34276d6651f6006fbd8d9e47131f9e43cd8de11f2e2b3f19411c795386d7ac49

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
Size 712KB
Sample240527-vlv2caba6v
SHA256 34276d6651f6006fbd8d9e47131f9e43cd8de11f2e2b3f19411c795386d7ac49
MD5 00e7ee5911e4fc0ab6c578526e0966e0
SHA1 1498548f5c09f2e2329aa5c122e97325b58a2020
SHA512 ecc845a11912edfef9e82b8d1d83a50aadedb22a167148e60e52d1c0b92fa58f49c1d8a096031711876db23ced6f0d7041b89325fa700a967979ce336f13f1ea
SSDEEP 12288:etOw6BaeGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPhz:w6BEt/sBlDqgZQd6XKtiMJYiPUz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3660	alg.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
2320	fxssvc.exe
1184	elevation_service.exe
4376	elevation_service.exe
320	maintenanceservice.exe
3628	msdtc.exe
4756	OSE.EXE
2604	PerceptionSimulationService.exe
4488	perfhost.exe
3044	locator.exe
2360	SensorDataService.exe
3000	snmptrap.exe
2960	spectrum.exe
1756	ssh-agent.exe
4936	TieringEngineService.exe
3720	AgentService.exe
760	vds.exe
3344	vssvc.exe
4080	wbengine.exe
1396	WmiApSrv.exe
4976	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b568babeb4b1389a.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{28C8484C-303E-4CB2-A704-E3FF47E10F7C}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042034c1058b0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcc7501058b0da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6c48e1058b0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3a30b1058b0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df23290f58b0da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f7c041058b0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000753b851058b0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d57de50f58b0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
Token: SeAuditPrivilege	2320	fxssvc.exe
Token: SeRestorePrivilege	4936	TieringEngineService.exe
Token: SeManageVolumePrivilege	4936	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3720	AgentService.exe
Token: SeBackupPrivilege	3344	vssvc.exe
Token: SeRestorePrivilege	3344	vssvc.exe
Token: SeAuditPrivilege	3344	vssvc.exe
Token: SeBackupPrivilege	4080	wbengine.exe
Token: SeRestorePrivilege	4080	wbengine.exe
Token: SeSecurityPrivilege	4080	wbengine.exe
Token: 33	4976	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4976	SearchIndexer.exe
Token: SeDebugPrivilege	3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3364	00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3660	alg.exe
Token: SeDebugPrivilege	3660	alg.exe
Token: SeDebugPrivilege	3660	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1632	4976	SearchIndexer.exe	112
PID 4976 wrote to memory of 1632	4976	SearchIndexer.exe	112
PID 4976 wrote to memory of 1020	4976	SearchIndexer.exe	114
PID 4976 wrote to memory of 1020	4976	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\00e7ee5911e4fc0ab6c578526e0966e0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1712

