Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:55
Static task
static1
Behavioral task
behavioral1
Sample
7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exe
-
Size
604KB
-
MD5
7cae9a90d74c77e23f34137d6940a770
-
SHA1
548204815e5ace136e2d5f9ceda621860cddcd46
-
SHA256
5712791dc101ef56dae9f25893ae3e5f2e35bdbdd9b898e28c6cae2636089657
-
SHA512
f4c7aa417f2d799a9beda59e2df3dfc9f4e1b7c93f3ba9c26abedb0d81dc36b07dc6c88e1ef782d67a1ebee7a67421506e4030055b6f3c77e918cb0d8889ec22
-
SSDEEP
12288:RIL6+oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:yLM2JOt934J7Z6bQaj1BvUm9J
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
Processes:
alg.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEDiagnosticsHub.StandardCollector.Service.exefxssvc.exemsdtc.exePerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exesnmptrap.exespectrum.exessh-agent.exeTieringEngineService.exeAgentService.exevds.exevssvc.exewbengine.exeWmiApSrv.exeSearchIndexer.exepid process 2700 alg.exe 4496 elevation_service.exe 464 elevation_service.exe 2160 maintenanceservice.exe 404 OSE.EXE 5000 DiagnosticsHub.StandardCollector.Service.exe 4696 fxssvc.exe 448 msdtc.exe 1332 PerceptionSimulationService.exe 2896 perfhost.exe 116 locator.exe 2660 SensorDataService.exe 3904 snmptrap.exe 2100 spectrum.exe 412 ssh-agent.exe 4120 TieringEngineService.exe 1484 AgentService.exe 3736 vds.exe 2460 vssvc.exe 2280 wbengine.exe 4420 WmiApSrv.exe 3668 SearchIndexer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
Processes:
elevation_service.exe7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exealg.exemsdtc.exedescription ioc process File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\spectrum.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\377536038beeeac9.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe -
Drops file in Program Files directory 64 IoCs
Processes:
alg.exeelevation_service.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93484\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{F3190C87-06A4-407A-A58A-3F71181B4541}\chrome_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe -
Drops file in Windows directory 2 IoCs
Processes:
elevation_service.exemsdtc.exedescription ioc process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
SensorDataService.exespectrum.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
TieringEngineService.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
SearchFilterHost.exeSearchProtocolHost.exefxssvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ab9d9d3bcacda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013b617d4bcacda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099f3f3d3bcacda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000281f9ed3bcacda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a209aad3bcacda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003fe1e0d3bcacda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d806e8d3bcacda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000598227d5bcacda01 SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
elevation_service.exepid process 4496 elevation_service.exe 4496 elevation_service.exe 4496 elevation_service.exe 4496 elevation_service.exe 4496 elevation_service.exe 4496 elevation_service.exe 4496 elevation_service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 660 660 -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exealg.exeelevation_service.exefxssvc.exeTieringEngineService.exeAgentService.exevssvc.exewbengine.exeSearchIndexer.exedescription pid process Token: SeTakeOwnershipPrivilege 4464 7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exe Token: SeDebugPrivilege 2700 alg.exe Token: SeDebugPrivilege 2700 alg.exe Token: SeDebugPrivilege 2700 alg.exe Token: SeTakeOwnershipPrivilege 4496 elevation_service.exe Token: SeAuditPrivilege 4696 fxssvc.exe Token: SeRestorePrivilege 4120 TieringEngineService.exe Token: SeManageVolumePrivilege 4120 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1484 AgentService.exe Token: SeBackupPrivilege 2460 vssvc.exe Token: SeRestorePrivilege 2460 vssvc.exe Token: SeAuditPrivilege 2460 vssvc.exe Token: SeBackupPrivilege 2280 wbengine.exe Token: SeRestorePrivilege 2280 wbengine.exe Token: SeSecurityPrivilege 2280 wbengine.exe Token: 33 3668 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3668 SearchIndexer.exe Token: SeDebugPrivilege 4496 elevation_service.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
