6b0266a2d7a94bbe53d82c7e38fa4311e8191543048312c3927d889b43435a4b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
Size

3.1MB
MD5

0f60121c8aa3c904ad5df6650008cb90
SHA1

83171758b8e5dfbec00234e036fd27899d51098b
SHA256

6b0266a2d7a94bbe53d82c7e38fa4311e8191543048312c3927d889b43435a4b
SHA512

0c2bd0ca2bdbc08ebbc9e60d1c6368cd20133d3fb18274efedc3037d93a8ad05cd93e54ca9bbda5603ee5f28b23ccf04d9be485e745fb172e756a3c3d3390072
SSDEEP

49152:5FoHgEIXrjXfE44zAKveF+7YdOcYTBZEjUqxZgJGLfgqjJUDYWbXnrfPOkhqvq:MHgNDfXQ1veFPk5FaoCRrgGUDx7Okf

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 24 IoCs

pid	Process
2960	alg.exe
1904	DiagnosticsHub.StandardCollector.Service.exe
4488	fxssvc.exe
3768	elevation_service.exe
384	elevation_service.exe
3304	maintenanceservice.exe
2272	msdtc.exe
3008	OSE.EXE
208	PerceptionSimulationService.exe
112	perfhost.exe
4076	locator.exe
4384	SensorDataService.exe
4556	snmptrap.exe
3312	spectrum.exe
3432	ssh-agent.exe
8	TieringEngineService.exe
2752	AgentService.exe
2524	vds.exe
1720	vssvc.exe
4420	wbengine.exe
2976	WmiApSrv.exe
3360	SearchIndexer.exe
1944	VCREDI~1.EXE
1116	msiexec.exe

Loads dropped DLL 1 IoCs

pid	Process
5732	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	VCREDI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ec7e5c851ed82f9f.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	elevation_service.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e579e63.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448612.0\mfc80CHS.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448346.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448752.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240527001448346.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448440.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448612.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448752.0\8.0.50727.42.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448299.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448737.0\8.0.50727.42.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448737.1\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240527001448799.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240527001448737.1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA78B.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448440.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448612.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448799.0\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448346.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448612.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448612.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448440.0\mfc80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448612.0\mfc80JPN.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240527001448299.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240527001448612.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448799.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240527001448784.0	msiexec.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448299.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448612.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448737.0\8.0.50727.42.cat	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A49F249F-0C91-497F-86DF-B2585E8E76B7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F8C.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448346.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448346.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448440.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448612.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448784.0\8.0.50727.42.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448299.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448784.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240527001448752.0	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448612.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448705.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867.manifest	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240527001448737.0	msiexec.exe
File opened for modification	C:\Windows\Installer\e579e63.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448612.0\mfc80KOR.dll	msiexec.exe
File created	C:\Windows\Installer\e579e67.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448346.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448440.0\mfcm80u.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240527001448440.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240527001448705.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448705.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448737.1\8.0.50727.42.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448440.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448612.0\mfc80DEU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240527001448705.0\vcomp.dll	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005b1010511f65dd1c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005b1010510000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005b101051000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5b101051000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005b10105100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d334cdbcaafda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdfeb5dacaafda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1e759d9caafda01	SearchProtocolHost.exe