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4376

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:320

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3628

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4756

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2604

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4488

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3044

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2360

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3000

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2960

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:404

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1396

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1632
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 8f2cc50019e33310bc8de9892d69fbb53b7b0f13ff271f2b553fde9cdf96f7fd
MD5 a96dbf0ca133d726b959f3c197afbc09
SHA1 3b09a47408571d044aa4e40e4817fb2f08c8c2ec
SHA512 a80b0a6cffaaed0c7f7545a5ed0325b6b28182cde39ddc8bb8a5734575bfad8050e25f3a267e5b5ea4b7467f3b4edeac46b72fb4ed920aec62656ce783453a26
SSDEEP 49152:ZuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5S/snji6attJM:ZPfTqi90bWEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 7d328a1fec35c0e1de77c5ae494196b3a57caff0db673652dc56519b4b2ffca8
MD5 9be2e5ef1b4fb722843680ce13e01f45
SHA1 31cbb68e1afaebfdc2ce298cfbf0e70fae005975
SHA512 9268bbb19d2fbfb69b6600c486df67b9f4bbb0f2f49a6835ce1fac2f2e3f005e865c55e3efba3849350016c8e9b6a2cd329469498d228e96e566b51ba342aed7
SSDEEP 12288:bcQiQmNJLBsunEkGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:DidnBsuErt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 245561c9aca89f99672ba1da064a92af88daaf5087e83d346a12737632fe0921
MD5 2741bb13791c3310ff9edd01a1ec2d8f
SHA1 ef1e20b72d70e7073e685cb4c49843aaf747d7bc
SHA512 dea0fd8539206eda2d2bb11e8a5e165a140d585993e826b27187005be718ffe336bcfa5a5cfbe7c832e15fbc0b58e7c06138988a320c4e5841018228ea0977be
SSDEEP 24576:u+gkEVfh4CoXt/sBlDqgZQd6XKtiMJYiPU:jgkExSD/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 965162cad34515142a31772da746ee54d273694492eb4256f902c545068f2f50
MD5 4164c435e83d9b307e11cf46079b939c
SHA1 88c7438c82d103767b969d95e7fd91fefbed53be
SHA512 6b1d82bc9412ff1923c983300e75f45ad1e2a0696cd2206c8e24c790cb3736c7ca5bf0c4379a1843b1519dc44cbe027dba3cf994a857ef3639896e591999aaca
SSDEEP 24576:aBpDRmi78gkPXlyo0GxjrUt/sBlDqgZQd6XKtiMJYiPU:+NRmi78gkPX4o0Gxjy/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7d58d4a6b77b40751b715ce5cc413db971e4617735daad99e4e81c1bcd271e30
MD5 18c006272d717cd6190a740a3f33ee9e
SHA1 fafccf79640866f0e251d0bf59ff2bb5577cee86
SHA512 f810e6ca54a6186506012d24b1df59dc3a93037685e6f7bd14644a4d77bbe788a3f076c10e806157aa0d629c9607bd7b907a869122a738b136aec7bd78ce3eca
SSDEEP 24576:mLOS2oyPIXVXt/sBlDqgZQd6XKtiMJYiPU:W/y6/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8ad249abe3b2ffea2e865c18763c2096ad1c4b33aac76452597a519309e05ea2
MD5 fc7918bfb4a91c8fb4619711aa477eaf
SHA1 89f0bc501270ac7a10c1b5c141ef02f651f0f1e8
SHA512 ec0a7d5780164e82788b72b0bacd22e8f4616aa7e450fd11e09faa28484608d19a0303cc21ec6e5afb63c6fbab76c76441925b8342931b485d80242f7fe35be4
SSDEEP 12288:ffeGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPhF:ffRt/sBlDqgZQd6XKtiMJYiPUF
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 f2e828ed83b6fdcbc2d6a6106e77bedc24236ace49ed917d2b5a19923e50f4c3
MD5 9e2e9d317baf6fc22fd44caace253292
SHA1 3be0c5626dd349bf1434f33368f30f8696db1290
SHA512 21efb5c6c7a52c38011c6e66cf7a04c92d174dd0dde1bf956ac78ea855235b38832a09e6f2ea0c14496fc73a23061bfa4411b8e9f97add0ddc1f5b767395f478
SSDEEP 12288:jeBNUbTVO86UfGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:jJIUet/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dc9e9b0ae555a895bf5ba51dba1a6b985dd29bd61642f210ebef35c7b46e4cf7
MD5 b32fadb43bddb7f91e5ea38b5553ba63
SHA1 76f9b40d190cd07e066dbe30ab847988d60593eb
SHA512 609cb3e59d941392c48c5b1df945f3165226c904592c529edb7bd7bc82614a6e7fc819c574abce219b9896f17909e837dd770d1d1fc36c6b0ce0091920f5c14b
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THh:NQvGAdlCEL8c/yRNw5CJEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 c80711a1e6389b20ba734d191ef6d72c5e067f47cfeb264deb9e6dfe1421e704
