fb8039f86af402d6383f92b18c5ed2e064b20f1f93676e02a5295cedf04685f9a73d249f9bbeac066b3
SSDEEP 12288:ghbHjfXWoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:ghbHjPd2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ab3fb2173e3184688566324a15a40c94dd6ffdf59eb08b19d58c50e7d4d6f980
MD5 6e116c9c6599fc14e78924800da51b8a
SHA1 b12419d3b062aa27720d6877f7d72ddd32957d3c
SHA512 188ef34fc238dbe582bc29d16b1b7396b424e2abcf911d105fd589a6f99e39b43b73b1f021ee5535f807f6fceaadca5b74f3b4eb33432302f0e19c05267e7b1d
SSDEEP 24576:Q3YgnJcRTk4yti+R5dpR/F2JOt934J7Z6bQaj1BvUm9J:QIgnaTk46ppR/QJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 26644e5dd8d57d55e8b3edd0764e6e44e6d4f98e8c3417982c8701cce43be89a
MD5 0a6040d83fd2597a41f99aa08fb297f4
SHA1 b522f1dc6d76d324371879dcf689ab26966f4c6d
SHA512 375040e98da18ae41809f1fa9262a986c9c02f82f84d8ddac1d2f22dba85a7f21a0a1290bce57b93e066818b64aa5742c73013111a523592c958cf819a5e616d
SSDEEP 12288:X9oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Xu2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 3e614a86b270e48001120002fa1df7992e14ed6f52901dee3df9ea5e3c7465f4
MD5 6c178474a26abf047eb3c9ec54aadcdc
SHA1 fbff1b890a31ef61724b7ccb8f9f9dbfed6ea6e3
SHA512 d8004ae1c3f229e2daba3beb08fb6404274550562a35a36f8cc0e41583a459f54bcb767d534f6c42c021df67596e3f0d8bdc05e281d17cd530f124c38639896f
SSDEEP 12288:qOb9A4LWOsvAYFT4oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVjf:bpL3UTb2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 975d752857c939af48b80a3ebcba0331fe2d2c19671c40796597daa7c691e300
MD5 2e92b955f04a43a9556f9274a4befd1f
SHA1 91688cd55c1e752238fb2805323efa2986bb2b0d
SHA512 31d180065512e52a6ef8b5946b1dd0dce9dd8aa42bd0d99ff967d53d1c2c0346900f96fda7825857610e852f4ba59a4a99df2be5ee354f64558d73671b959c8c
SSDEEP 12288:FpFtpOkoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:tOv2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4e4e9779616e6941f5f96cdaf2d42e4ecdda17955211e9f5af757a0214b19c2b
MD5 462b23a29e4bca73e9528605bf0164cc
SHA1 ab76ccf993d8c07fcef19c6ac545c6d3ef0f40f6
SHA512 c6940a21a310e61f872824b88d6df5e614eeef516b840473b699b01adeb5ba89ddd7aaf1fee6d83e2ebdda7850da391d87cdef8d13bbfb8192455fc8dfadd77a
SSDEEP 24576:W7NM9YmZqmWMUkPjZM48Mv6bEhsq2JOt934J7Z6bQaj1BvUm9J:W7cBWMpPjN8DbEhIJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 00aefff21d1ed3fd518aabafdb690ced923a2d6ab461526d973aebf90c06e1d1
MD5 3d4a6d27f10e4bef2cca2cc25c81dfac
SHA1 e7227efd0a96d47b5f40f4a0d3f2a81f31435961
SHA512 c9ed95d0f644aea908a0246be54c94290ff7402215fd3b57ea8320e2f2f96024df50ea4088cc1dff5488affe81a3d22a615605cc2bbe71d8d3035b3da493fc44
SSDEEP 24576:XW6BApg2YuyuNDYTabvcRvNYf8km1s2JOt934J7Z6bQaj1BvUm9J:XF2YuHNETovcvNYf8kmpJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 29ef037fed9155b10df4c88dc10703007c24bf59c30e0597271de8843432faf6
MD5 42e2666b3fd0dc52b8d388123dfb11d7
SHA1 8c4eaf7d2796ee920c77d53e37ecc2000b2f0d63
SHA512 6fc2d4be68683e77a26cb6769697916d52e4207647639277420b8b021fa37b2dbcae8ed58720dc9c13fde5d7bdb0cb92aa0b782466fdb4d523dfabc4c19cd137
SSDEEP 24576:jAFs06+Omlf3NXEbToT2JOt934J7Z6bQaj1BvUm9J:sFs060lVXuLJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 791ec4c5b6f90c0009819d986110cee8680fc9ebe68037cade559275ca27164c
MD5 d1e896469de06d20babc0471fb0d0052
SHA1 42e133e371813ae3afe45df2bcf66035df81e516
SHA512 8f0b5d23456ab1c71d68cb8761178f95e7161386f4bef1a35c21850a442d8df35561952ddd9d32b41defd8b43603688aa7541b3f9853527c24d897ec6d2864da
SSDEEP 24576:YJnJ5D3Wtg2JOt934J7Z6bQaj1BvUm9J:YJnJ5DGtLJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 150259ea8cc7d82990ecaaef49426f323608070bc001837b93e7296622a2af40
MD5 f3c03f27e41c592802a6c187bfeda9ab
SHA1 6c104881c28f92a3d42f8be754441296634d25e1
SHA512 bb38756784561d926a389ac2f1d593a377cb82b88d96d3aff3f2ee087e08123ea36656124f3b9b354e12f71ef72301f1d89bfde4f798de9fcc3e64e2497421cf
SSDEEP 24576:nEPohm6/7IIXdwcXrif7qQncjlP65i3VuF2JOt934J7Z6bQaj1BvUm9J:Ao06DIKdwc+eQnSt65aVFJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 f3231fc666ba91a5c60bcd452a32efb808d5daa71253707a22e94ec11c916893
MD5 27993e41519a8b1cbdec9a1aebcbdba2
SHA1 75d2ded0549065f0b285f7ff6c20e18a1917f0bd
SHA512 f491b87628f80588ae304780934ad1bc76b17af1216d63bf53d07b47b73cb90e1d11c1a2e401ed6ea845aea41e8eabca953379c105f6fae4318811823c4c4918
SSDEEP 12288:1EP3RrVoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:2r22JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 dfa008cfaca68b1e36a00e28f017060feef6be4168f0e9402d88030ae609f57b
MD5 834db62727f7d3c63659a1ccb120817b
SHA1 2e989907de51b5f4086fbd01fca3089260645b57
SHA512 cfd08c5bc98b5c405423db50757b758c619e753ae1743a912718afe83ef35d9f7a3a3008fb3f8cfb41f434125f1d644d120cabab26f98b02b2f8b5f36faa98d3
SSDEEP 12288:UjkymoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:UIyN2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 06b85456315fb7b48c4d64b1f604d52d4f4ed5343cfc35361c13adb409f3b531
MD5 372a9dfb37c73036424154464e87d74e
SHA1 bc5f3009aeea86988ff02bff46458adb35462f90
SHA512 3a96bc43498654f787e13484029b4530b695992fd6ff73cecc15d149882abdeb7b81066323ce1c390794af91dead35d7c32607aee91d9c3b284cd820845cf8c2
SSDEEP 12288:AF0oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:uf2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3f034ecf3056a4ecaad746ea56adff1b60154024b4cad77a075e6fdff01e77d6
