397fec247d80f4699da929a65172013e93843cdd0b4346feee288685f674b73e

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
Size 1.3MB
Sample240530-edefmaed46
SHA256 397fec247d80f4699da929a65172013e93843cdd0b4346feee288685f674b73e
MD5 6321f572157a500af6a409b5da727f30
SHA1 876d000ffec5bf8de13d94abfca7172d4e0a2c2b
SHA512 e7e88349f68cd4c30af7d683ca652fa07bc2993bae93279dbea1f0713c4a8dbdac819e23653d622371904558457d8dce759bbd26ef9a63573b99db2c5ae57c20
SSDEEP 24576:C4oTPkCgwCbae/Fk6OvgcZLUDvpg6AtlbniXHhHwp7Dp/:zoTcwSFkenvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1132	alg.exe
4004	DiagnosticsHub.StandardCollector.Service.exe
1168	fxssvc.exe
868	elevation_service.exe
1996	elevation_service.exe
2280	maintenanceservice.exe
2816	msdtc.exe
3352	OSE.EXE
2784	PerceptionSimulationService.exe
4056	perfhost.exe
2052	locator.exe
2148	SensorDataService.exe
2296	snmptrap.exe
924	spectrum.exe
4592	ssh-agent.exe
4924	TieringEngineService.exe
3384	AgentService.exe
1908	vds.exe
1540	vssvc.exe
2124	wbengine.exe
4864	WmiApSrv.exe
5076	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3556be24c3136770.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\msdtc.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055bf9b5a44b2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ebe1ff5a44b2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d50565d44b2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009283a05a44b2da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051fd585a44b2da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c5e7a5a44b2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f749865a44b2da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000784b675a44b2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4004	DiagnosticsHub.StandardCollector.Service.exe
4004	DiagnosticsHub.StandardCollector.Service.exe
4004	DiagnosticsHub.StandardCollector.Service.exe
4004	DiagnosticsHub.StandardCollector.Service.exe
4004	DiagnosticsHub.StandardCollector.Service.exe
4004	DiagnosticsHub.StandardCollector.Service.exe
4004	DiagnosticsHub.StandardCollector.Service.exe
868	elevation_service.exe
868	elevation_service.exe
868	elevation_service.exe
868	elevation_service.exe
868	elevation_service.exe
868	elevation_service.exe
868	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	972	6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
Token: SeAuditPrivilege	1168	fxssvc.exe
Token: SeRestorePrivilege	4924	TieringEngineService.exe
Token: SeManageVolumePrivilege	4924	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3384	AgentService.exe
Token: SeBackupPrivilege	1540	vssvc.exe
Token: SeRestorePrivilege	1540	vssvc.exe
Token: SeAuditPrivilege	1540	vssvc.exe
Token: SeBackupPrivilege	2124	wbengine.exe
Token: SeRestorePrivilege	2124	wbengine.exe
Token: SeSecurityPrivilege	2124	wbengine.exe
Token: 33	5076	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeDebugPrivilege	4004	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	868	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4176	5076	SearchIndexer.exe	113
PID 5076 wrote to memory of 4176	5076	SearchIndexer.exe	113
PID 5076 wrote to memory of 4704	5076	SearchIndexer.exe	114
PID 5076 wrote to memory of 4704	5076	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6321f572157a500af6a409b5da727f30_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:972