SearchIndexer.exedescription pid process target process PID 3668 wrote to memory of 2816 3668 SearchIndexer.exe SearchProtocolHost.exe PID 3668 wrote to memory of 2816 3668 SearchIndexer.exe SearchProtocolHost.exe PID 3668 wrote to memory of 4572 3668 SearchIndexer.exe SearchFilterHost.exe PID 3668 wrote to memory of 4572 3668 SearchIndexer.exe SearchFilterHost.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7cae9a90d74c77e23f34137d6940a770_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exeFilesize
2.1MB
MD5babc064a6fcd8a1ae728a5671482f0c2
SHA10a4b9dd6a2ca3333d8ebc9e4195bfc5b3438ee4f
SHA256acbc12ab8d34ff93511ecb9456a13876439da4a2b4c577abf490f7d557b43bc1
SHA512cdfc9c5cceac86923672ad224f9f27492b1a425aec6a4d2de11d7fcf64f752ddb395e255c2961f4c0c5102825066093ce213702de8cc032c96728ae20f66454b
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exeFilesize
797KB
MD59394e4c5dce68a62cf3ad615d013edcd
SHA10f5ce32ec230deff3fe9054640c3f0b6e1af171d
SHA256dc929eab84043576c129982cf8b0364f089e5b25ebd24693e523e2a3c781ec52
SHA5126d6112e4b644dcf8c5ae9fe7a3aee52de49f77494d371f2c1daec2ea52378921f3d41be6958fc3048f19cd45eb633e5496f42e2b9d1b23ea4c2737ca1575a1c1
-
C:\Program Files\7-Zip\7z.exeFilesize
1.1MB
MD5d4b62250046cbda2ae9ee345dd571e95
SHA12f6b859177a373aa30f85e525e48c31056a6578b
SHA2568b9bb0c7a3a848ac60cf28ea7aefefec04062525ba4c2c51e1360dad922dbd59
SHA5127a8882cd526603ad9b3130f6d004ff403ee77b905cc1a960ea6bb4e0e3321f7cf51bf31cbbd05c761c0d8f0cd99b33ce509af58d42b7ea6119a4691ff7667b0a
-
C:\Program Files\7-Zip\7zFM.exeFilesize
1.5MB
MD5ebbafaa56328ba0902ff3d9b51d08ebe
SHA1be22ce309c7e4e48e1ac48e37f368fafa1573f4e
SHA2565de24d1a1b2019ec2c35f01d627d8afd0544e0efbbf7e5cf6729a897e12d8fa9
SHA51254cf00e66aca5b39e260954d48c7014a140c99f7eb24ed2edb8dcb732e12cc1c622537d9b04de3b3e53e608967753aeccc0696489e599624ff3e61c9687f54ab
-
C:\Program Files\7-Zip\7zG.exeFilesize
1.2MB
MD534cfe4b84ef7e15eb9203d22c7907901
SHA15d1ee88ae3de51b27ab0c9027faeaa3fed065f90
SHA25665a7b8ddd63f2795f992732bd81c0ffa39da5b3dffcf1bef257b2c0ed049501e
SHA512e67bf9cefe3007b8f1a45484977b9c7c982d3e34ba527321e48391e89d040f52b749989ce5d08339c07459fb42e2b92f959f85d2d7f32080fc9c2f5e4fc5e82c
-
C:\Program Files\7-Zip\Uninstall.exeFilesize
582KB
MD522934d7f09ab3d1e199ebb26eb4ad0f7
SHA1bdb944c6dc44860f24263275755b3a376229863b
SHA256da7a8ed3f8c5fe1490b943f476a65ac4e58b2d21f722c0ca3d4f17947f45600a
SHA5121aed983bdeb2a12f437e6364666e7393ba332e73e6bc811c593f997cab24ef3076b9142f075a546eb46646c6f2e65c94338a44765ed54353dd7f1c4d8dbadced
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exeFilesize
840KB
MD558e6b09e2347708e3412f9b4c1adaa2a
SHA16b70776f86a42eeb07ae09fc05faa0d6a286cfe6
SHA2563e73c98c732e3cc492c4577553f4cc043987b67d065343c617bfecd5ffc8c090
SHA51266ba4e86ac85e281d4d4d0289af3a644981d6c66dc46581e406dc140817d7194dccf544b8252b38aab3243c0b864e0c4eb67a25326adbeb0382fb39262989323
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exeFilesize
4.6MB
MD5fbbf9a087ff2f296d51c8647af865f25
SHA11778235e02b26140bfe01dc629d41c4acf851c4a
SHA256a912173b2de27dd959d14ac3a5c96ee9c4898c5927ec8eaff1b9b119376e0dd2
SHA5128cbe58f49e3d6dd330cbaab1dfa42a91e4d2dd6f295d5a8fe0d504ad705b143d45335ca36c118dfe51734ef0730093b0fbb11c4d7c4d839573eebc7ec1969a3a
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exeFilesize
910KB
MD57c5711eb3da403abcd622b276d52e72f
SHA172aae5cfd98e58df9835fbea572e67e238fb632a
SHA256f9c8c0ce7950ea8447358301932ba354435ea0868acc76d097fbf520d52438f5