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\ProductName = "Microsoft Visual C++ 2005 Redistributable"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\F942F94A19C0F79468FD2B85E5E8677B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F942F94A19C0F79468FD2B85E5E8677B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F942F94A19C0F79468FD2B85E5E8677B\VC_Redist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F942F94A19C0F79468FD2B85E5E8677B\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Version = "134268455"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\PackageCode = "FA1F9ADB128EB664EAA9BA3CE244C0B1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
1116	msiexec.exe
1116	msiexec.exe
1904	DiagnosticsHub.StandardCollector.Service.exe
1904	DiagnosticsHub.StandardCollector.Service.exe
1904	DiagnosticsHub.StandardCollector.Service.exe
1904	DiagnosticsHub.StandardCollector.Service.exe
1904	DiagnosticsHub.StandardCollector.Service.exe
1904	DiagnosticsHub.StandardCollector.Service.exe
1904	DiagnosticsHub.StandardCollector.Service.exe
3768	elevation_service.exe
3768	elevation_service.exe
3768	elevation_service.exe
3768	elevation_service.exe
3768	elevation_service.exe
3768	elevation_service.exe
3768	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
Token: SeAuditPrivilege	4488	fxssvc.exe
Token: SeRestorePrivilege	8	TieringEngineService.exe
Token: SeManageVolumePrivilege	8	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2752	AgentService.exe
Token: SeBackupPrivilege	1720	vssvc.exe
Token: SeRestorePrivilege	1720	vssvc.exe
Token: SeAuditPrivilege	1720	vssvc.exe
Token: SeBackupPrivilege	4420	wbengine.exe
Token: SeRestorePrivilege	4420	wbengine.exe
Token: SeSecurityPrivilege	4420	wbengine.exe
Token: 33	3360	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3360	SearchIndexer.exe
Token: SeShutdownPrivilege	4340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4340	msiexec.exe
Token: SeSecurityPrivilege	1116	msiexec.exe
Token: SeCreateTokenPrivilege	4340	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4340	msiexec.exe
Token: SeLockMemoryPrivilege	4340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4340	msiexec.exe
Token: SeMachineAccountPrivilege	4340	msiexec.exe
Token: SeTcbPrivilege	4340	msiexec.exe
Token: SeSecurityPrivilege	4340	msiexec.exe
Token: SeTakeOwnershipPrivilege	4340	msiexec.exe
Token: SeLoadDriverPrivilege	4340	msiexec.exe
Token: SeSystemProfilePrivilege	4340	msiexec.exe
Token: SeSystemtimePrivilege	4340	msiexec.exe
Token: SeProfSingleProcessPrivilege	4340	msiexec.exe
Token: SeIncBasePriorityPrivilege	4340	msiexec.exe
Token: SeCreatePagefilePrivilege	4340	msiexec.exe
Token: SeCreatePermanentPrivilege	4340	msiexec.exe
Token: SeBackupPrivilege	4340	msiexec.exe
Token: SeRestorePrivilege	4340	msiexec.exe
Token: SeShutdownPrivilege	4340	msiexec.exe
Token: SeDebugPrivilege	4340	msiexec.exe
Token: SeAuditPrivilege	4340	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4340	msiexec.exe
Token: SeChangeNotifyPrivilege	4340	msiexec.exe
Token: SeRemoteShutdownPrivilege	4340	msiexec.exe
Token: SeUndockPrivilege	4340	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4340	msiexec.exe
4340	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 3484	3360	SearchIndexer.exe	113
PID 3360 wrote to memory of 3484	3360	SearchIndexer.exe	113
PID 3360 wrote to memory of 2668	3360	SearchIndexer.exe	114
PID 3360 wrote to memory of 2668	3360	SearchIndexer.exe	114
PID 1520 wrote to memory of 1944	1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe	119
PID 1520 wrote to memory of 1944	1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe	119
PID 1520 wrote to memory of 1944	1520	0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe	119
PID 1944 wrote to memory of 4340	1944	VCREDI~1.EXE	120
PID 1944 wrote to memory of 4340	1944	VCREDI~1.EXE	120
PID 1944 wrote to memory of 4340	1944	VCREDI~1.EXE	120
PID 1116 wrote to memory of 5488	1116	msiexec.exe	129
PID 1116 wrote to memory of 5488	1116	msiexec.exe	129
PID 1116 wrote to memory of 5732	1116	msiexec.exe	131
PID 1116 wrote to memory of 5732	1116	msiexec.exe	131
PID 1116 wrote to memory of 5732	1116	msiexec.exe	131

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0f60121c8aa3c904ad5df6650008cb90_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i vcredist.msi
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4340

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2960

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3036

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:384

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2272

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:208

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:112

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4076

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4384

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3312

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3976

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2524

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2976

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3484
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2668

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5488
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7190B7849EBB1E8F4555BCB1FB5A8900
  2⤵
  - Loads dropped DLL
  PID:5732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e579e66.rbs

Filesize
27KB

MD5
403dbd2c47c56339e3af99d9d9a36955

SHA1
e60a981a3aebb5bf0b355dced62263d1e30d3ce4

SHA256
0937bd90a79808073afc31312a402b5fdc5ae4976a1602f729eef929fa8829f1

SHA512
793b41990a6741036f9b546c96b323a89ae5e581f956cb47240718e3bfcf543a850fd0e51fec96ec1a5260128b9c2bf6a02d035dd12b3cb018ff7d64d83d8e36

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
da56162a2f06b9e51349690104f4e139

SHA1
171c27bef05482b37585f5183b0150f7585ae0d0

SHA256
30dc2e679b93f405ca4b6a4ede1e16250232da7567ff48e7c48fccdaf0ad0724

SHA512
7a8603e88f7b8152fc2c0319a6dab57f24e4906c079c1e6ea83c4755ef2a6380121a643d8b44ba2e3dda6e9f1bc161302dd7acb07b6552938f0fe3a63dfc0e44

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
797KB

MD5
fc2403cf9602bafa6ec8667d866f6d3f

SHA1
07e326dda3e6cf177d0d6773b959585c403d0b53

SHA256
aa05ed76fa4c1f21292eed83c793eaaeab7b19fdd98c457e04a0e787529de7d9

SHA512
4c23bd08e88d7498a4fe1103b740cf5cbcde56c9dd8f8072fc6c685756cd82702219bbf11802182d2dac566ff266853a103b4b022052556711f184a90e82522f