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1132

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1436

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1996

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2280

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2816

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2784

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4056

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2052

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2148

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2296

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:924

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4264

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3384

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4864

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4176
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 4d795382a1a5a45e2fb3aeb6f9d793e39bcd36894e7179f5931bfafd91d3633c
MD5 8c7c4993f683d301c436fefdf55f58b8
SHA1 172c9e3089da14135457e3a763cbc9d7b6769fd6
SHA512 b7e48792cec3ae36767a39ac4ec9954c0cd143ac2da4de639f634c85080cbff6d62828db56d2879b54683084a4931ef365c300bcdc62c4f5761fd04657ab9960
SSDEEP 49152:6uYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z50vu6olbnoQx1:6PfTqi90bqu6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 063642f13e4d402998965ed017efe812bedb5eaec60a3c885b729d29b085193e
MD5 8d1012086b29eb4a85af1bbb4fdbd962
SHA1 fe8fffdf2637a10fe75b9b4aea0af56472b72ed6
SHA512 11cb9555f3802eb6d1a2f6f3c160e49022cee5cf023313814edc5b9dbb77029cd5e84dbacc22bb68ac9aba443334de5166abb2a755b28c6cd465e759a6d799c9
SSDEEP 24576:yidnBsuE+LUDvpg6AtlbniXHhHwp7Dp/:BSuevu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5c6849a0bb57711a6ee597dad8736b8e3a85bcb0e28b3f37b2e56880579e167f
MD5 a619301e02f04debbe2e91b7568c1b1b
SHA1 2778ddc5e12f87fc6f667534854db9962e2cfd71
SHA512 dfe3bb673cdadcb03e3754b38435c221c22151973d76e39c3b768487994f5f4cb7bac66499dbc9f74b8b22d4485a31a0e7f9708f071a0bddadc369fa0574fe2a
SSDEEP 24576:V+gkEVfh4CoqLUDvpg6AtlbniXHhHwp7Dp/:8gkExSBvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b0e64e4a4b1322a2893dcec31ba02c1564c9134141785b447034fa470280ceba
MD5 d6f0fe84872397f24625890e68940137
SHA1 d219fbde5dc3287b51e17f6b6ec765dd8353173b
SHA512 a0cf7c5a346deb4027411fde8f4678f777952438886c5aa3a5dc8a138d41d40e388e26d51396bbb5ce2acc08aee56c6db181d2141e680cd949d0a7e394da9b6c
SSDEEP 24576:yBpDRmi78gkPXlyo0GxjrVLUDvpg6AtlbniXHhHwp7Dp/:GNRmi78gkPX4o0GxjUvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fd100bcecf484cfa06766515a27a6ecd9956ab6a1612b0003b178c3cf0a2da26
MD5 75197e534426370bee72412d650f50f3
SHA1 3ede3df2abc3168a7801de0296cd437fd54ceea3
SHA512 8ad15462f5f86758027ce3517b4b719fda434810245638bb60a9189c37a61ef2a1f24e15acee08f240fb0fb9f43a5a0566c290e7fa6977020ab656172509d47c
SSDEEP 24576:YjLOS2oyPIXVqLUDvpg6AtlbniXHhHwp7Dp/:A/ycvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 90993df85e45e41b630397fe49f0100ce1b8d7eaa7d9a4dcb9597ade0f8adbb8
MD5 3dd128f578ad9fdd03218fa15d5faa85
SHA1 0611724c0101a29f7cce757b7a4a6d72837fb664
SHA512 e88692e9d754d661247540edeae161a8118ae54eed018e31dc4e2f6f93228c93813d777363add4035264caad1ec19ef00fc119ceea06a595ed1b9390483f3529
SSDEEP 12288:zfIASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/K:zfILUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 77b5b451e389f0037830d097c58da937494282dfede27adbbbb264f9c096874f
MD5 8befa61ec8af9a7ecb8a7ef087040be4
SHA1 9ffcafe88f1686817f7843819f55656155f4b88a
SHA512 68c28453fa78d14e7e671af291863ab945a2257b4da962ce3e6d47d3e9b25f1e22dde96cc837eea72ba5b80c037bb71ac75f6df5e9422518b21a550e32cd3aa4
SSDEEP 12288:seBNUbTVO86U7ASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdps:sJIU7LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a01e25c2c50c0a83f563d3f5c92ce55a3a406efb175bac74bac1c1b1f81cc236
MD5 441cd563b39bfe9c2bff4d85bacce113
SHA1 822bf1dc0037e76793ac346d55389c0b80f72e0a
SHA512 1301d635765150d8dbec8b61cdf3a4f605dc114990dbd92c13a50bb22a78062df8a61511a073a465002cac9c3bc7834bb35ad93db2d9248e8032d1bc7171c1f1
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:bQvGAdlCEL8c/yRNw5Cru6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0dab15ce1f4ee98e46100dcae0193713d670b2edb8018aaabbf2ff7ae9e22234