SHA5129cbcdf8ad7499de48773aab8b12d5681442d98e0e5bda1a8362a17cd6c7ac2e620c6bd9e46c6fa4a0ec7cae620901de195792875398a707e1d7164cc64c450c9
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exeFilesize
24.0MB
MD590859f44ce21f11f92e3ec564c6d4855
SHA1a2efacadc3d7189ff0a325597b4ed2b07b6a7a07
SHA256bbe65d453253058e00a1205561c9b9411fdde9d07425f7b70960b73668666248
SHA512b62fea7eb23591400e82ee133cb0ee3d3ddcf2e27c88ef4ad20148cf002abcc890df6cb1ad97c543e6c8b0eb583720fd5bc8e92c1cc2f1a37af3879af2b2ae72
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeFilesize
2.7MB
MD50c4baa8f243f39e409191475d2173cdf
SHA1d150e28d9c08e8f512ec4b4e024aa2e9fedf9d07
SHA256aadbcc0a8094303e54fbd6722afb0e93aab3c79a950a14310e5c2cb48e2c4384
SHA51285b2f02f34f88f0d8fe2b664657a6342da40390a25f3863492b3972e969adff8362cddfb9ed3c67cdda8330db406c8184a503393921545b0f7a762b61afde4d8
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXEFilesize
1.1MB
MD5749073212ddd807afca0d3cb0c8bba77
SHA185f4a29dfce37b392a06f78fd3c81981e827b7ee
SHA256420eb8578e88a8560ce21d5d71b2fe94116dcce77d778294c6819ca1dbd9721b
SHA5126e5151b660263a73fe193387124b0878bb3d06e6f0bf1dcc764eee2e65757f3ac777bf1e130594fa1436ab035a23d4b714266ba9554ec658e2f78a74e413b622
-
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXEFilesize
805KB
MD56b1fb9ae2d7554846f5be407c720d6a0
SHA1a103f9f3636a44f010cc9534c65a9b6bab6ead97
SHA256c77b14f1531e80dda71dd6715a4fb64b26f4ad8203ceb947b16c1416bd0599f3
SHA51224ea254b87f2d0230c079a4f40e22582cae94fc70ddd83c86793be219c09fa327ce2321141b7fc66f5f4653f1973a97b01740d3464e8d876de88ef425ec3a719
-
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exeFilesize
656KB
MD5ae102b4a6fd4c447482a2d5049222d87
SHA15b79dbcda3fab665023e02e89760ac88203f416b
SHA25625bb3cdac1647fe8cc53fd8e76c255c159b42344e5bd4f47e7bdfa8b72b00f55
SHA5127535b0066bb13f73828f4fc425f8ce197601e9cd6e3734a1960db663298b2650c3ac5025e2742d92891106ce70934803e30fd935ded2714dca76f4fab1e0ff92
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exeFilesize
5.4MB
MD5788409c5e9120aed89920033a158f9e8
SHA1cc567b77865aa31184ddb5472fde1ddb52d78bd8
SHA25628ad286d35c6bed6d2726bc0959551aaaaf6e8a17d85634cbc10416f13ab371b
SHA512520e5b4af73fd9ab955b89bfb75b31f69cd165ea6d2dbab8bb3ea5dbb4f4944d04ba90e429897877cde977e8b34a3e70d98662cd589e1e15805cae66e6340bca
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exeFilesize
5.4MB
MD563d70e1fdc91f5de9761ed8bda3cd26f
SHA14b43db4bdefa7b0d11a644a8a4adc5259f614a50
SHA256c845436c38792d89f573b7cab6355f5f0bfda5b8e92ffa87d62b33c5ba775d45
SHA512ad3b0f1e758eedcef070f166d212b4f92c069ebe138971b78410dc0b6e7bd715080645916eb13431d8315acb5af9e08444ef81dcb425b37edd21375d4696acbd
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exeFilesize
2.0MB
MD5e1ac7c039d5c5e2dbbcd702bdbe1b349
SHA1a6e7410caf24843dab65797f2d9244cb6a20beef
SHA256c2b10859d9d96e7cb0be3c8b891de9f35cb42c36e04ab6bd135a2ed663565468
SHA51293bc4c81741f78245830103a044f9dbbcb9b546efe7481377b94d666cf979246bfe38c95c9891da80d642f92591863f36541c738715bd37c96dad5ddadb219c4
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exeFilesize
2.2MB
MD54de9d3ffdd9f9c093a918a9537d630db
SHA1ad52c5ba54c721bd9bf8023fbd9f68607621fe42
SHA25616551f3ef66ed7233c0a5b6984f32e0c7a03669b76eba46cedf61646dddd5930
SHA512c0c501dc6b85f48fc2547b479682e149d73908eb1750988eabae7af59526f10f8b314a4470e3d2e5230e729bec9e48294a0b2e1c6cb07695c717b0fe616cda4a
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exeFilesize
1.8MB
MD5f5cf5a9c5c880e5fec85b44fbf34bd71
SHA18368c1255bc916bf8c89b3f90a209a25ab003a31
SHA2563016fd5224bd12a53824abf307e9c0ad2dfc7f776996fe4226abcfa37db76225
SHA512a84584221619b3424b9cae407abaeb1c307b041e0dd4de19755aad950fbfc8e3bdd32b6e2a2e475383de861f653736b5b76a3abd2b3197a7f41b86bec5f89398
-
C:\Program Files\Google\Chrome\Application\chrome_proxy.exeFilesize
1.7MB
MD5ee478ad0169f871ea73641530408481f
SHA10b67098e9e7fcb4b2ac1b2e060ee083a3c12b01a
SHA25668c23494487484616622a20f7d4cb1d0f13c654b74f62a0aef9a1f4af5806816