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.1MB

MD5
e4f413f3bb755816f6cadb0100364569

SHA1
46c69364e4c82e0e3ed844b54d072e1253177ad4

SHA256
dcdb61a38b3949236253ca791bf2885007b45f0d2e56ced28a0248c840e4e789

SHA512
91a2b5c670abdbc213f0a5c4c1e3bb536f5b5a7ce08ad4aa69d4b5609a562df2e3a6d34cf005ab26710d121af91e711c9ab86daf47c999bcb23d82d4850d20c0

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
4b70036c0f07a647f28a410ea5d07a19

SHA1
8da7119850dbac6b3082c66255773195ae49a62c

SHA256
566642b80607d3fa987b5b1907dfabe4e732944ce652932c4f16558a4786db32

SHA512
242d7628c04b931a8d0fda2248c56449be889febd4708c5559e1efab31acbf0024e8d51df54abe5d9f589184d9e1af321212c8098fd5c8cdb457d67abe0e6f56

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
2cf1359c28ba20e2fe51a44d0d0c0bb3

SHA1
60312f04752c0f2581bef1602c144aa523a5e5bb

SHA256
258d08ea2ac840c1dccd791d1a27662d088f595abeee22f6ee3f816b2baafb1d

SHA512
c0fc1d32053133884db586d4c4d67adf35e6e443112effe5fc6efe7c899d827d67ddaad3dd0880ee1ca0eac2ad0faf42e1c2c3de623777c917506c7393161a95

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
582KB

MD5
42f92d1c6d1bebab9852458779ee4560

SHA1
62d05d67ba7b1033ba84937a356eb7e76f494c45

SHA256
8487daef6174c5a076d8e90c772aea428d492e82d974af0bb6aeee4888e99993

SHA512
bd1a1a86cc1223dce013e8d402aa80c12de0e43fcb79fd14c1856de34f93a75681e3d95cfb407aef99ae6f1028cae29ad4c6df4de43f93732e410b1413cf00b2

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
840KB

MD5
f6c16d6bcb7f100bcb8d974e325e4016

SHA1
5fd53aab907d828d3f0b87a63e064c6444c37181

SHA256
d335500cdaf6954d1390f56994e77ebe717e938fa1ada4f7c443f0bd89196ebe

SHA512
990aa33b721067eef55226e95ea3c11d93ec7102298ffdf991220806fd08ef6a46367a5df94c2cff40754e9627a3e483a2b35d1a1cad408b5f972be184280402

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
c5bdd88ceb679690438229f53e440b9d

SHA1
54221ec509357727017029de0624a9e4550399e4

SHA256
dd39e47a3588454a00b0506a1a2c738dbc47ce5841e303c90ba7c82f27b6a71c

SHA512
6815fdd1c5dcceed55b26e7091a724add28746f98aecda82bfe5ece0679f6e383815f3098baa26ccae5908293b1bbd545921300ad6fe86f2a0c27b63e5865f4f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
910KB

MD5
d2020b01c5a68d412c3cdda9994c7327

SHA1
0f4a49b054dc51c12754881295fd19b0759eed49

SHA256
ba12add668b1bb59861ea7a53554a5ccd9ac56fa098772c73bc40f4d374b3a2d

SHA512
da8dd216aead424efc5832e10c5f9f5b65b3a88bfc58be03433d104b6efd550d86cc460bea8df4d984bc157a5b1d91c245a3b564e4ea6c75ce259263ed5cb6bc

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
9a21f9fab5996b72ce3166bde75ca1be

SHA1
422149db4ea6c7910b087768a35e379fd9a19ac6

SHA256
c96a5dc4d8ddc7cdaf1a8813c2814044268e7f477cbfc4c0c6208f9dd78773f2

SHA512
c7f913eea0e9ee0ff78ba34e27c60b28a9328e89b700694a695897629830c5ab5e194fff52ac26f08b14bb5d82e4c24450817b4c067f1fa9611ae53b005ad67d

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
1457f5736bb374c4c083b4c94657579e

SHA1
510b43397f7500c9e5fe7118e3e48de8920da098

SHA256
78637fb2369943e1db17c141eb489b414248e9b313f650923e57a1012c169d86

SHA512
0bdd4b667ef4615655738ecae91efb29c5fe113510356a46d34a8238d999d13b52e76fbd49ad6f63979a416b0b5318f4db96de27eeccae7dfcc9e99a76532cd0

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
52e6d43a1ea5196848f21267341f4f4f

SHA1
d6c6e73a91d0e374e544fcb4aad4955ae345f057

SHA256
f944c9e1575b0358725bbbf470539a9c46a82ee0c423ad410e901de5661e06ac

SHA512
9fe8833ed4850288020cd36a0147c115bccd8af7fde8ba48b834e89da513f67479b53d830bd059962ca5406b84a61449d5b9ebf0593606253fe177cafa3e37b5

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
b41099c24e6a4d4f2f730aa5efff2813