MD5 b25acba047979d83493c5fb614a41b67
SHA1 0512c3fb866eab30c393b9ca2d8ffbf3f8076265
SHA512 1b10c45c0b076805a7db60fa10e45fb08eefc21f3ddaa92459cafb2c7ffcc1141d7a395c5b732ef3284d07addd913d1ef2b87149e75518ab0bcac844aebd2af4
SSDEEP 12288:6AwSfxL/2Dc34DLLmt0LDQewsAjpGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5U:PdewsAjMt/sBlDqgZQd6XKtiMJYiPUV
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 80d8811ee9e8215b8b8e75b89c4662767bb1b57329edd52bdc22b7013ec1d429
MD5 6af6914d25ef048946c2a5688087b9d2
SHA1 ca9465748c344dfe98bb34f545d32680cb494c7b
SHA512 c5d8cc160f40d307452be177ef19eaadcb4d4139f282c104e50d533e5adfc4411421030f0a82980499a1b6ee181425f944d18158f13fbada1b9cbccc0202d349
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH9nW9:JUEtQevvqc2W1cpV2EI329
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 53077035b6c7414122c69408ada4f2a28f13c08f050575f4d76223762a925d70
MD5 0fae3e15efdd3d237dbfe89d4ed13fa3
SHA1 0fdae109b88e3af2331d97d27468bd6eddc87a6c
SHA512 8843abfb341868b2ec7b8f224d0935118c936bc2ba60e815041aa02039639152ec8646f1afe2a2560fa1ab4c07fd9d4743bce6fd3422641e2f59511f13569213
SSDEEP 49152:jCbRquA/m2yL5zifFiV+XenmE3/z2/snji6attJM:coqHVjnmNEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bc12d7f5cbd393678b29e2a9ba2a3e8ed91d7be02296d526b963a1ed60a053ad
MD5 04c5245c4ae6402d20e7be54033b7ca0
SHA1 933d37be0110ccfff54797120afc868f93eae0e9
SHA512 975fb1ebe18c5039f4ab1e3a17af5f65d58da5ce4c361968713c760789f27be4aab7423085285a1640302ee5dbc43479cd335f55a2b668cb5e58d9638e61266d
SSDEEP 24576:cAhGLJIFoiwtA5l7S53nt/sBlDqgZQd6XKtiMJYiPU:cAMyFoiq5d/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2ad875b9b1cf84925be82688e798dfdecd88eb7712c0ebd93fcade085fc93395
MD5 085d4bd1dc54897f2b34fb7792a70202
SHA1 b5260c3b1605219c6a357e5697ba21a18c30789f
SHA512 e9ffb6adf18569ba2026dde93ce9f008bb1e96b568d96585e54fdd7a5a4574cf04eeac7ddec2f1508056d1f03b126454f63e60bf50a6724d153f634f40e88b4c
SSDEEP 12288:Pmw5HEjsChNVBFgl0WDm+CsGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNA1:uwuoOWwt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 31d67c9acf0883e3a27e85c3dad49f5cfb195c60443cd9814b8f12d935534aae
MD5 6dc5a3144ea86bcd352ea277bc8e0e98
SHA1 55368f3916a9579c039d2e6b9560cdb2002c6aeb
SHA512 01d154962c2478416d60c5e80329d1998459a193e1eb1e53be17f359e7fdadf9d1081f835ae9741f5b7b2eaea50d5190ab61163b9235b8a794e55c5d272d494c
SSDEEP 12288:GBZ1Iy5Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:QZuNt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 b9a89bc8f8c9b26b441ebb96ca70302fffd0bab9ca32c1b0eb97cddb2027b80f
MD5 32906fd3d268dda875cf1e166ef26c9e
SHA1 25fdd7198776665caae4b9d36ae80a9c2ec2182b
SHA512 1e91d4ee527c4af09577c212bb7ef48587288021e55a5a1cac913a0ebcdce8e453c49693fc230bbc4a56040d5e9150cf249b5a6f30ea2650b2c810baea4fd640
SSDEEP 49152:q0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLR:cwfhY7g/rLd7yYA3awr341glEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 b4c9aba1709b9b6896f6de5e1303195c03d90d2c977456eb039518217d8a35d6
MD5 b8753a8dbef85d5da2f5769fc5fef967
SHA1 d4e7aba0122e760277ad7ef049264a0746e111d6
SHA512 8a7cc9e38032e481496657f5e30b80d6a427882a6befb161248f6bf292b3423d8a1d337fd6ec8386701fc006b8d9386e3719da6bfffa84ff3b814f7a719a1eaf
SSDEEP 49152:50kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLR:JwfhY7g/rLd7yYA3awr341glEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 e14b5f2885e409a2379056e121aa0c6fa8a26450e9e0d66322262caf1bd89fbd
MD5 3bb24370727b4418c54c4892b1fd712c
SHA1 897f45f94216b5ace7bda134e6a372b4b733d45b
SHA512 0cee80bf95d154cf873dbb1192cdccbbe7acfbb60d66103d0dda64070ac796f1842589e1d0ab21bd92d85bb94bdc532b502e847a0aa218f5f5cae08ba01716c2
SSDEEP 24576:PcTyYv0FteQU+5I2kjgD6iQacAwt/sBlDqgZQd6XKtiMJYiPU:PuXv0Ftpn5606zO6/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 724f0ee2ef360d4548ce8871d86d167428814b32146524b95825419b19dc0d2a
MD5 9b1f80de57f37dd694fffe314d060e99
SHA1 0d4b538785010f15e1480c7248914f9a58f918bf
SHA512 360e3acfb03f81ed1cfebc16331af92f8e0bf6d676bca30f4c09852948c51eb5e79b798c4d9380e16421fb519c31eb47eb519f42fb6341b8736c16986f3be1c7