SHA51247b1b8dac30a41322f7cb871326f2908702eae7f5cf7b9b92def7b5d5a33c102cccebfd28d14a5715f8e33fea810f4a3be91da39d8f9ebf02df58f0c56ab2505
-
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exeFilesize
581KB
MD5496d2852c3a27d7fbd0e0bb77b148121
SHA1d17fa7ea2be5d38ec868d838f2585f7fa2108d5a
SHA2562be80f993462225ff25564f6fd84f071d039aa9da6470d54e1eadf33650c138a
SHA51230f35a3cf85889a2fa0fea32631fbb04f1cc308db50cdf4907cd330be5bcc5df4917186b4ef1a883a12402e6b6fdd73aeecd6b67d4e72319775720ad524f6520
-
C:\Program Files\Java\jdk-1.8\bin\extcheck.exeFilesize
581KB
MD57a6583ed0c5b6fa7ae3d5e568ba662c4
SHA12e765d7c177e9d94b33cc3bac771df98b46fc7e5
SHA256ce565da44bd2719d6c57094176643fcd276ba651bf5dd25a03ba96fcf04d41e8
SHA51288beb265eafb76a0d07be47864cc20e936093a18761dbd591879f734ae52e1703979c9e916a41b3a45c2caa62f74a7a1d5665ef290aa8470c5c5b21ff30f4d4e
-
C:\Program Files\Java\jdk-1.8\bin\idlj.exeFilesize
581KB
MD5a7e50e057ce51c1e47e505fd1c20c52b
SHA1f3e8de458162e167d6571d9d350e5a018e5fe233
SHA25621a65007ccd9caf3dc0dc295b1eb2e783dc781f3a4ddcd1aac99e7d6fd805220
SHA51226a40243c87daae93ca5b53ce3ff2957242c0662f75e708a2f6bc125b6ff54dda59fed3562088a822b606617cff0b38a8cadeb2a5a75cd0835a98190a84ad0d2
-
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exeFilesize
601KB
MD5c7a21a1f0b23c5fadd52de13ebf4f02a
SHA155a777f4433df432894c4d30e35df1d09f1019df
SHA256a79a594047645a2048d6f8e5ef0bf65a1920684cbe2f836671023034619815e4
SHA5129eb01bccb732ccc4aa010138d9eb3daeb5c6a56b0aba43efcdb6b02135c32e217fb0d2b2d6490fce2c5b0fd35be2f55191a1e8bf991572d34968f209be9a7473
-
C:\Program Files\Java\jdk-1.8\bin\jar.exeFilesize
581KB
MD59cf90f47b25f0f8fbdf2f504e58ec880
SHA17f7fbd6888143a9a6e3dc9dbe0b536131bf8095e
SHA25633386ad58bb672c9064481cfae8f58aa1af7d18a580ca364aba35fcb03246c4f
SHA51234a544964ae4319eda80cd0938fb2a5f1bf587e58b5fb43edb40c9952d79193063c9a4ae43cb45ba406ab32bb9cc320c99fb37652c303f7573375b83978a6de7
-
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exeFilesize
581KB
MD51b486b887d4221761aa55c989d3e9d37
SHA1abe81d656500301918664e6f86a846347c4d8446
SHA25637135f861332124e3e957487a4a86bd3dcd239a124f831aad4955cdfe5bb1ac7
SHA512d06b395eb990b603276a88137702e4ad16752988d54e3f4bd96f57fe397ce4b3d1e32bb45ac4b8bc88f9c77c3160c2d249fb08a1d1ef900e6b825afa9da6a46e
-
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exeFilesize
581KB
MD51a1c95a6cac103f4ba9b7dc65aaba09e
SHA1d97653d3d9740e94c5fcaaff7aaee20f74ba15eb
SHA25637614b6bebde98c46077990cb83b1ea6439f04e09d17a063605b20fbadbe49ac
SHA5129d29c4d818814ed6ec33bba5ae9214431e8b5c6627482bc33e20281da9edef1b2dcf4ddf3ab5372425e197a0263cc0b5cf847105ee66ca0f9cc62520b74a031f
-
C:\Program Files\Java\jdk-1.8\bin\java.exeFilesize
841KB
MD558973355fa066e351b1f9d89a5a11f4d
SHA1f6ca673a1c7a4b792ae47e9a2ac853a1b5c7c364
SHA256d18d63bc5020983dbb8842d55a71d26665ad09bc9c8987f2b7763fe354e3f6cb
SHA5121ddce3b403acf0b08e4daae0ed5f0d33a184479867d8cafdb1170ecb66d25bd2425740881799dc5821136a89eae682c60c74d62ab5c962d44c5556598d2beb6a
-
C:\Program Files\Java\jdk-1.8\bin\javac.exeFilesize
581KB
MD50132b95edbc997ef2fc0c1a7994cfed8
SHA1c929bc02d7a1dc0aadaf8556b1d7e38deb1d00c2
SHA256c3d2fa0e94b95ea71327bec37b21768c4e0d580bc2ee0c1660a9fa22db4aba1d
SHA512f98d747e445fbcfb267dacf882a5a43d5b4a9a366e49ee0cf1dad21afc5fc7cfd90d24ae68cb2e9eee0c68f2800316357cc0983009dac4df4be2e213cf76c666
-
C:\Program Files\Java\jdk-1.8\bin\javadoc.exeFilesize
581KB
MD58eaf9f0561dca113050276ba6dbfd7da
SHA19931484f3bb7ea32764e1d94ec9a8f5e0025fe6d
SHA256c92f6a99ec7d499c555bfe2b64a0a4301828efd31f33813c04ee4d5ecd8b95a5
SHA5120884c581e0f19575733028796e15fcc09c7bef6f6c2bc1d3bd6ee27dcb977e45826f164229b1e5a42f61c84fb0bdd14c2b10e05f3a1ad8d99e8f268bdef3cab5
-
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exeFilesize
717KB
MD526337b99561a802e180bd33a6a80dd63
SHA10d5fb1af90decb934a00533f71a93d07cd71628b
SHA25675b9e2789f8304b78777ad0d80b907a3920887d0d62d07097c87acb1a04d98d1