SHA1
f1a123ec6b82e91b066cfdc4a696a023048c6a07

SHA256
c91cbdada4f94dcb9ee8025e370623098debbf6763d55cd2a6903e6b1baea7e1

SHA512
49f74204d70f88b82a4a3f2f1b302e46d5401e453eed18043582c4257675a5dbae2f00277eba499e5172408746d71d8c5dff243f5e39d0a3127951b51a07f5f5

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
656KB

MD5
ded261518068306a8aadf039fbb6e586

SHA1
f599e85689b3cfe1147fe96f933b8a153d6759fc

SHA256
0c61666e95b946d9f0f7b0aa397f04e6175545abf9b35b1dcd922f31063af3ee

SHA512
4b5faac598d7da8b3c7d9ccc1cb97bd28c421457b34fc3a76d03d3a260684b79ceef59a4847c47bc43a79ca81f1b7d126967695ba6ab3d9025761a35dfbc5d46

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

Filesize
5.4MB

MD5
2a080d1f660ed56cdb0718fbbe85c725

SHA1
ca9965d9459da6e9ea627840ac080a7408fd4c84

SHA256
88adf4a33eb841171b0365ce82e280631c0d05d5c4389f034f32664ba9fd8a9f

SHA512
ffac2a6583c54f830cc32036a6d5a55458c3653f5c2e018aa78933c9cb934c30ff7d6e19a45479cc556b920577a4ccdc1cd1417603cef55c35d18bdeea250f6d

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

Filesize
5.4MB

MD5
e1a5a9bda1c8953f060aa9e0fc18c38c

SHA1
0a0d643d440acd32403bc3f5cc567e5fe502fe18

SHA256
9897b28c0f095cebff71bfb310c2630046c2c49624a1364b5a8df55ab04105b3

SHA512
bbcc75c911a883c729499dc256b13919db2fd26e8fd8ed53bfc222fda4a4c2d97bce8135ca54c069830f532e38f945223594df09f4d26a3d43643f009838de48

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

Filesize
2.0MB

MD5
3f77ce05db9214160dc1b7192a6621bf

SHA1
c2b9aa78dcc645dff10d572ad29a2bd529c1770c

SHA256
176602da3275ee5bb342c7ed86085b04396a1f4201b65253471200ed7a874e3d

SHA512
8f46418fa552a78a3ad82931733317bd5bd8ebcbcd011dc03c4da5d2f36a518381ad48996447b52f29d2d550719aeb4e621c7caa7da622fd9661ece21addcc71

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

Filesize
2.2MB

MD5
b8ba39a5f4287c81305f7991c8a3cc8a

SHA1
379a25e7ae9bc71d928b2dd219bb8007ac3541a9

SHA256
7fb6e0c623c2ad14daa8e36ffedcfb43ed5ebc4dc3569548367a8e4e3cb6e086

SHA512
bf71873f13e79f333af5684c6d4699d8cefc88b0d8d28105a05d238d9c82f0b6080e2bd04f12725219b305c6f12891e0a1ad4e4db144b699ae070875044f8ade

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

Filesize
1.8MB

MD5
d6684bd706869066dce33b09a25fbfbb

SHA1
467b8ab64174f16b643966bc30b501672491e36d

SHA256
79fe77ae9e3ee46c43a2e915c28bd54467c4e564232f6390093791151df6007e

SHA512
d6985d8e03c3ea448befbe20af838ed3aeea57e6765a79b1038d006921066128c4f9d6ffa628d006b22b405d454bcfba2ec6755faaf80e5a90eee3d60878150a

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.7MB

MD5
58923255af589050257866dffec06b30

SHA1
ad80e7f09d64ee480f234da87f54fe25fc3743c2

SHA256
ce19b570ee01e10a733bb70b520bf452f40cecf564fa0eb219cba25deeddb113

SHA512
a349ade34ecabcaf87d01936c8fd82f68db17c14f82034b78fb8062a2b3b3d8f6360eb40275391b46457fac5798e4eca65e4e017f4199063b0bb255996704331

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
581KB

MD5
25bd8fcc60c08245b253df646e6f9c3e

SHA1
ea722890ec75c9fe1c875bcc565f2bb454415372

SHA256
f93b7201116ec133c2576f2b8ef26715c981c08bda377f5f2eb9426a14b0d85b

SHA512
eb82cbeb11525842d4907a8d5d621d76d9265a6e3b79f38e8a1dc0b8ae88a142a212d912fae28e3d60e353402a47e1c50bef045cd48dee529088b1bdff44bf04

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
581KB

MD5
cb46c28b89d4b2e74a3bee9fc6f34439

SHA1
c85e8faca0e8372abf61aa0be216326bf78d2a33

SHA256
46ae8548e3070b9855369b62509e70df9aa3962c0b6f699b0204dc181dd54012

SHA512
d7221bbdeda9366635d0bdb000f57e4c099f8d11ac92620e460193adff6bc4b0e8897dfa71163fbe78b49c95f240bc79e839e819065d6d1c24f8dc8b180c4792