SSDEEP 49152:Xy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxW/snji6attJM:SmYeyxHjWjMTWEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 f3845958b2ee72e538e540ca61e447ca50b7bc55891c9a5e5d2320c375fcd13b
MD5 cefbe9b3204e7b6513bdf3b44e9adfa7
SHA1 71a62ae33ab35a7081ea417f1e1d385f5ab44861
SHA512 6a866b2db89431602c3da82d2a853ce5d7eb3c4bd1d3230250a834a14a1809978179342e48a214814683357bb3d939e3344edae86458fa4f1e71ab9031d19c26
SSDEEP 24576:A6drZn1WEci182IEUeNbJeRgUebgW816Ft/sBlDqgZQd6XKtiMJYiPU:AWnDci18yNNUgbYS/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 2057fd1a91472e02dad421ad4efc88e9d022d2ccc22758738ed7ff765641e2a4
MD5 dab7104601a671e269f1956965e7c2a6
SHA1 d9bb5549e506c26eb4107e60554afb52fba252a2
SHA512 d7de3cfc6037bfc583f73195de3df1a38e6bc5008b7552a50689dc72a4b2c03ebd57631fe8062480dac055170cac063046c9b88c0b1894844d1da358485d4231
SSDEEP 24576:Tk5lHW5EzMZupO80G2reD+melRgTTv/1nyat/sBlDqgZQd6XKtiMJYiPU:jizMZm0GhamSo//snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f3657340012e58bbbae6c3baa817fed373b6d8dc6b0d180f263baa48cb71ef45
MD5 e817f8462d5088d059f0b59874456259
SHA1 575e99774b5ddc634e15d63b141daa39c51e597c
SHA512 d1d7bd0597adacd315984264ca943b66cc605e0ddeca05fbefb3873085cdf3e4d86f1084175017a07c5d6a536817cd6abdf28c441b49d1cb69a8e2ab3b67533f
SSDEEP 12288:HmGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:HZt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 54a1093fcd291393851f6525a361e27914c801d542166a17b4e116e0ff92677a
MD5 2582df8f3e5578cb1b60fc027a5d9a59
SHA1 cfad73b003179be0202bd34b87fd680c3e60a803
SHA512 5dadf103df2c8c76302f5f407918aecfab1fd263544c07ea926863e40f36db4b8406ed5fb3ef27ec6bbeec0ae8208ff471141e029e334208fbc888dc69eb6586
SSDEEP 12288:MFGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:MIt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 2167d1ad55245ade4d89fb14824594e9a3fcb0584333eba80b4b255908345944
MD5 512b6ecd61557ac524f4fc0dcd8b65ee
SHA1 63e7bc84f237ef84730e1dc15a3a02769f0f02d4
SHA512 41cf6a0f56e2dd7f4bec66bb7af5fea0eadfe5eb10db2ea0dbac34d71b70eca1ef5365ae633d549fb8189c07e4a7ea53fb2540a2f1db46c0333279bb31b68c12
SSDEEP 12288:QnGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:QGt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3bd0596ad8215c1f747b124c5391be0cfa756cc22ebfbf9102b5d8d329dfb9c1
MD5 4d12ab3910098f6f59321142c95f7bbb
SHA1 577e4673e84e0f145ffad3a31da6553ba2b55d2a
SHA512 c049d77a2281d6664989ca998394d8765668bf7c9770f56350d67eeb826f1d85be08bbf2633a1e901b95b8e41d4dfe40ab47c81cccf81ac1103e9bc2ef3a0392
SSDEEP 12288:zVgGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:1t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c66597785cecb105bc670dc1cdcf7a025b7a68769c0f58a1a37dfae218a3c907
MD5 982036446867e3f8906176f6e82a6516
SHA1 06d6101ac803d185a94b43d9cb2fc3df30337aa4
SHA512 edfd9113513838a2e231943d72616c0ce27173e757bb4a9229786096e925fff220ef9c898c19cc2e174c04237b417f9107573db66f9f875bc6a5bfe821b0d816
SSDEEP 12288:M4Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:M/t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 40276867c9219366256993eafa4ea1c0768df640add63a5eb6834d2a65407a98
MD5 7af5c4eb9497579e4847024a5fcd03f5
SHA1 ed23ebfb223c0c0136bac39c96c53eb785a2406c
SHA512 04a1641ae476a0f47b2d135d4a34d03a2ed098cf06bd64b9aa888b2577f39f99d6c39790e55c4429e7f9893135bf1c2d543909ce1aeb3e6f42bd538bd8099005
SSDEEP 12288:ORGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:OUt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 b153e65d69c0561b6a4c92353e1b701c8b57d4dd724ddddfce508fa8db80e249
MD5 f0cea8b49742e491c74e66f6086b8d30
SHA1 0a86d9c1ba19fd9e00ceee7fc95a8e61e2411172
SHA512 da3cc3429723e59d8087ceca998f7360533d1ee8d0698a9cd611a2225dfbae46063862e7ea939fd68b9568feced54a0b55128a8bc231abdd45a30b2df49fa4d0
SSDEEP 12288:49Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:4At/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 113f0f3b1b1b5fef3c7fd337e53f86b1abb7d232a468db492b462e2ad22b8065
MD5 ac6bc89d608003f606fef41fc657683d
SHA1 618bb101be873b92a4adda48ddb1a31be2cf14d4
SHA512 407c185817c042fb0a35123da89f92b7877397ed1acf4de9b11181e1fd9c34b2656904c15d149d0d54d14eac80a4d99a263333419b367a8b104097881ab02756
SSDEEP 24576:vZMSzFVSOot/sBlDqgZQd6XKtiMJYiPU:vZMSzf+/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 22ddd04bce8769297269723ecf64b554ae90b43a470af522113f7c7a26c32ee1