SHA5129205f5d7466e55dcdf88d37747551d0e9115b5793fd2aea02128f1cf6a134a2a765df2a2f10b00237f098b745ccc08647e10d18424d805ac588104b04fc7b274
-
C:\Program Files\Java\jdk-1.8\bin\javah.exeFilesize
581KB
MD53d6f7c74756d58113386affd51415ebc
SHA122d4bcaa31a745628824db7210d9c93ff5c25612
SHA256bcaf62f5a1b0d31b8117ac376660932fab286104a710bf8d72b14d15c979cbde
SHA512e60de0da0371f3a472689d7ee994837e1d32cba05d4156ed8259349bf163d8774164c220bf55027a774b65d47d7ad4d215c4aefe7a774ac27a6d3c96a5d9c7e8
-
C:\Program Files\Java\jdk-1.8\bin\javap.exeFilesize
581KB
MD547a4394b0162921533f6070e5628c418
SHA1e640f21390a7bea5992f91aaf4485b75067ac6ec
SHA256b69dd2f32eb78d5cd83a95eb414f8d88f3c2fc542d679401c123d3061d787405
SHA5126a3102e87144ad1da8d730659aae89f7c4c14ef85d23c0c6b92f49e58b349cc1c63b4ff6425f611be6536a793ed5ad0adf9b6b4253fe2de39d154d5fa73b95f7
-
C:\Program Files\Java\jdk-1.8\bin\javapackager.exeFilesize
717KB
MD532aaffaffa04c9943f2b522647099ceb
SHA18b115c4933cfa96a59a823b476d28e961b7efeb0
SHA2560e31442b3e4bed30a90aa82c98e6feaaaacb476b7387aa4f640d3c20b99c79cc
SHA5126af07d3b452ce5d28ba694f1f5545b6eea43ebfc1daa405cd287a267b18f7e005ba2d466e8e48205853d5fc9ed28f293420886b8f91c0d858a2d11a47fe463a0
-
C:\Program Files\Java\jdk-1.8\bin\javaw.exeFilesize
841KB
MD5d316c22e35a1d8247316901b0930f6ed
SHA1eac267e0cca4035234ce48ad23b66b6d056591a5
SHA2568927876068ca0f36743c3c6de9bfa0d943be646b72e353f714bb2ce5a4b32dc5
SHA51234261248f36e627df661d1862f043e0ebc6e7f953985767e0f4068c9dc0d7ce09658bb6c006ed051a4ebc4640a1ba51c46d17c6966a1e712196331bc5043f5db
-
C:\Program Files\Java\jdk-1.8\bin\javaws.exeFilesize
1020KB
MD5d2cbc93ab4ea0f4322eb2b112cc4434e
SHA10f05be38ac4bc35232c966a0d1f94f245dc545ad
SHA256efe4d48346e46004822379be6850959ab51bf12f9833c237b667cecfaa74701c
SHA5121387e6604666bea00a690f763d3b86d0dda8f439ccfe1d58db91a7cc6779ad6c011c0e02666860437ce0038e9eaee17d2cdb5bc3e3abb4283eccf37adfe6f88b
-
C:\Program Files\Java\jdk-1.8\bin\jcmd.exeFilesize
581KB
MD595984744f184df308a4d5d2e02de225c
SHA10152d9979c6edf01f13da023de55f4d6d77f11bf
SHA2565f50a8770167a667442dd0c91a641424075b1f51dd6b1df42579c884e575a104
SHA512df8c28d60c3558a74ded70934af71a076446266ccaddc75be0a8ab15cab3849d9a5e882deb55d238829c9c9c116a56163031f11768576e0bc43d6126cc24b54a
-
C:\Program Files\Java\jdk-1.8\bin\jconsole.exeFilesize
581KB
MD581863c016cd00bbf9595e4ad2a97b90c
SHA1c52915a9ffe23b9a85a37bf837e9386cbc60506d
SHA256e067ef40e9a6a8d4c82b065663d347e3ff838e7ab0181596258dc24451326c8b
SHA512b31bad24a0b772c841d5f45c3ca1ed92dfe849661b37f7f3458d20a899870f73147c01d34a3e1a151e6f387a6342c62a3dc8d12b28e707b7998eb837fdbb1bcc
-
C:\Program Files\Java\jdk-1.8\bin\jdb.exeFilesize
581KB
MD596b9937bd895c61890b00bcd466eb67e
SHA173f386a7a134f49e1e4f67b0af4802196bc42ef2
SHA25685c108bcdeba10ce15da90e82c8d99d589487d483c5b35ccf73fa857832fcf30
SHA51210cddeb67c988a2398687ab44ee06c0cd9847245fc4b282ff05242376cab8711541cd1dcd8219bf86421e720c63dd2718986fd774ff3a4de0a0ab5b64aa9c4e6
-
C:\Program Files\Java\jdk-1.8\bin\jdeps.exeFilesize
581KB
MD5e2301fd3fce47e12caed02f05e0c7382
SHA17e312dc4b6fe170bc259a4d4c940d5ccd4c9787c
SHA2569dd5dcbf433249e92984bee47f3e6f1ca23415868ef7ee6e313f4916cf3a0f65
SHA512a0c1678b57eac6528af967234b0666195a88d1911a1d436b6e497a47a5f35968c3900d9c749c0efe202e3f144773d83485557a79119a3ebfb877e6a95e10899d
-
C:\Program Files\Java\jdk-1.8\bin\jhat.exeFilesize
581KB
MD5f9665f79f2c05d8b9aa52b3dd209da36
SHA147183537801c3b5b4561e0df3752df6c92617c9f
SHA2561d1c38599e2894f688446cac45afd40db63321aee566f6e665bf049f39abeb24
SHA512d5e7b4185633e36b38102658385f9af8b8b5d8da4fedc373e9ee154f41a5ee4e7d15a0a89542a58abf023de955c7a802fca3b1be6aeedf6048af3b8d458a7b19
-
C:\Program Files\Java\jdk-1.8\bin\jinfo.exeFilesize
581KB
MD5ca706b2acc1ede8935c283e9dc91a037
SHA1de07ab987f5da401a76ade2f261b06c01cb87b0b
SHA2569768b4301feffad2ab50256e5d02b19109befb11e2a522bc9f2f79757a0d192c
SHA5125f609ca1ed0eaee1466a5b7db2e89d8575a16b5736551ad6bda5635f5830e372ef078acd076c1e53ffb478c189ebd07dea18803180f8ca3cca74c7457f13daba
-