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
581KB

MD5
41b2638fdb3a785e70ab8a7fde62a0ac

SHA1
65df1d09586e053612b70e236acb9e91a9977bff

SHA256
b723f632c343903c53dcf8b5927fb5446e0dbad804c223f8de47ba599e3bafd1

SHA512
6737db7ee3411a1591bb565bbd9209518b28f6f0b70af18c86273113b6367aa3df378e13a9859b05f212a872ee6140358c98d6a4555228b494d6886149d6e4b4

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
601KB

MD5
95d6808ee4ebfc940822b8ff7a6427b0

SHA1
137a514e92a45bad95ab8c8cc2eab72cc4614488

SHA256
4ed2952a1e1549a3f461e34b4e37f29c00cf672f4c26aafdfa6bf6985e0f3ef4

SHA512
7f8f3f2b935e6e12e37427d2b392a095b33579cb38db42531be98c2938588974305236fd4e0c16dad4e75b518e3b51b1bc5e79bde4c38ce03ee429ecacf86470

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
581KB

MD5
33d24ce65b98f48f07e097253a8bffbe

SHA1
ec6f752a21e7a19644c10a0774e427dc75ec2487

SHA256
87772ec59b0896893b4a65f2f8edcd008cb57dd19739cd4929885f4602654c6e

SHA512
ab8964c5e51f9bf7c56b2a2702242e60f4198c2426461f7af575abaa5491b54d79acd7111d10b70363ba38c1ee7b6bf7d3fe854f17a6844c72bb732b3b95a211

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
581KB

MD5
82a62076d92d1adabf3b26efeb8e1d90

SHA1
3eda7e8770aa2ef9aeb8d0aaf536d4c7be5914ea

SHA256
45810acc20b7da9e46a69c8e2549f3bc1a28b5f46c8c266164715a0f0100ae1c

SHA512
a403e4a7e3458a24cedba8deb27b5dd5076f92bc03b5f6539818a2457431db9c051603109a18c3a82036f25bcace294a2b5e7d9e0aed7714d0f21e9eb202599d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
581KB

MD5
7ecd4cdd5cda1f16f44c96c0205c2658

SHA1
0c8deb9c3eee693ed456bb129033bb367c5c51ed

SHA256
d0b5e5a3104089bbea35e88aad0cee339eadcd1d163f998d07208ada90d4f87a

SHA512
6eec224171a12f88e7ef586911ef7cb9e8693cfbba4cc0e3efeb1ab8a4ad99330bb5771979a8f65314e0235913c7bc020cff5c749b91ca1061b244df6acddd38

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
54fc2492d9a3ea615ec50f02749305b5

SHA1
9aaea9688f7ca28e419ed231484a1ba06b4525e8

SHA256
3624bfbff824253047504bf8d375f3a3e1079299f598aa41d6eeb8d3ae87f360

SHA512
030324b51f90008e8dd6919a2d9ead33f268b127ccae1f9c3c813440c9a6c5dfbba1cb36e52c26bf0a416531a7b30fa1785872ec6749403fb50030dfa36997a8

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
701KB

MD5
a00c7c42fc6f98b9233166d6a9a8dc8f

SHA1
a44e4465c6691ef62f54958b743d44534c41553e

SHA256
8d9ce9e7048c7ff1013878a3268bcb52a672dee73606dfd8477c29e55a5d8b81

SHA512
efce629029a8d9286af7e92150fc2bf7875c6e9f8afffb739a40be5e4f3d399f25f9714a547c697413dfb0835da33b5fc5f5c7680d7725c098306e3d856df54c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE

Filesize
2.5MB

MD5
f031c0d2b460209b47b91c46a3d202fe

SHA1
95040f80b0d203e1abaec4e06e0ec0e01c507d03

SHA256
492826e1aacd984a00dd67a438386e4de883cc923cb1f25e265525a4cf70ed7b

SHA512
18840649d19c5310d274bac69010514872a554bb5ecadb4af5fa3667ad1a6bf9d644b31393edbc1b60ace6eff907c79c078f8213948cf90fa4d1529c68ccc629

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab

Filesize
245KB

MD5
00d3bf1c1e82eee48fdf3361dd860e19

SHA1
b2f45cd2791ce178b45b06a95e7f58f298512d6d

SHA256
f2ce7873a39f7f8a2a2cd888a6b2f0a25f62bb3c475ee73cfe54988982ef65de

SHA512
cf5c06c4052b103d0a339d5535db2d8a9f069e928ee8c985f03e321b7e1977ff2f2200ad15671d6e93b9c706bea7586cd3df11fdbaaaf8c63a0ea4291431bca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi

Filesize
2.4MB

MD5
b31b234cb0f534069ba32aaaeacd7b2d

SHA1
d6f90459f8bdbf7e75cc85affe9b137dc5e304e2

SHA256
b5a652a1025f194f59e1349a1f26709d7ff7760067439b2d52d988a55d9340f0

SHA512
138cb14f6018d3bddd78012c5b36a591fe70d1b2b7f9d3774230639302401be57e1a4d6098c66a83c47e67138ac6dbe79f64548e4c317bb804a4e9a3ffdf94ea

Download Submit
C:\Windows\Installer\MSI9F8C.tmp

Filesize
24KB

MD5
7bfa56d222ecc4267e10c01462c6d0d9

SHA1
9b3236a45673ff3bb89df3e690784b673ae02038

SHA256
6eeb255e1d5333a7b4f1b62e36afa1bea5cfd6c7e32058bb3a9efebc4d9f2ad6

SHA512
10cec6bfd08a8b7cac1acbc3627cb014554ba71f44eb4bfe5b1471b81d6d292fd83a352d553af0de75fc1668a1f13d7f6f6c7bf1c6524117f363a3a7fc9b09e9

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
0c20245b603a5c2e0981a2031073d69c

SHA1
412e12329e12b46e967cdc1ef548e5f7b40aa75f

SHA256
dda2f705a02e5b115145feac09b99f92201bcfdb15ada05fa2d240216fddb0ef

SHA512
f026c970e84f20e3baf3de7d70f1b907e1b746bd5183c29cd19457a2c608c26b602d06d0cafe5080cebab4620dc2e48f40617758ce85e6eefe100fd360dc95a5

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
34db72cc70ea0b456c1fa882bb40777d

SHA1
874bc4131b135ba96637b2815075ddc9e1122687

SHA256
450088a74d4bca8f7fff954fd615e9fdb2f695bd3aef250d7c06be1131a38385

SHA512
639103ea89c5954b3444a33a456269c834e1105be601c2d835f7562759ca280218cd5dd168fe655406cb91524594c95b9be8bc9ca40a947dfbf26e9ebd13deba

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
0aadc904f0720de4dd79eb67f409be71

SHA1
07515d2c6c31e02070e61d141d0e3e5b9075f4a7

SHA256
a4c29f1818db7f95cf90b6855d679b7a62d21da3fee98f18195a5930ef5d14c0

SHA512
9b0e3b49520c8f698ecd63e521168cc9989eb3c37e8e22d67836e35ea9e04650c858eebbac28f2b65642624ea53662a84530f0e57ca6b036a1fed9f44edd9f53

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
7984c6e473ed27fe886e26f6805f596c

SHA1
95535e14e7bf6adca055c16e07cf8a409480f8a5

SHA256
5c6a82eb6c64ab695f854f0cb63d06cb5c98871c2ce7869dd6d79fe8147f2118

SHA512
1b5cd471e3b76cc0efc1466e0855da932463e08a9f8fe402840b6a156e1c1dd62b52741bafea94547899c679fcefeac262e3a32873a0d36a6252d3f72990d2e6

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
ecb2fa2e30e20df19c225f82e04297a0

SHA1
db25f403e400e26e1c8931967959b9812415a427

SHA256
1f562a9d895010ee89be5b6e0945ac4b70b85899e40e7c306babece7a07e00d7

SHA512
185cdbf362f2d87fa425526ff0766c966eeeae32d2061a55e9cf72781b0778218705d80a02d7e3b2111d1277e3d40c0d52fc920e6cec23776e1ddf664c605110

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
82d01c6c6df2f83c337501a84a760ee0

SHA1
2ca8dcd909e347a7c5e144c27d9cd05eb864be41

SHA256
4ef8f20b374479d1e350af97b34bad8975eb89e5b8fdbfe65f610a27e41f8456

SHA512
1c0f726bf807f788ab5f3e3f6ec02e5d27c35cfffd89eba192dcb9c439af8b8cf24b365c04c14779c33d443270f275a1451c82573ad70c4da014b0a16da99f0d

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
d04791c3ea15db1786715e9319638aa2

SHA1
f75f87a806a6b84eca6629a9b63a4c74c282b667

SHA256
c789a7309f849296883a24ae2db367449631387cf12540a5e816f17013086ad7

SHA512
cd7748d270a39cba0f809bb742e058eb8f42949682f1cfd153c1f65303189e310036b8c017922bb011a0cdcf40be657a5d4f4cd706f5080bcbd7e9d3f006130d

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
1fa438255e9acb728c55531f034b94ed

SHA1
6ebb6d33b0cec7f00a611130f759e63fe55fe719

SHA256
dee7e9c68b5093cbf3649315846113746c8f145a9e29494ac98716a6e2af6a23

SHA512
e7f10bf6135435e2f6514bdb10219efc1b6cc65dbc41d9a97eee281473124a21eddb35c4b03552e962045bd74b73b7a5307831a7556b41b5c24ae1147165b380

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
8774d9e3de00355f823c04cab0df2de2