MD5 f318413fb9979d04953a57509d11524c
SHA1 accca5e2d1dd5f2441d2c068da7ba24c6726c740
SHA512 bb1912e8886240f3918b449517f69facc1557184376e075ee8da8be6c7fefe8628e930f059ace697efb04b897ac229c6c9136ae46dc7f709a98f06fc93d92988
SSDEEP 24576:5Q9MxZKdcz97w3C2JOt934J7Z6bQaj1BvUm9J:5VKXBJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 32cec0a0c14917029bfb6d0538c8d2b42ad7b097544e8cf4252a396186f2c53c
MD5 013b680f711fd028666df413a1b4b128
SHA1 16e3015bf0dcc9b9768affa066199a12a89c7144
SHA512 a7a3bf21643b2d499e3ecd98a48f101768e4c36efb0f9f1f1d48bdd129d8b144170250c9b7f893c6e6e68bd865978993e016f9c9fed230abc21cfd175889047a
SSDEEP 12288:hyoKo2HRple9pSoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:hyocxAph2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3791e63cfdf993d372cc952515a869e97e31fb25576d34b33b5f56e887e01afc
MD5 95a38f7ac850e209226e37694a570fda
SHA1 b157f9a8744cab33825bd5f09f349e4decbf0b4b
SHA512 9a289162477d01925d45bac180f42baea429824e336eb94a95b1320d09698ede1ef447aeff9b898d4b363546034addcb81d595e36e1dc72ef64d7bff725ac646
SSDEEP 49152:1WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK8JE3jM2ce:l0zuNIcE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-296-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/116-415-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/404-236-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/404-69-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/404-67-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/404-61-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/412-649-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/412-342-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/448-379-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/448-267-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/464-235-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/464-38-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/464-44-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/464-57-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1332-279-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1332-391-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1484-377-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1484-365-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2100-330-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2100-645-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2160-58-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2160-48-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/2160-54-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/2160-70-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/2160-73-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2280-404-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2280-655-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2460-654-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2460-392-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2660-315-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2660-648-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2660-430-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2700-231-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2700-15-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2700-22-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2700-16-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2896-403-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2896-294-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3668-658-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3668-437-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3736-380-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3736-653-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3904-319-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3904-532-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4120-360-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4120-650-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4420-416-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4420-656-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4464-1-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4464-0-0x0000000140000000-0x000000014009C000-memory.dmp

Download

memory/4464-14-0x0000000140000000-0x000000014009C000-memory.dmp

Download

memory/4464-11-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4464-9-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4496-33-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4496-27-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4496-36-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4496-234-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4696-265-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4696-254-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/4696-252-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5000-353-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/5000-242-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/5000-248-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/5000-241-0x0000000140000000-0x00000001400A9000-memory.dmp

Download