C:\Program Files\Java\jdk-1.8\bin\jjs.exeFilesize
581KB
MD5e81caf384f6be8cea6b98b4ea90f956c
SHA10e5be400fa26d06a5a5b15dbbe3e77b2c6a59437
SHA2564b0d30d29e285b9287eeba8d8ed3f5123363395e22ac73c2c93d42ac15c908f2
SHA5126d451176a5c281982d7f644252b8a4ddd2b2186bb357adfb9dd2a309bd1be55ff454985534a1d27635610ee6a8965c706f3673b23f8a3d9cabe99654b531e31d
-
C:\Program Files\dotnet\dotnet.exeFilesize
701KB
MD5af7675c0a858f548306405f6ad1bbf8b
SHA147dc819823645f25b75b7216e8705ae70192fd9a
SHA2567e90c60d04c3abb9e0f126bf44f36adef196f478090bb28eb018d41654b6409d
SHA5120ea7d6dfa3d21f5644845315f42f6ff2fbed9f22898a2c13cd200cf2ff41fd24fb4aa20d537c58b3037d826742071be688c29f35c6a2aa729c9577e766cedd2b
-
C:\Windows\SysWOW64\perfhost.exeFilesize
588KB
MD5d4a6f6bcd0de833934449b403aff4bfd
SHA108d4350b07eb9e41b1f5b6777ae04d1686d5d360
SHA256e217f8a4614571dc98df7956e51c888eaa842dab1bd41fe019617c4e357df2aa
SHA51227ffa1997fea05b703ae6196a1f40660e572acf71e1edcb60a31e232bd863cab700e819a851918f2e780c5e73ef85e8efc83d980eef3e05a491b3280357ad658
-
C:\Windows\System32\AgentService.exeFilesize
1.7MB
MD594547f87f11befaacf071e66292649f5
SHA1eef5f00545bd4a1eb06d422fa674175fd5aa247d
SHA256de232d0347a1f52e16a5e36f7bc098ae80ed7323a36344a1456c9d6494e7dc5e
SHA5120933e7d7a8aba5d63a176f6b558ea8dd55c76d27c3d6f28e219c1e36df881540f9edb6dfc4c9e0c30a9a311eaa1ccaeb6fac633cfec060a49230c9ab232a4389
-
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeFilesize
659KB
MD50f9257c47379bab595427d016adf5fba
SHA15971740590fc1377d9535fda19f972fc2ab52833
SHA2560756c545e886fdfa25c39a237b5dca9ad1e72cca833614cd0773e8eba005009f
SHA512ff5edc59f72f05e2182d1e4446eb4417f318a262ae367fb8039f86af402d6383f92b18c5ed2e064b20f1f93676e02a5295cedf04685f9a73d249f9bbeac066b3
-
C:\Windows\System32\FXSSVC.exeFilesize
1.2MB
MD56e116c9c6599fc14e78924800da51b8a
SHA1b12419d3b062aa27720d6877f7d72ddd32957d3c
SHA256ab3fb2173e3184688566324a15a40c94dd6ffdf59eb08b19d58c50e7d4d6f980
SHA512188ef34fc238dbe582bc29d16b1b7396b424e2abcf911d105fd589a6f99e39b43b73b1f021ee5535f807f6fceaadca5b74f3b4eb33432302f0e19c05267e7b1d
-
C:\Windows\System32\Locator.exeFilesize
578KB
MD50a6040d83fd2597a41f99aa08fb297f4
SHA1b522f1dc6d76d324371879dcf689ab26966f4c6d
SHA25626644e5dd8d57d55e8b3edd0764e6e44e6d4f98e8c3417982c8701cce43be89a
SHA512375040e98da18ae41809f1fa9262a986c9c02f82f84d8ddac1d2f22dba85a7f21a0a1290bce57b93e066818b64aa5742c73013111a523592c958cf819a5e616d
-
C:\Windows\System32\OpenSSH\ssh-agent.exeFilesize
940KB
MD56c178474a26abf047eb3c9ec54aadcdc
SHA1fbff1b890a31ef61724b7ccb8f9f9dbfed6ea6e3
SHA2563e614a86b270e48001120002fa1df7992e14ed6f52901dee3df9ea5e3c7465f4
SHA512d8004ae1c3f229e2daba3beb08fb6404274550562a35a36f8cc0e41583a459f54bcb767d534f6c42c021df67596e3f0d8bdc05e281d17cd530f124c38639896f
-
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exeFilesize
671KB
MD52e92b955f04a43a9556f9274a4befd1f
SHA191688cd55c1e752238fb2805323efa2986bb2b0d
SHA256975d752857c939af48b80a3ebcba0331fe2d2c19671c40796597daa7c691e300
SHA51231d180065512e52a6ef8b5946b1dd0dce9dd8aa42bd0d99ff967d53d1c2c0346900f96fda7825857610e852f4ba59a4a99df2be5ee354f64558d73671b959c8c
-
C:\Windows\System32\SearchIndexer.exeFilesize
1.4MB
MD5462b23a29e4bca73e9528605bf0164cc
SHA1ab76ccf993d8c07fcef19c6ac545c6d3ef0f40f6
SHA2564e4e9779616e6941f5f96cdaf2d42e4ecdda17955211e9f5af757a0214b19c2b
SHA512c6940a21a310e61f872824b88d6df5e614eeef516b840473b699b01adeb5ba89ddd7aaf1fee6d83e2ebdda7850da391d87cdef8d13bbfb8192455fc8dfadd77a
-
C:\Windows\System32\SensorDataService.exeFilesize
1.8MB
MD53d4a6d27f10e4bef2cca2cc25c81dfac
SHA1e7227efd0a96d47b5f40f4a0d3f2a81f31435961
SHA25600aefff21d1ed3fd518aabafdb690ced923a2d6ab461526d973aebf90c06e1d1
SHA512c9ed95d0f644aea908a0246be54c94290ff7402215fd3b57ea8320e2f2f96024df50ea4088cc1dff5488affe81a3d22a615605cc2bbe71d8d3035b3da493fc44
-
C:\Windows\System32\Spectrum.exeFilesize
1.4MB
MD542e2666b3fd0dc52b8d388123dfb11d7
SHA18c4eaf7d2796ee920c77d53e37ecc2000b2f0d63
SHA25629ef037fed9155b10df4c88dc10703007c24bf59c30e0597271de8843432faf6