MD5 90de6e130d29faac17a0011d711b93a0
SHA1 93382eda08629d0b6f151c15b5a5c362625d1896
SHA512 4575a160e79e7d613bc5f96a137feea9a98a028c3dbfb38960ca09aa08a0f9299f5f0d7d9631c4efc20149c717ac4f6a36fe96feb2697608df3d959141291447
SSDEEP 12288:vAwSfxL/2Dc34DLLmt0LDQewsAjtASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcd:4dewsAjtLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8aa9e77b733090ad01121feb530a20df520dace1298d8639f44d7aec7413d131
MD5 155f6345159dd0ccf521e3fd7c739401
SHA1 dd5992422080693d2f57fb16a28d26fe7decb731
SHA512 1621f443bc723ea9db4382ad825c41c8edfa5f71579a34204e2cb99e7f2043d67085abfd398336ce8b70bc60be25c6bce9d928bf12fb298467fea4e4cddbb931
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH96J:jUEtQevvqc2W1cpV2EI329
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a3aea32de46da09f109873d1827feecf4b83b4a082f9060ceaaaac0b533699c4
MD5 24d0f22793c4043c46b9ca3e93a042c8
SHA1 cd0ddddab2002f3ab7767883bc8ef116ecd580e8
SHA512 68f8140f9c3b604e9a092f38eb28df23f0fde78e8b39851379e429dc91522d106c10d478331c1822f314074cc0075345976175cb8986d6960989f359518bec9c
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/zgvu6olbnoQx1:AoqtVjnmPu6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 41ceec5a90c5b25400617fa6631e485a28aeb311486da4238c4def1c4c94a9d4
MD5 569d8e617e3898c0761ad5c4b329394a
SHA1 a83fb05d5a8cca9ec1d99d37a23d6a9da6d8387b
SHA512 ef5c93af932bfa0c15848d1d6946c15dba6b651c32db2b06bbacde8dc9936ba96391ea3c56d7fe77ae47ece220c34804025091130879ef76755ef49219599639
SSDEEP 24576:XAhGLJIFoiwtA5l7S536LUDvpg6AtlbniXHhHwp7Dp/:XAMyFoiq5Xvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 667f062f258d757744a952fb65b34c22ed073ac6e3f5e141ac85b8db07a97ca4
MD5 a984a1ca322f3ac559e2d26b615acfe3
SHA1 23ad9f934384cc13952bd784f9f251b10677d125
SHA512 e7c8b7ce17395dcaeaaab2e4172124a93cf977e9053cd4bc571c01aabc7d0db442df32c41d83afa2d7a49931c6c31394dc8b2db8be75161c9e99c365ea502b2e
SSDEEP 12288:amw5HEjsChNVBFgl0WDm+CGASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxe:zwuoOWxLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3e9ccf333036cd915b6b411fa81d181d336233e7df3b7982ad6ffd8112f6dd7b
MD5 7eea7d8474b3d15a7d0884dbddd1da01
SHA1 f5ffefdee0961c3733af3f5c5a57eb5fa608a942
SHA512 35a841350ff23c439050b96288301ed20bc98c3081d505c46a8361e2cb66c0f883fef3106e6d815feef98d5e042063f0a4d28b2d75c2f39d532630d1f7cc998f
SSDEEP 12288:eBZ1IydASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/W:YZuELUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 eaf4279d48445e06dc563b1ddcfe6156ea425d5e0b09adc37a2b307280a2724f
MD5 c23d78f4867069681a4ee4c9170e9075
SHA1 4c313ef2061a7aee915dc038d87918b2aa381dc9
SHA512 c80552f1ae1a1b2b06a04c185373085a39e328ac4b6d5397195f57782a149a59c2cdca3b4a25778745d927594f9cec2701781f2a9d9b056fdf027e7fcc1df789
SSDEEP 49152:q0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLL:cwfhY7g/rLd7yYA3awr341gnu6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 d5573e06a33304104ac689458ffa4f97fde980047fd16503f559284fdad7a2f6
MD5 1d1aeb1db741aab7a8f2066fce8aaa2f
SHA1 bcc02a0b9574c098c7dcdd0ae82afa3944a40430
SHA512 b9454e4701e140ee88b418862fc4184f64caf71d1cf90c5327b4eb1fea15af3869c56d8805660814e02bbfd0a25de7345977f7820b0d09836158b76a175a6c91
SSDEEP 49152:Q0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLL:WwfhY7g/rLd7yYA3awr341gnu6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 9c849e5f161c6b3bb97061af9ebc88533d7b9a19b6798bcf60646ce7bf08f46a
MD5 1bb3fbffd7cccea2b8e2c820aaf79903
SHA1 a64c8694ca430db59b7ad25480ab6375cce033e5
SHA512 f96206c27446d300ec34ea45e2db87e405773cf34e7a59f31d94b14f054c6cf5b4a0dddb44af23d33899cacae2767fcdf6e0f9a9b854653f78570b85e1e6b9bd
SSDEEP 24576:fcTyYv0FteQU+5I2kjgD6iQacAxLUDvpg6AtlbniXHhHwp7Dp/:fuXv0Ftpn5606zOcvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 d4333ae0c322662fae2e7101a89524a75591736cd4da35e1a6c09aadae740f51
MD5 741dd518e07bc5d74132b5919b49689f
SHA1 c65f145ca15aee5c50102b1e7d4c57cc2ce5a89f
SHA512 9d801d19dc34646de6a520d0854009067b02a06a26ca2a8b4075e6d16df952185a316f4affbe47a578f31c21b202b896aac62496b12fe9e3ce614fa3974bcbc3
SSDEEP 49152:ty7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxAvu6olbnoQx1:YmYeyxHjWjMTqu6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 5e65a7f64bf4fcfb68cb604f0bb7438da525502200d45360418d1e8db05fd7ba