SHA1
ca753175e86b456289c4431c62a467c5f6c08b47

SHA256
7858db616cdb5c2f8a9fa570f9e001326380bd39a9ddf19497476ac1e5555199

SHA512
3d56085ac877b90056e59e8d81b09e85c80e8fd72b6605f05bdd360d084d06f98aff335f1e5c30cfe36dc53201e8eb6a8dc3f6201a4f9c0fe95d91935d13eb50

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
32fc725b378e4e12a9ceb8956d52e4d6

SHA1
7f5827e14c8e3af8834107d4b18dd616979ff0b5

SHA256
85d92db100704c4c197105a21fa3e8b2d554d20ce69e429001898604c776ab01

SHA512
f1f5d1a1b548878ddce7a3e7e8a2408e9740540a3abbe43ff75c29f56fcd189db7a19a0969c0cba79e9ae55e5dec72d30fade279406e1f2dcde98f54b09fe3a2

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
fd020dd54a6539fc8c36c35307184953

SHA1
c5fdf93ca6bbd2e1ea9e5fc09ab63ebebf2b7bae

SHA256
14eafbc44b4502cba753666e7c8cf1218358445fc4eff8b3404a7dd807c0d943

SHA512
2ed21e199238ddfd9b1a534617f24d4759059b35c40825be1346dc145d8c35a03ec00a4c8654f5d25fe95372c655bf2d11b2b1cdbac180d70648e7f65047df1c

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
69d73148590bf5929243740b370f4597

SHA1
0cbf799ed58518f044923bf4bac74f40db90d815

SHA256
a2efc4b51c9d40299cc28472b3a9ca6bee71a6cf5f05a3e091c8958898c0ceca

SHA512
3725598e8b93d41c06653e218db76e205ab950bd3819264861cf5045f098ad79dad7a53de544c0c1214cef639dc6d287bce32193dea1c5319740c2a3f1cae9de

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
40124a22584bb0ecb9dc464ca4d0ceeb

SHA1
ebe1bd0d85581f93916bd70d0c7369d917430f18

SHA256
aeb539d2de7cce00c1401778dcb7ba124bf9f18d7c97832fc4c3f7ef0d85baea

SHA512
e1b61b72d7f09bd53b323ec35060d115bf132c46236f6c4a332a019968ea58146cbc6b7f6ba3aa60298e28de515d993a4f8034fbbf7a4cfefa9c02c7453e8cb2

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
7c3ee13efd19cd43d16bc4cffaf2f37d

SHA1
476da63e4a0479766d91d9685d8006f82477bc8a

SHA256
0d9e75bb2fca3e08bf1e9f3c1538241548a83e6d4becffc460be64ccc028b94b

SHA512
5e1e17ee98899c7bdf338700bdda062ce973bc69aed1312526465f4dfd2809216ba513d435660cac1f4598d3ea0ada614445156fd72dd2f0c03c629b14f5e48d

Download Submit
C:\Windows\System32\msiexec.exe

Filesize
635KB

MD5
e7f2da823619a8c2b1961a24a0973308

SHA1
66d85650fb92220f7f9ca437e31270181b2b2b10

SHA256
efbc0c01a8c662e12becc07ca45e97079c7d83d05e610e57b6ec7ef901dec55f

SHA512
0180cd145019efa5914960627870829b1b2e4f3bbb49c3dc491f70c11f2ae18dbcde2c6ae6a9ae68528877d143dbcd3f802747dd5a6550e64aeace599930002c

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
5e0702423fbd1ec71a7039150aa0cc01

SHA1
a8b4b0ca8c62843b0b6062e0f6762d66660cf52f

SHA256
c381c4826f3e0651ddc538d57679412d2b98367a1a056800b9c7c8ec9ebf1328

SHA512
5e12a48ccd53328bc2ce2c4badf6f0e99bef14f928974ddadc406a9d37b023939155543a3618997baba4ae2bea77cc3f2e4e461ec775c069061b22c76067007b

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
a69d02d914f67ee38dc82b13ebdfe1fe

SHA1
14b1bf265efe898523307e2daf3081478ff892e3

SHA256
d8eb1db44b5bd7a43cc5701a4b90235eb2127440579c69092ae268ec07d5652e

SHA512
ea8c3b1f6b508ee5d8077168c88cb0a64851bfbc8b20c0ef457d40d6b99a92725484aa8c055816796e74a4d9ee190f823fc46ce457b52b6e51929691cfd79e90

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
a049d9f8676cc1980d8d25d57fcac5af

SHA1
64480f14f0edd5fbfb6b8d42a4e7b04047f0856b

SHA256
3114ad299dd8991c656a2c7bd614b49592fc8dd85b07fb74639d8bda240d1f8b

SHA512
85fd697c68b8fe390d7a574a16c94da0077e230fee7cdcc209c8c73f518b1cca544c10234779d114dfd6a753073c72e6f3f277dd246b61f656761cee047c4107