SHA5126fc2d4be68683e77a26cb6769697916d52e4207647639277420b8b021fa37b2dbcae8ed58720dc9c13fde5d7bdb0cb92aa0b782466fdb4d523dfabc4c19cd137
-
C:\Windows\System32\TieringEngineService.exeFilesize
885KB
MD5d1e896469de06d20babc0471fb0d0052
SHA142e133e371813ae3afe45df2bcf66035df81e516
SHA256791ec4c5b6f90c0009819d986110cee8680fc9ebe68037cade559275ca27164c
SHA5128f0b5d23456ab1c71d68cb8761178f95e7161386f4bef1a35c21850a442d8df35561952ddd9d32b41defd8b43603688aa7541b3f9853527c24d897ec6d2864da
-
C:\Windows\System32\VSSVC.exeFilesize
2.0MB
MD5f3c03f27e41c592802a6c187bfeda9ab
SHA16c104881c28f92a3d42f8be754441296634d25e1
SHA256150259ea8cc7d82990ecaaef49426f323608070bc001837b93e7296622a2af40
SHA512bb38756784561d926a389ac2f1d593a377cb82b88d96d3aff3f2ee087e08123ea36656124f3b9b354e12f71ef72301f1d89bfde4f798de9fcc3e64e2497421cf
-
C:\Windows\System32\alg.exeFilesize
661KB
MD527993e41519a8b1cbdec9a1aebcbdba2
SHA175d2ded0549065f0b285f7ff6c20e18a1917f0bd
SHA256f3231fc666ba91a5c60bcd452a32efb808d5daa71253707a22e94ec11c916893
SHA512f491b87628f80588ae304780934ad1bc76b17af1216d63bf53d07b47b73cb90e1d11c1a2e401ed6ea845aea41e8eabca953379c105f6fae4318811823c4c4918
-
C:\Windows\System32\msdtc.exeFilesize
712KB
MD5834db62727f7d3c63659a1ccb120817b
SHA12e989907de51b5f4086fbd01fca3089260645b57
SHA256dfa008cfaca68b1e36a00e28f017060feef6be4168f0e9402d88030ae609f57b
SHA512cfd08c5bc98b5c405423db50757b758c619e753ae1743a912718afe83ef35d9f7a3a3008fb3f8cfb41f434125f1d644d120cabab26f98b02b2f8b5f36faa98d3
-
C:\Windows\System32\snmptrap.exeFilesize
584KB
MD5372a9dfb37c73036424154464e87d74e
SHA1bc5f3009aeea86988ff02bff46458adb35462f90
SHA25606b85456315fb7b48c4d64b1f604d52d4f4ed5343cfc35361c13adb409f3b531
SHA5123a96bc43498654f787e13484029b4530b695992fd6ff73cecc15d149882abdeb7b81066323ce1c390794af91dead35d7c32607aee91d9c3b284cd820845cf8c2
-
C:\Windows\System32\vds.exeFilesize
1.3MB
MD5f318413fb9979d04953a57509d11524c
SHA1accca5e2d1dd5f2441d2c068da7ba24c6726c740
SHA2563f034ecf3056a4ecaad746ea56adff1b60154024b4cad77a075e6fdff01e77d6
SHA512bb1912e8886240f3918b449517f69facc1557184376e075ee8da8be6c7fefe8628e930f059ace697efb04b897ac229c6c9136ae46dc7f709a98f06fc93d92988
-
C:\Windows\System32\wbem\WmiApSrv.exeFilesize
772KB
MD5013b680f711fd028666df413a1b4b128
SHA116e3015bf0dcc9b9768affa066199a12a89c7144
SHA25632cec0a0c14917029bfb6d0538c8d2b42ad7b097544e8cf4252a396186f2c53c
SHA512a7a3bf21643b2d499e3ecd98a48f101768e4c36efb0f9f1f1d48bdd129d8b144170250c9b7f893c6e6e68bd865978993e016f9c9fed230abc21cfd175889047a
-
C:\Windows\System32\wbengine.exeFilesize
2.1MB
MD595a38f7ac850e209226e37694a570fda
SHA1b157f9a8744cab33825bd5f09f349e4decbf0b4b
SHA2563791e63cfdf993d372cc952515a869e97e31fb25576d34b33b5f56e887e01afc
SHA5129a289162477d01925d45bac180f42baea429824e336eb94a95b1320d09698ede1ef447aeff9b898d4b363546034addcb81d595e36e1dc72ef64d7bff725ac646
-
memory/116-296-0x0000000140000000-0x0000000140095000-memory.dmpFilesize
596KB
-
memory/116-415-0x0000000140000000-0x0000000140095000-memory.dmpFilesize
596KB
-
memory/404-236-0x0000000140000000-0x00000001400CF000-memory.dmpFilesize
828KB
-
memory/404-69-0x0000000140000000-0x00000001400CF000-memory.dmpFilesize
828KB
-
memory/404-67-0x00000000007B0000-0x0000000000810000-memory.dmpFilesize
384KB
-
memory/404-61-0x00000000007B0000-0x0000000000810000-memory.dmpFilesize
384KB
-
memory/412-649-0x0000000140000000-0x0000000140102000-memory.dmpFilesize
1.0MB
-
memory/412-342-0x0000000140000000-0x0000000140102000-memory.dmpFilesize
1.0MB
-
memory/448-379-0x0000000140000000-0x00000001400B9000-memory.dmpFilesize
740KB
-
memory/448-267-0x0000000140000000-0x00000001400B9000-memory.dmpFilesize
740KB
-
memory/464-235-0x0000000140000000-0x000000014022B000-memory.dmpFilesize
2.2MB
-
memory/464-38-0x00000000001A0000-0x0000000000200000-memory.dmpFilesize
384KB
-
memory/464-44-0x00000000001A0000-0x0000000000200000-memory.dmpFilesize
384KB
-
memory/464-57-0x0000000140000000-0x000000014022B000-memory.dmpFilesize