MD5 d7c73ed2030da4bd32b5fffc77caedcb
SHA1 39e95d969bcca91c85fe78a60698e2ff3ee148a7
SHA512 13930593428902ccc20bed8b65cb6c01425d6b97b915777252317e2074e2983f4ca6211fbf6620ffeaf81568a8a78f031a5ce78fe3564445ea6674ba2f41f4f8
SSDEEP 12288:naGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:n9t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8926c3631b6917db86cff9c04932e61b8c4b3333b313be754116e72314472736
MD5 3871acf972eed883a678806ba9b7844f
SHA1 f542c000e80a46740b984c5e950616240059746c
SHA512 0099cb9f92f7505e06c18f559826064c9950dd2da88bd0972210a4fc2cbabe97323aca15ec7f23561e866fe18f97cad17ffb069dc751ba89a4a2a499cf0c4a7b
SSDEEP 12288:4uGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:4Bt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 c84c456324cc60ddf8b055414381abb513b97e323bd20a24394c3ea1bba5c4f4
MD5 3184aa9ccaa41a2b25b58c8818a2aa03
SHA1 0145db9d77ed5b8bf8f18c16f9500c101ec90d1a
SHA512 901b90b32f9e870475446e13dcc8f4b59cb80bcaf358a6485d10cb143245096cf71850bcca541614fba0b8a05ba357294f9278a6acf7ec72a8e46955669775de
SSDEEP 12288:7yPz5L85Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:2zy8t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8dad595ceafc6e3db3ac65c9a4dbffdaf177a01109501f1d0d5cbb99986c7c0d
MD5 bd414ed422cbae394055c7c7db18faca
SHA1 b4e33b2555a9f97d0b31f21ba1dbd2e4ab56c7ff
SHA512 fb82bdc4b142fe10ca6313dc4c929fde856998fe7c743004ce70e47dcfb0de907dbd364cccb888d9a5d7894680f1b3e24dfcd313cd3fa1f2f0d02499344a41bc
SSDEEP 12288:zaGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:z9t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 89f66be65426fc2da7928f3aa57e58b390ef24be5ecef2dcebd17ed30ca537ce
MD5 f25ccfefee2d485df9523c21108625e6
SHA1 8ee3ceb83b168851f5d1e5a92a467072e3470828
SHA512 5f52aa83d99c15792ac28586b78baacf1e37dd6849d652cb580c74d94d7c08f8022e7bb09709eeb07195e6266f97751054debfdb3f0c4d6f2345f82540c6b3b9
SSDEEP 12288:/aGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:/9t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 09a9a57bd59842e15fad42f5a23bc3d3b34684ba83204fd5733ffea2428d5fac
MD5 b3e37fbd85dd4679dd089ec52cb55a92
SHA1 e687b3e93aea5b32388e8f2f252ad3775a7d2a3a
SHA512 230f1356101bebf2534f983b3e09b1453808c05f584697d39bdbee2b40df3e2ef8b72548acdee9bf50b47ceb233631a6ea34b46627447783ae36022beb8e87d2
SSDEEP 12288:6yPz5L85Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:nzy8t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 ecb8352d8ee433467998fd02794f1ada3b39b7a1bda5c4f7892f89a61adbcb6d
MD5 2de203a63a6272be7f0f86db41254f96
SHA1 88fb3f53826cf0f6397f343f5f5b064224296c93
SHA512 b3b66ffc81ff257565887b2eb696c2c02e083b618d518527ac1e317cce2942fa5273341720d3901e6fcb9f54b8708f054b586691d27956ec5bb7d21e53379ebf
SSDEEP 24576:CTHaLl3z0zDWt/sBlDqgZQd6XKtiMJYiPU:CT6Llj5/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 a4af87215694ecb11e9cb8276ae295b4ab1a25d0395af4ed31b675a9a7711247
MD5 731dd15cf9bb06009010823ddbfaddad
SHA1 4b8e9eb1582c2ee8813929d577616830237e3ad7
SHA512 b0036f81a9b0dbd4d5ff24f3e5224d76e8fa1edde4f792ff256a6802842f1b5b5fef29a8bb99bade9a83ed0436d40efa8e33b7338ec71e07efc8ce27bb81cf03
SSDEEP 24576:837d9CHKy7GZyt/sBlDqgZQd6XKtiMJYiPU:m7d9CHKya+/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0c4b0a8c514098b76936556c2e79a4085bd4311003abfd3d1f200cff964247cf
MD5 ad6a71598891fe582d6c54cfebb4417c
SHA1 923fb79c977a60194387710d67e5f164f75bfea8
SHA512 21e653b4fb631adfa7886b9f36f779f8d1874ea20bef848808f6a62985635eb0757c7d1df87a5dbc879a56bbc593d1c781749b9481f6c68ddd38c6bce293f162
SSDEEP 24576:2cP4mcvIjkGOxhKP2l71SNKbrh/8KBVt/sBlDqgZQd6XKtiMJYiPU:RP4m4IpOO67N8KJ/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 ccae0a3b5687cb9b4b10d9ebfcdfed43895c987757957fe273772dca0fba9f76
MD5 dfaa6fbf3df8e38e3e5f1a82141cb169
SHA1 6f7ec2fdb7a1284d9476d59873552705f9e35efb
SHA512 ef76624669c9c799aef5dbd76440020063fbd05ed398696368914d1fbb14d811d7fa4a192e44fc1a8d68ff57fad4e33a168a3134f789bf36bd5a7339747299cb
SSDEEP 12288:8UFmDDLzGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:eCt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 8512cf66bd2ef7aeea3ef080c5f3b3b0fba7dab378440244c23f277888271bee
MD5 da2c00ace42a3414d7aba8a7cfeeeb2d