MD5 a585cb7737e6482bcd029148e7105f2d
SHA1 aa1936dae93991b7b3c10f1f32c209be759d9a42
SHA512 5f0c125998999f6384a26a47b6a89eb5d2a4514f5b1677874f681bbccb21160d5138858191b5f9b1103dea050f4b890e256192a102611fbdaa7222d95a06ad91
SSDEEP 24576:B6drZn1WEci182IEUeNbJeRgUebgW8168LUDvpg6AtlbniXHhHwp7Dp/:BWnDci18yNNUgbY0vu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 a67ef8b59d344ab35e15a7d10dd73984adb64da241e152f798fe9d232b981afc
MD5 5b22499ca3d60010bcb85ec7ed1743d2
SHA1 ad41b0628c288ed99cb1d7962dafa2d83c86ceee
SHA512 d7e52c45275b7c1d0808fb105997a0d83459c6105495e475083c3bbf4834b74a976f5c0e9960a8db9b76bc91fe5093ed1d6346b4c9ac0d5178a7093978213f6c
SSDEEP 24576:nk5lHW5EzMZupO80G2reD+melRgTTv/1nynLUDvpg6AtlbniXHhHwp7Dp/:3izMZm0GhamSoVvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0d5b4db9ec2db19444e5bb92b7a640ed3a0abf45bc17b6fc52dacd24b6392ea3
MD5 42c8b01f213e7074c2b2d4a7992e6d87
SHA1 abc489961bd1c46b563fac654af074690eca801d
SHA512 37cf83befdd2593c377d91688bdca94d527b4f51342cd23fafbfb1c920a016a6c631b09b36eac18f514ba7b276238873f5a30aa6aec15fcb11243b26a9b7042b
SSDEEP 12288:JwASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/U:JwLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6d0f1b2aa9fd59d9f9364a1ffd6b7bd249b30d70528fb631cd036549771add9e
MD5 f345cb7b21a9ca562ae3c5d1ee87f12f
SHA1 fe65a08af09974c29938912a22b9fc115de3a8c8
SHA512 90a080a6a0e22bbc3a771dcf03014a2dcbf79816b872550afaa4569530e1448ef0aa561a1fe902d0d744d8ab2c2ed0daceae72815e48cae907116ae373e54705
SSDEEP 12288:4JASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/l:4JLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 81b6ad49dbe3bed7bf839f8ea9a9df42a0de1798700eb49d3787d7308c4fc1fe
MD5 4e40aad3751a871d5453437312346f28
SHA1 157bc2f4c3e94116d4aea442c95c0b9592893140
SHA512 3183621e71ff70fb4af40ad6dc150afa7b99904b5feac26d023a1bebe0c7853176c387b984a80e4e530f208677f62e1f4029f3b386a9904b5841b76c9d5bfba9
SSDEEP 12288:OjASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/P:OjLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 66e9a83f8f1429565d2818ffe1734afc49e4f67e664c7eed0abc93a3a5b4695b
MD5 9ac3622fba2863abb14ed7408d307696
SHA1 4c7b6ad86f9a64e07e4250549c856c6db51b43f7
SHA512 c2ad52869428c29b9a197b480d5d37f10c2f29af6e4cf793858031943dcd756b86a1a294b0ee2c38c291022801816596ad556bf38f95dbd2119f19f33b5efcf8
SSDEEP 12288:6VaASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/6:JLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fed6c1bda6cce790e6fd27891979273823b9a7956542e235e31d9aab61062ce6
MD5 f134a0b6a908ef25ed6fe51aa98845ca
SHA1 5308ace022d521392bd3f69cceb1338b1a94c180
SHA512 f6a045db4df2a69f1718a33d6c1865154092631317a1ad2c9fbffaa418b2a61ba8b4d161b9cdff40fb855b2f8cd3db4c456ed4074a0853b309a21a325d35f361
SSDEEP 12288:ySASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/C:ySLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4159ec44ab9810e5a6226bc1f6a1a9f17cbf412260c0236a3e39525c2b6e7fdd
MD5 cc9215c72f534a50f97da5b3307b55e8
SHA1 dfa5708a0926adc5973eb8156f4de05ddfd4976d
SHA512 0a03415a804c28559c5fe0393c0bc4014fc7cfb7cc4f90c27a7bcc6d7faaec509f749fd12fd37275322ee581e080a7cba333b70a625b285fb1c3c1ce9563c477
SSDEEP 12288:YVASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/8:YVLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cfb3a2f4aa147dd6e3d08bec478e4b85e52cd8a2b19b737e151f99509dc3b8fa
MD5 e21b5cc08fe7e471843bb14cbec15a7e
SHA1 7f45802964c5ca95f6bdf913eec09d1e5e5959f9
SHA512 829b15880a0714348ef9ef76a955bc254726bdd3e7ced11ee1a8c1b891b90413d3e7a650c6a10c51ffe9e38c193350788a533d0cd1d4fadc7fa116c7dda01c39
SSDEEP 12288:LBASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/M:LBLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b62d89a13a750c77babd72d30b95e6a6895fbd423944b010394584a1dcbbc562
MD5 d213c2a4d56bae0fb20ace356a097993
SHA1 3dd801f4863e200be7eaf4a359ac1b4a9eb44837
SHA512 98ade76ad7c263410ec14538a88b605af75a5e3d69a0c22511d572447103788cae69820c238615559df2fafcd3be4faba82630da2fa15edd3f3128df581c5c0d
SSDEEP 24576:MZMSzFVSOpLUDvpg6AtlbniXHhHwp7Dp/:MZMSzfIvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 85eb6d2f9465c3bbd84aa5a26f712ba180c70ac723b23f60a15a8479fde3fdc8
MD5 8c05ce61e4ed43f2a72abec703bf9375
SHA1 d71cd8bb53c895748b9e9d08c3d38945e72994a8