2.2MB
-
memory/1332-279-0x0000000140000000-0x00000001400AB000-memory.dmpFilesize
684KB
-
memory/1332-391-0x0000000140000000-0x00000001400AB000-memory.dmpFilesize
684KB
-
memory/1484-377-0x0000000140000000-0x00000001401C0000-memory.dmpFilesize
1.8MB
-
memory/1484-365-0x0000000140000000-0x00000001401C0000-memory.dmpFilesize
1.8MB
-
memory/2100-330-0x0000000140000000-0x0000000140169000-memory.dmpFilesize
1.4MB
-
memory/2100-645-0x0000000140000000-0x0000000140169000-memory.dmpFilesize
1.4MB
-
memory/2160-58-0x0000000140000000-0x00000001400CF000-memory.dmpFilesize
828KB
-
memory/2160-48-0x0000000001A70000-0x0000000001AD0000-memory.dmpFilesize
384KB
-
memory/2160-54-0x0000000001A70000-0x0000000001AD0000-memory.dmpFilesize
384KB
-
memory/2160-70-0x0000000001A70000-0x0000000001AD0000-memory.dmpFilesize
384KB
-
memory/2160-73-0x0000000140000000-0x00000001400CF000-memory.dmpFilesize
828KB
-
memory/2280-404-0x0000000140000000-0x0000000140216000-memory.dmpFilesize
2.1MB
-
memory/2280-655-0x0000000140000000-0x0000000140216000-memory.dmpFilesize
2.1MB
-
memory/2460-654-0x0000000140000000-0x00000001401FC000-memory.dmpFilesize
2.0MB
-
memory/2460-392-0x0000000140000000-0x00000001401FC000-memory.dmpFilesize
2.0MB
-
memory/2660-315-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/2660-648-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/2660-430-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/2700-231-0x0000000140000000-0x00000001400AA000-memory.dmpFilesize
680KB
-
memory/2700-15-0x0000000140000000-0x00000001400AA000-memory.dmpFilesize
680KB
-
memory/2700-22-0x00000000006E0000-0x0000000000740000-memory.dmpFilesize
384KB
-
memory/2700-16-0x00000000006E0000-0x0000000000740000-memory.dmpFilesize
384KB
-
memory/2896-403-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2896-294-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/3668-658-0x0000000140000000-0x0000000140179000-memory.dmpFilesize
1.5MB
-
memory/3668-437-0x0000000140000000-0x0000000140179000-memory.dmpFilesize
1.5MB
-
memory/3736-380-0x0000000140000000-0x0000000140147000-memory.dmpFilesize
1.3MB
-
memory/3736-653-0x0000000140000000-0x0000000140147000-memory.dmpFilesize
1.3MB
-
memory/3904-319-0x0000000140000000-0x0000000140096000-memory.dmpFilesize
600KB
-
memory/3904-532-0x0000000140000000-0x0000000140096000-memory.dmpFilesize
600KB
-
memory/4120-360-0x0000000140000000-0x00000001400E2000-memory.dmpFilesize
904KB
-
memory/4120-650-0x0000000140000000-0x00000001400E2000-memory.dmpFilesize
904KB
-
memory/4420-416-0x0000000140000000-0x00000001400C6000-memory.dmpFilesize
792KB
-
memory/4420-656-0x0000000140000000-0x00000001400C6000-memory.dmpFilesize
792KB
-
memory/4464-1-0x00000000007F0000-0x0000000000850000-memory.dmpFilesize
384KB
-
memory/4464-0-0x0000000140000000-0x000000014009C000-memory.dmpFilesize
624KB
-
memory/4464-14-0x0000000140000000-0x000000014009C000-memory.dmpFilesize
624KB
-
memory/4464-11-0x00000000007F0000-0x0000000000850000-memory.dmpFilesize
384KB
-
memory/4464-9-0x00000000007F0000-0x0000000000850000-memory.dmpFilesize
384KB
-
memory/4496-33-0x0000000000C50000-0x0000000000CB0000-memory.dmpFilesize
384KB
-
memory/4496-27-0x0000000000C50000-0x0000000000CB0000-memory.dmpFilesize
384KB
-
memory/4496-36-0x0000000140000000-0x000000014024B000-memory.dmpFilesize
2.3MB
-
memory/4496-234-0x0000000140000000-0x000000014024B000-memory.dmpFilesize
2.3MB
-
memory/4696-265-0x0000000140000000-0x0000000140135000-memory.dmpFilesize
1.2MB
-
memory/4696-254-0x0000000000EB0000-0x0000000000F10000-memory.dmpFilesize
384KB
-
memory/4696-252-0x0000000140000000-0x0000000140135000-memory.dmpFilesize
1.2MB
-
memory/5000-353-0x0000000140000000-0x00000001400A9000-memory.dmpFilesize
676KB
-
memory/5000-242-0x00000000004C0000-0x0000000000520000-memory.dmpFilesize
384KB
-
memory/5000-248-0x00000000004C0000-0x0000000000520000-memory.dmpFilesize
384KB
-
memory/5000-241-0x0000000140000000-0x00000001400A9000-memory.dmpFilesize
676KB