SHA1 c9b4b099ad19c461e484905864173e32d4ab7f91
SHA512 6fce8739c6f43735b66b0bce90fdcea85320f71b04de4b300ee33b46005e2663d32942e248b2e252ffc9b1e68d53b4ccc6cc1ac27be42ec38bc435cc6f5a4a29
SSDEEP 12288:HqGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPhK:Htt/sBlDqgZQd6XKtiMJYiPUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4dca705c9fb4471046b97e0a7c2a7651c63ddc0017512a9f90f09bb1ef2ab4aa
MD5 9736994e079c3e8ae4d7640d833251f3
SHA1 968f2eba5d14752888e3647c4904f09c834880ee
SHA512 7159f1bb39c2b09dab3f5f46138d15a9208a059ec2812ab86b6d9799fbf2a22a39418c782207272b1f19f11bd487efb36566297d595fb4f00a989e6c8058fe37
SSDEEP 49152:da0h2GEkuAe73q3pp46zwwQV/snji6attJM:da0hNYG4JweEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 a81ff36cb40950f037f4908f40edd33f0e97447cc0641d08a52995cc1f919066
MD5 42efeaf0c77d595daf0d6a45df99d266
SHA1 c3e920cdd5097ecb3c6acc06a7c3601610f4a436
SHA512 4ebf2fbe9888bef141956ece7ecc2a8214e0b74796315bf21cf1033f75fcfacf65453be6219f87ce90e13627d3a2cf43c765b277cff0d8973ebb6536a365b423
SSDEEP 12288:ehbHjfX1Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:ehbHjPYt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c5fb246268e96a060d239096e37ebd7c338324dfc6bb23fbfe0e282c6966dd94
MD5 61005bd21ffbaa4ccbb123e98db04adb
SHA1 718d2ef445f8c9e2ec25d4088a991357e708842f
SHA512 e9f4896dc1e8054543585e1c70eb0e6d91f220d872d23a9b73a91a4da5f3338729f47f65b3069231e3be6e91fa607f0c8e0d26dbb8afc6c0a1e5b86f3080615a
SSDEEP 24576:73YgnJcRTk4yti+R5dpR/wt/sBlDqgZQd6XKtiMJYiPU:7IgnaTk46ppR/6/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 f57b688d2c05671382f6ccb8f1ad56633cdce23a88560104d16d14744c10ed68
MD5 909f84a40d2d46be4e97ef46194fad13
SHA1 2e361fd2c3add0625eb0bd816e9c13b8c4a13b38
SHA512 8b0f2fe2dbadaef0bb75dfc67ba4158e87e16d941ae668947f5840ee54c38d43d0be2247e12601d5d771bfd9b7f0eb1726b312ca7c2e33c4643add6ba17e07a9
SSDEEP 12288:/+Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:/xt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 684fc4432c88268c767a983a0a34ce5f3f760e32ee320b221e5a8643f747c065
MD5 cf1457a7c923eabc9ece258d97932aa8
SHA1 d3956bbc3919c6355197a2151c1b16d1a8778d4a
SHA512 ebdde046f438df691ad7a333a7cc0980e555dff70c6105771d2385923bd566618258b66f478c4090f27af0ea825d1ed846c9902d22aff3decbe0ff519d9cbf36
SSDEEP 12288:1Ob9A4LWOsvAYFTbGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:ypL3UTKt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 e591f1ddabfe4d60d3b26e724bd61886e44a2d7101ca0a9ea1813f267d5a6140
MD5 92a1fa04dafd7f8b03569f8abb716217
SHA1 6114be43c50ae2925aad5d205ce47f5c433c0e6d
SHA512 4b1da3b981ed8da8e618764bee2cb6eac0327db21ce4bfd14d0244483afd59b250dc5075f1a440e2898f055766fa40cff35d406ab0bf69f3c02b2aa8d60374b8
SSDEEP 12288:wpFtpO/Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:yO+t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ccab1ef4b4305001ab99a27c6ed3316afec9ca8caa388fc86ba410a0ccda42b5
MD5 649fa531c36c9cba44495ef205adefd5
SHA1 edf04bc4378dbd633ea100ba30c270c36abfcb1e
SHA512 92696fb9527a0bd500cb9e3126678c30acb680739f36b874634ec7af3ecf7ce32ae3ddf4df01e324b58658d0e41f3fa35f0953aeef4973cc74ad4eec27c9b642
SSDEEP 24576:Y7NM9YmZqmWMUkPjZM48Mv6bEhs9t/sBlDqgZQd6XKtiMJYiPU:Y7cBWMpPjN8DbEhy/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 4d5a649ce1bf8bbc8bbbfb544674f1041ee77583fb6c21476059bf84d5d50110
MD5 cc871b91ba7cb732299cd420b8c0c502
SHA1 330a61b3319b454c86ada5188008d48ac23a0c0f
SHA512 b99d39fae4bafcd982a4f20eb65d4dde25fc26cea1d27fe49712f960517f9d2dcfa265cdc89e909835a6f8ccc59d102bc75a6a518941e03d2098704c1cbdef78
SSDEEP 24576:pW6BApg2YuyuNDYTabvcRvNYf8km1Lt/sBlDqgZQd6XKtiMJYiPU:pF2YuHNETovcvNYf8kmv/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 882e7328d52be6294b943448f5c67f34be594e37414761216aeee4704b18b718
MD5 ae065dfb0e448a10f76c10b3991a4125
SHA1 6347b8432e538b98a820b6b0c6822dd8c7a3582a
SHA512 ddf4558402b6c39515697ee3548dc5f68af2ff99f887436bbef70edf79938b1df0005604f7185f67ceabe8e71f97fbcdbead80651bffa447a88c240281977206
SSDEEP 24576:8AFs06+Omlf3NXEbToyt/sBlDqgZQd6XKtiMJYiPU:RFs060lVXu1/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 5238c588d4c41182c11c28ece3f04e09a5c3ed4cf14b6dbab4960845629590ad
MD5 d80590b5e531737cee01b4ff28c1f80b
SHA1 a1ec4c6f76f1920c7fae935bb21078d73916e883