SHA512 b510beb94dcac873f959f5777fbacdd96bd3cef49bead040ce68ccdd7f51eb6f716bc001b0758259325c429f0c491d2f3a748a340446cddc3c20ce5473c855a2
SSDEEP 12288:S0ASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/3:S0LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9fb80dab5747c61316d3efdabc62ff90dd20afabbb7b512565b710444685351e
MD5 10f99bbc4b1a30813cc496c59f6b0091
SHA1 5dd2fa35ec268eaaf521aa7ce0480ddfbeb7ba2e
SHA512 f7bbbab476f4d54df8bd84e023e49dddd7c64763b8614f7a54be13b94aab06e9e0dde114b1d5f8ecbae6785076e280e7f7d0ebfc0b6ad1f3d150f086cc5c70ee
SSDEEP 12288:V4ASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/t:V4LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 65803142c8ce6c5b02057c8c18f9dab998cc7667e7fad4e51b2febeb7b925e90
MD5 77e6c487cfaf3705eb189a928423e91b
SHA1 05789b67db5b11da225e8559a3ecd0035e8fc41e
SHA512 428a53b523c415b7877fea4733aa40b7c228ed8091326747e34758c6e33a3fe1193ba244cb7c6b46f3efdd7bc808bb3969453c3a20f05dd0bfbd37b0b616811f
SSDEEP 12288:4yPz5L8dASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/K:ZzydLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d2482430016ec46c8ebaa7edb09b1cb45782d3150369ace8f22735d42f25af63
MD5 cb936ba6e716dc6737f1c4db8c622633
SHA1 63d55b83e2511d06442853c54542ff47c4582930
SHA512 e49d1c69d168a806633a0326f3b00fdfb28ecd0fdefed14e449b1d3e003f92ac3f9de95603ed2c65831c770b20829fef2cb93aa7e85d777e4eb3d47be8472ff3
SSDEEP 12288:i0ASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/o:i0LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f7c47e8c471495d74507161ecd5ea1562fd6480cf82c94dd530ab7961ddf0160
MD5 b8e661176907bfe8be188b9445ac9f1b
SHA1 bae3b4e54b3efe60cec5caa4201c5932ff6363a0
SHA512 2671b779df1f372b5f378ba19d4a9e2a59cb45269c3fd15d751abedc26f68c3965cfa7a60061e61433501e74fb9ef053de0a4ffb5940166ac913bc00fa960fab
SSDEEP 12288:r0ASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/p:r0LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 1736313df8d6a70d219e92d49d74faf639175a13ddfb3a5857b8258a0ab88589
MD5 96e132e9312b9e78630e74f95c5b937a
SHA1 cae9fd8a866edbaa89a235dc9dc2a75e4c916c66
SHA512 fbd226616ecfaa89112341d2bf1edde53e80547c8eaf8910c21e6203945d76908663e5e143f28b8d47251d9049fcaa07d6a7e7ee6df8e6f0ff03ac61ab953036
SSDEEP 12288:3yPz5L8dASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/7:6zydLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2bfd9895d359883c165a180dfb00959cde0638fe704c88531b1c6c531bd986fc
MD5 49563dcd726d2e0e06d27f867172bdce
SHA1 b92422991ad7b4819ffb4690d4b66e10e29d6289
SHA512 5deee49b6e28e48b28dbbf584ca2375d0c24655debede100c49ff82a36a4656d65e42f6ec03c64879acff30ef8e5cf7d39e281c4059b33151bf3fe42f6ea97a4
SSDEEP 24576:RTHaLl3z0zDzLUDvpg6AtlbniXHhHwp7Dp/:RT6Lljrvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b1229af895350a07842e43b5796bb46dacd3543b6dccf1cb30d7f1e26dfa3cfc
MD5 b0549f6de2ac4c641293db0cee951562
SHA1 75d3f1655a9747b345ffd5f424b30d90c2ee36a8
SHA512 e49f713c2b8eb1c2ae69c5414da76fc27c69b282fca69669d2c2091fcc4cc32b50a0a297ee28e273092cb3cca8a81096021a85db3ea7006913bd832d8914ff57
SSDEEP 24576:f37d9CHKy7GZfLUDvpg6AtlbniXHhHwp7Dp/:v7d9CHKyaIvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6e50b0547bf2955cc4922c5a09ea1d83824a926031e7a8c5a5e6033bc748f411
MD5 0410ac0d39f0438c1fbb52f979c25072
SHA1 ed6d5e229c640b5ad9f01427ad2b17c8ab417c6d
SHA512 0a08ad2cacb4ead20f857ec00ac60f186262537e4b4fc05095938a8bffd27186b2924cf11337c303e20ad6e8eeab990691e39408a949e348f3bd5a9ba8f6cedd
SSDEEP 12288:RDASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/B:RDLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 52b58ce81411a8e6274228647e0116f9dcad0872c15232a4b3ff17e52e6bd18d
MD5 4dc5b5d3f713011f04478066072f10e9
SHA1 d4404bf06ec3e81595e5e06614e648c071decfb5
SHA512 73fcebb4722c39bab1a5274f4a12bd6138bfe24b5ce0dab7b3d70b7857ae8000862ee40104e0a06f9dfd96de95ef744ea0c1ba26be0a04fb14f282c929d7fab0
SSDEEP 24576:jcP4mcvIjkGOxhKP2l71nNKbrh/8KBMLUDvpg6AtlbniXHhHwp7Dp/:YP4m4IpOO67W8K7vu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 7d0079429b246e8b349060b35a6ecd97e8d921e9d7477b2d3347b0c22a2c0972
MD5 9565007b70e8e075840dad3abab091bb
SHA1 0551c91e933dd4fffc429b0927b0f60ce39b0ce8
SHA512 47b2646bc9cee19b0906b259e5ebcd792da5095530fe0e651667daf4b40848bd635ad8702701b547bb1a3fa4da1b517b475888acdf1a3f07fccb1570dca9979f