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
9c8ffb78896e7a400500effe9924321b

SHA1
c6409b8e6206ce27d7baac83350a08ef8d80df0b

SHA256
832ce86543fc9dad8feed87b7ebab8abe4f3e207d42b1bb622c25b4218140f7f

SHA512
aae512d61a419e528b50241db79fec412dc174abbaf6467ea470ff25c9092b51625a0ffcae66d1da9046b905e4792f90d087f4099237ec5ef6d59fc9c69c9172

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
729535511ea4bf339cf35a1aa863d0c5

SHA1
959f04ab35958a9d7f13f13a0267e8fadc6ba96f

SHA256
d8fc61c259108876edecd15ce1faed2f55963b8395c3016faa809b527a7648e3

SHA512
5ccb3c3804b8e6f7fa4399a4b1c490947966fce868f882e8d692abb145fe11096779115e24469b6c8d8122c88eb3093b79a366aa06ae876d80a9da0c4604cfc7

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
877KB

MD5
f8dcf430f7e7fc78777b864296dace21

SHA1
dceb04296e24d32beaef8879c2556cebe2ab2286

SHA256
cf4ba7691dee5031b31a52fac18464f5bb347f22d31bfe9bf63a17d64dbe93ad

SHA512
99a53bccba9dc7e5431b019fb7b62549d0bc5c93f80a91e842fdd1ad7559a4880a07f88d6f044688c22eb90522ff7125d60020b0bbca8bc8cdd3297e15aa6395

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
2b34a61198628400fc5f8c07cbfc398c

SHA1
3259fcbc593eba2b4333b4cafd8a46e257473599

SHA256
81f62d7c2e98b3f86339365d9196039e54a869ecd1127dc44d1f1a2a77f03ea6

SHA512
dbc0ca5c2c82e71c1eb064d7f9f86c532c1020d53f36434b7a6872e215535bff4da56c64c77d719baa382a835b257b5450747ebe6e75c1fbf47559b8184c7001

Download Submit
\??\Volume{5110105b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c518dbc0-8b47-4ab8-beb4-6db91d60bc7b}_OnDiskSnapshotProp

Filesize
6KB

MD5
16e9844d69e99de9c8791f40ce8a4ae4

SHA1
2b5fc83a3c2322ee795815f612229305f8ec6219

SHA256
7601dcfab170c4065fd7c40f67f791b13b2e999b1518df5d6f683a342d3fc5a0

SHA512
20df4d3f934a8eb2ee289418f8a97e2e07128266177bf1fd6910684c1c88fa8d80ab375722135dc06b470044d1dab352fe5a384c211073bfe4bb18a40d4df53d

Download Submit
memory/8-164-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/112-98-0x0000000000670000-0x00000000006D7000-memory.dmp

Filesize
412KB

Download
memory/112-103-0x0000000000670000-0x00000000006D7000-memory.dmp

Filesize
412KB

Download
memory/112-156-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/208-85-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Filesize
384KB

Download
memory/208-155-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/208-91-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Filesize
384KB

Download
memory/384-52-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/384-49-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/384-43-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/384-413-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/1116-642-0x0000000140000000-0x00000001400A5000-memory.dmp

Filesize
660KB

Download
memory/1116-367-0x0000000140000000-0x00000001400A5000-memory.dmp

Filesize
660KB

Download
memory/1520-540-0x0000000001000000-0x0000000001320000-memory.dmp

Filesize
3.1MB

Download
memory/1520-0-0x0000000001000000-0x0000000001320000-memory.dmp

Filesize
3.1MB

Download
memory/1520-1-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Filesize
412KB

Download
memory/1520-81-0x0000000001000000-0x0000000001320000-memory.dmp

Filesize
3.1MB

Download
memory/1520-6-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Filesize
412KB

Download
memory/1720-198-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/1720-508-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/1904-23-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/1904-15-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/1904-24-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/2272-82-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/2524-197-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2752-138-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/2960-11-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/2960-366-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/2976-200-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/3008-72-0x00000000007D0000-0x0000000000830000-memory.dmp

Filesize
384KB

Download
memory/3008-477-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/3008-83-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/3008-78-0x00000000007D0000-0x0000000000830000-memory.dmp

Filesize
384KB

Download
memory/3304-55-0x00000000015E0000-0x0000000001640000-memory.dmp

Filesize
384KB

Download
memory/3304-67-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/3304-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/3304-65-0x00000000015E0000-0x0000000001640000-memory.dmp

Filesize
384KB

Download
memory/3304-61-0x00000000015E0000-0x0000000001640000-memory.dmp

Filesize
384KB

Download
memory/3312-162-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3360-201-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/3360-509-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/3432-163-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/3768-32-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/3768-38-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/3768-31-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/3768-407-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/4076-157-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/4384-158-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4384-371-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4420-199-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4488-41-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4488-28-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4556-159-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download