SHA512 c2ee83a25b85e3f7dd9be5e2898771a9f86213465e9cf1d9f19db6c42ccf7f60371a0892de209fc91f57f71ec6448a739faa8f6622ee7b44f2edc1fc3d7842ef
SSDEEP 24576:8JnJ5D3Wtft/sBlDqgZQd6XKtiMJYiPU:8JnJ5DGt1/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 85d5ed1f1d56e39b12a14575b328082f2a20d4e390a4a9f605183f0ed904fac0
MD5 4dae2801c863c0d26a89a112e998a6bd
SHA1 8d5a018b0e44352395c1986f36acefec610069e8
SHA512 69cdefc7d61dbdae5f2f2048ec67e5d123ceae5d50290687c09c14e8d134ba36c9b015ffb5a3e8c2209ba0a04ce9172588f3f0117aa354e461d17674c7579f2d
SSDEEP 49152:fo06DIKdwc+eQnSt65aVb/snji6attJM:gBEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 47c56b7f74b254e68b4ab7a691157e1851817ff89309bdbbc0216105dadd8f75
MD5 cff8c52694f76508ac9895aebb71166c
SHA1 710ce43fc657fa8a6dbde58d59deb8aef5502f24
SHA512 4bca980c9e3aa86b310456700140bacc243f44db070551c37dcb6b7e2718b9f8dcc6ed37fb10dc3ea610a734e6057e45eb8c6100b611b29a6d7d9e89813d9cd1
SSDEEP 12288:fEP3RrsGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:krzt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 d42eaffc9438c1e445a29c065e01767b5903e0d5def516efb6ca1531b6d8af20
MD5 7fd404311b0f1bb73ff5244dbe5d9380
SHA1 62489d22585266f297e0ca6101789f4aaa9eb536
SHA512 3b3d6012ac3e5047b210eb26c26d19fb968dd655ef6d16a0aba45e36fcc340ec08d358fd377bbe8a5dc09de04ef3333d5795811d2d2349d158186fde412f5002
SSDEEP 12288:TjkyFGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:TIyIt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 1ec95aee71ff10b8602ece199129163b226d67b9be0bfbc4ae74857e28b6d9f3
MD5 bc40515ec1220e94f0ecad677ffb06ad
SHA1 38154f17a0d96b5254ac374fe42e232f2939ccef
SHA512 174753ee4b1916098a02a7702d78ce731f8eeba09239de11787f0894d31dd47463bd3aa9ece97414b45e101eaf67b79de71d7355508f9a9a076e269c44504e59
SSDEEP 12288:dFPGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Dut/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1d01d1b1e5681f054f4a2e827c7962478e9070d41e8b1c05377bbbcc29eb358f
MD5 aaa42e165a6972ab07a613308c6290c8
SHA1 82015c7ada1c956358831c5a3c3dcec88845d7cf
SHA512 ba355b932abb37ee6eafad7c66c216ccbff8ef63bc760e5834210f6b875b2a856baa28478f102d2d12734d95d7325e3388384d2e329dd48bf28f06330c558f9a
SSDEEP 24576:LQ9MxZKdcz97w3lt/sBlDqgZQd6XKtiMJYiPU:LVKXH/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 1c84c362dfc146f942363cd9338a5e5d39e0f36b7de5f57821f096efe3d19d4d
MD5 0c4e9783dcb2a8a3d7eec009da552f1c
SHA1 8c6e28237c9d575fc3e440a6ee10c705ad231e56
SHA512 04f1719cb5cbbccf0984ebfdd40c4e7a7f767fa0a51eccd9eb3c916b9ea44cdf6cefa31c033d9ad48a4ce19eaf5c10b981d127da53d9348ecb4e0e01eb9a6f3e
SSDEEP 12288:myoKo2HRple9ppGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:myocxApMt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d998d6097a31ab9e8e9d5ce4305748aca3c7d60b4b3a8c03417cf348f7902cf3
MD5 6e2ff0d4bda55b3cb909d977f1395233
SHA1 a715bf31a0d92249f93e0684ffb0cfaf98d20aea
SHA512 abf23e39409240a5c87400955424facf4e3e241e94f39d3c1d827ae9c3cb4e76ed070a5d0996761c3848b699b874264b0ea1fdb123989b7cf6afaec5b8b61af3
SSDEEP 49152:BWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKW/snji6attJM:50zuNIKEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d8be05d3d4484577bca795848f4a1be759cb21a7a066d2ae2bdf6ec097de6215
MD5 bb135c77840f595fd38cebc5a095c9a9
SHA1 a6a6729177a3d538fc6e3be508a4d68403a3debb
SHA512 79bb618b7fe9d5c5518acf8bdc95a4614f314a511f6c38e41f8fc89ca6de8fde9eee1e8b03643435a963469fb542b43b2b8ed2a471189cb960491b39e53685fd
SSDEEP 24576:91QT7EcpfxR+N5AWAz3ooiYtjMqbzt/sBlDqgZQd6XKtiMJYiPU:ITDxR+N5YzTfjM0/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 c4920f07b82a73629135ee75210facf764519ad3f7b728c6704cc788dc36c1bd
MD5 60b319aeaec19c5298218c3c4ddf917c
SHA1 ef8c3c5e07338282b778a8778d6d13b8f2048ada
SHA512 aea10d22fbbd45022d6a5956eb19eadda70f061cf038905a6bb322906a321f6b7344954c74c615a504ab95474ccd5bf057c3eb10c9c36ffd47f0004dbb42e275
SSDEEP 24576:yTMdOz0FFS+imSLHt/sBlDqgZQd6XKtiMJYiPU:e0K+imSLN/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 986d42e1335adbfbea6f0b4304042f47f6e4d2a19848add7b79b836d57b90af5
MD5 4be20a8d0f62f9ebc50cf29f5ef04f25
SHA1 c2e66dc4c7c20f636f29c7f619b006556fcd002a
SHA512 38d11804ba134f57f01bdc1f3731d409a6063ae3977ca23d3e83792ff3a9febaa77f21caea7c2711b64266c63d415da21366ab481e69de8655db7e6d80451efa
SSDEEP 12288:X47bGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:yKt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/320-76-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/320-101-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/320-82-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/320-75-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/760-551-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/760-225-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1184-59-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1184-61-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1184-53-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1184-174-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1396-261-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1396-557-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1756-196-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1756-546-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2320-38-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/2320-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2320-50-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/2320-49-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2320-44-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/2320-46-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/2360-281-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2360-151-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2360-545-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2604-236-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2604-118-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2868-32-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2868-31-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2868-33-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2868-139-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2868-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2960-181-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2960-474-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3000-452-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3000-163-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3044-140-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3044-260-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3344-552-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3344-243-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3364-6-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/3364-1-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/3364-95-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/3364-0-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/3628-97-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3628-92-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3628-86-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3660-11-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3660-12-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3660-18-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3660-117-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3720-223-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3720-210-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4080-555-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4080-249-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4376-72-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4376-187-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4376-70-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4376-64-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4488-248-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4488-137-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4756-224-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4756-103-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4936-199-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4936-549-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4976-282-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4976-558-0x0000000140000000-0x0000000140179000-memory.dmp

Download