SSDEEP 12288:GUFmDDLvASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/h:8vLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2a0f8ef5ae53d452d281eb6052724e4b4e4f37fa42177c9dd09e4953320bca30
MD5 2637db9e82f1356f27de5279012f1afd
SHA1 bcd1712dfdb450231ee0ed22f1f7cea68befb02a
SHA512 83cd06ae9282177d68747b7c1f9fa94aa6fa59b95b512e9b59c882cc2ee1d9d1b337d82cc2680591770fff513705121fd0ca5b023199672e0cc9950e493ba199
SSDEEP 12288:mkASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/G:mkLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 bf2d2ebfda3a4a01442913cd7d16e7af2739aedf14e711c0ca08753b67bc1cb0
MD5 67fae9e13af1e08f471840e1e5ea256b
SHA1 9c2f7d39776cebd6d523ce2c98dbc286a3e61c4f
SHA512 ccd8b18997b6206fd22e51b594975782e1872e8ce86beed7c7b0e0980aff2c20017e6b300f692a13b709ca383284e48323b32898d6212f7b8c4ec798aa606294
SSDEEP 49152:Oa0h2GEkuAe73q3pp46zwwQPvu6olbnoQx1:Oa0hNYG4Jwyu6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 43cae41f919c307f393243376d24ce9e4de038c10646ff77511365d5d2c07332
MD5 b8a96177c5c94c19bce37b513c81d00d
SHA1 2b7d4175e5b335ff5ecd5f3b702ae0bb5b2fffed
SHA512 dfeb7311b29f65c4bbdb9c4467eed98891fa1aa80b6cb83eaf8df32926f300d43eaad7973e8334d730e6af2f99070a4b8e935263358521327f3bb7a35d350f75
SSDEEP 12288:hhbHjfXZASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/9:hhbHjPZLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 98532809a83dc0309a8ec4e13c8fd4d4595e0275dc6f122aa4c2deecca3fa1f1
MD5 733db5d5e3ea5d89f2448924b3aa1aa4
SHA1 2b2be9c3c0c03592bb9c15c06ee0335851e280d5
SHA512 ba3dad3ab66955a8fc0e49c3880b9d35e5464dc509ee5fbe1c7ce2efe28db9d36184ca204b7fd3131ab846345f8c4483797bf618aa4757d424dd4cd3342de3b6
SSDEEP 24576:O3YgnJcRTk4yti+R5dBR/xLUDvpg6AtlbniXHhHwp7Dp/:OIgnaTk46pBR/cvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 29f5bc174ad85dc1fed4b216583350e011a5a67e6197778b2b1680ece24b91ff
MD5 f391f00ec17ef77e4734e7e7ea00ce38
SHA1 688d97b9339d5eb7caf9358dbd7c532a5ab76cc8
SHA512 88431a801ef158da92d3beda05dbcdd9883c23843445bf6c9ffba94536fc51ca1e1b6985c544098358f27173b78eb3b3fb5aef04ba3654a726ddf800d24f4bec
SSDEEP 12288:boASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/9:boLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 70f424ed9222caeaf98c226b565b87451fa90288c2191f97ac5547f4bf0655b0
MD5 4ed38135b077ee411b35889267f427a2
SHA1 5aaee7a8e6c2dd9f1d84c76d04f79f43ba65a54a
SHA512 9555ebc80adab3a60a67c7eb146de86d0fe1a5d057655fda88807060d9dc7a86d68fa290a26f88366c541f65751c1078fd1a4b928e502174e6bb61b86a25b4ed
SSDEEP 12288:aOb9A4LWOsvAYFTXASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEx:LpL3UTXLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 e7f6b19e4f53e3cd232f337801233093065edc4baf328087bc4e6f790b9e75a5
MD5 7c86e959e3f9f15fb8d71b2382fbd49d
SHA1 44084588293f37e1df405fd8706e7a198190291c
SHA512 30d8fc69ce84af0d7855b382de9e6361516c61227f24e0eceb6d71dec11c01719ea32313375453ee5b34ab67aef38773dd19be0e327210e16267dc2c3b9f2322
SSDEEP 12288:zpFtpObASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/c:PObLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 91ddf8929574cff299c0803df339157337f1ae20dc81132fab24b98b90129066
MD5 ee14a5b1cef4f058d0890ed573b6e84e
SHA1 e338f358f905462218d2f29d119f0d210414e61f
SHA512 1772f55e3a83fb0868c22084d570718f05421e763a4c167f8f381bc74668a27116fcf1bcf3f320cc2e5fe2141b5edee518752a13eb07949a5d8a40ec3e305efa
SSDEEP 24576:A7NM9YqZqmWMUkPjZM48Mv6bEhs0LUDvpg6AtlbniXHhHwp7Dp/:A7cBWMpPjN8DbEhUvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 319d2e1de15bc7f5eb33c208dbd4c5f4c6b35d7cd1a1b1c9c9e6773d3890978b
MD5 53744dc304591b57c874b1981a837b1b
SHA1 576128e4a70d9092659eed969d13824bff976c59
SHA512 d828001256ab5b2dbe7a78a79957578c2d4c2081931e29972591fd47b7713a9364fb719b18961f3a2e6297e5cd9c8d17994ca53243990f10e329f35d04e255de
SSDEEP 24576:FW6BApg2YuyuNDYTabvcdvNYf8km1eLUDvpg6AtlbniXHhHwp7Dp/:FF2YuHNETovAvNYf8kmFvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e6d73fdbc2910873e2ac2a074ff8f0216de8c7eb15414bf94860a437ddcde312
MD5 c75923d7e4991f25f36fec6646c33d25
SHA1 eb7745fc7c4849b46ba91c9a44d45c92b33e3658
SHA512 f5c7ad7bcb7367061151cda27b2d7ebe3d50a0927a2f053ec11a68470bff9bad856c69ade5f38a6a238f2ee5f03f1a73b25f4fdfec7bc6363f134f450d79d719
SSDEEP 24576:5AFs06+Omlf3NXEbTofLUDvpg6AtlbniXHhHwp7Dp/:+Fs060lVXuvvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 eb997c5afa89f3a33e6ff80f3921a5c84cf285494e87cb2fdf1ef4cc425115b1
MD5 e9996bdd5c679ceeb7a38d2d0b8bec79
SHA1 d745e06b9c9b626b1dcffe081ff67f9c123c3cf7
SHA512 624f69772b9e36fb9b389aee5def46d3125b8cf67fb3138bd5f73d19ce5f27a71e6771ad695fb568a6e7c121ffeed4c694f40db148ec6bb6946f1c8cab6694c8
SSDEEP 24576:AJnJ5D3WXyLUDvpg6AtlbniXHhHwp7Dp/:AJnJ5DGXvvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4564893aa2f4df2668ea9a3816bc02c0774fa110c96000999e01703eb6590b58
MD5 a86dccb6ce487ae40f60391dddc60f90
SHA1 68572fa62164abdd357d24a36c0846500e4f9ed6
SHA512 6a6d65f4f83a442f6ab44900592522165343052cde6842bdc1d5ed612aaf85d2268b723bcb8dc010340cee5a4c6adc51bab1303f1408c7776f3e07a6721e3df2
SSDEEP 49152:sg06DIKdwc+eQnSt65aVZvu6olbnoQx1:dju6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 d4e69e099cb9e9dbc227b9570948fc245ced42652a6c32d3c81e84e0caba495a
MD5 4dceb8c97f0f5f807f88e82f59380f70
SHA1 2875ebd4ff04b94eed52a2aafeafb3f496cc3e9a
SHA512 a36bd369836038cd353b1a8c34de843ccb61715115269f1490b14bb044e52660fe99e3b2e64ad2aba02a0137f46b17677948d70440c7e970e13a3dd47e5da584
SSDEEP 12288:UEP3RnGASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/w:PnGLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 08cd825cd68ca769fa5675d968f6d0ef29636d4afdbdf207da79de273975d204
MD5 8bb46e7604717983216ec9dfe30442d3
SHA1 4b1ca7927533948993efbd022f50d6f3590c2367
SHA512 e31973681aed92bfaf212cd3f64202470590f0620055c23421ba51e67570137050a94c680429210bcf0677324a7c8ae243277a30dbd658c75274a951354d37fb
SSDEEP 12288:zjkyJASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/r:zIyJLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 5e5d3e59e51b0932e683fbc573ca3baaf4d5ffd7ce599573491e4340c5e06923
MD5 78df30dd575f3662e1cb59cfc07f5c61
SHA1 b9b7113e7d978ac54048a7fba8fcf4bf3092f232
SHA512 b6845abc66dfd510026d8c9b3467d594e44ac265634f5a1f9fbbad6e8a2f2fb3bccc7875ebe4b651d5968fc5309c076754b1ce7e097a49deb45f0ab713093ec0
SSDEEP 12288:4yLASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/M:1LLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9feacb265e8c2bc006b1f2f7e2dd733be6c6adc7a6cc40aff5d7156fe7dc5c5c
MD5 51f0f1964450918ebc3d3e43ff6fdbfa
SHA1 bdfbf1956933baf483d8712c68dce6f896926cbe
SHA512 337cbab90d6b6581b5cb69f24afe1df8b562d8db9c7f71bad3cb884b26c3518b8ee6ef8a82f4cea2261ecbc58adf5d4ee70b67cadaa4b98daa274ea3dd676fc5
SSDEEP 24576:1Q9MxZKdcz9dw3cLUDvpg6AtlbniXHhHwp7Dp/:1VKZ9vu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 495989e4b89f66502bb3bc7c50cf4a317f9f4a5b74f137e3a0c6eb07ac1fe9c9
MD5 82f6712323539e6aa467b3b553383a23
SHA1 ebf0138a4ae265ca24291b71ec69b44ae2a3a425
SHA512 7a0f3b99ddf35a24d542b51c4201cd594fb2a43ad4592855f05738606fac59c7c1a97ac76cf2aa7672c220bd66205e1009267a5f7657498f35cc6477f17f0cbd
SSDEEP 12288:byoKo2JRple9ptASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdS:byocDAptLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b0bd6baf48d4477d8ad46ab5525ebb64cb2c8f9c5ce93d4284ceb744cd23c412
MD5 b719ecf06b41c02b5fefa3fbf077c8f0
SHA1 510502a7b6b5066ca2e829dd35bc51fbc32267dd
SHA512 ad5d0700b1ee36b3a3588ae03f9f68350d3a6bd274837624b16dba4b855744d4dae71dacec920b334d2d6913d959bb97ccd7a55ad2ccff2fe4e89056b0f281dd
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKAvu6olbnoQx1:f0zuNIcu6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3cfa3e959e0923ec5c3db06b0ec8b84342cae1a0999888f650374618a2801857
MD5 33c56003c0588b790514dfea823f83f9
SHA1 01be8f57c5f89be62d22b96a7f85e546d587ce20
SHA512 1386e58daa3e8150a80d1b479c7086bad496a3eba73559e3c6223f408cb2bc583e7cd0013592db376ace5518f4349607fe38c94ee3996c708c759c9397978b46
SSDEEP 24576:s1QT7EcpfxR+N5AWAz3ooiYtjMqbGLUDvpg6AtlbniXHhHwp7Dp/:xTDxR+N5YzTfjMavu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 2221ac91d818a074b4caa9208e56a15a81f996bd6cf1867dd06e31ae294e5598
MD5 44adc26b0c9e5042559e80642bac33a7
SHA1 c8b17a69d4626fc186b99e5b7170f0c552248f3f
SHA512 176c92abaeb122c17d4ba28788d52fd50a81d23041bb3e2cec550f01ce1b240cca0776db168e06a4454784bdc3a35f1426add65c8fa4c59cdd02d4d87b012cca
SSDEEP 24576:oTMdOz0FFS+imSLaLUDvpg6AtlbniXHhHwp7Dp/:g0K+imSLHvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 911ade53ffd926bea548824a8c11e821a2f16b12eb5bd013835addeb05b87b56
MD5 c461e41c68eec54669c0c641fdc9d784
SHA1 f5f31f8e279bdfce56f70a0a05495acd402a1840
SHA512 f2cc669793a1683cafd1526a817197dc4bc87206c36213e04325f1d69ce9502267f7505fc9dd61d69c9568c4e659923ce9750b830b7b0b9fe6525284fcc4aa93
SSDEEP 12288:w4KXASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/Y:mXLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/868-37-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/868-31-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/868-39-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/868-121-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/924-555-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/924-122-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/972-0-0x0000000030000000-0x000000003015D000-memory.dmp

Download

memory/972-76-0x0000000030000000-0x000000003015D000-memory.dmp

Download

memory/972-257-0x0000000030000000-0x000000003015D000-memory.dmp

Download

memory/972-6-0x00000000021A0000-0x0000000002207000-memory.dmp

Download

memory/972-2-0x00000000021A0000-0x0000000002207000-memory.dmp

Download

memory/1132-104-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1132-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1168-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1168-41-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1540-158-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1540-564-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1908-155-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1908-560-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1996-43-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1996-51-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1996-134-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1996-49-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2052-112-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2124-565-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2124-163-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2148-486-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2148-114-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2280-54-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2280-62-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2280-60-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2280-65-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2280-67-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2296-118-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2296-466-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2784-157-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2784-88-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2784-96-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2784-94-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2816-69-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2816-149-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3352-84-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3352-154-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3352-77-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3352-78-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3384-559-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3384-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4004-24-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4004-15-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4004-23-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4004-107-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4056-162-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4056-99-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4056-108-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4056-105-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4592-143-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4592-557-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4864-166-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4864-566-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4924-146-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4924-558-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5076-169-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5076-567-0x0000000140000000-0x0000000140179000-memory.dmp

Download