9097662d05b5dfc07bf0e27b278818ff532ec5b319f0d6dd3ecabdc994f98ac4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
Size 1.6MB
Sample240530-gdccdagd6w
SHA256 9097662d05b5dfc07bf0e27b278818ff532ec5b319f0d6dd3ecabdc994f98ac4
MD5 66d1ef97dd08b7be33002211ffb09f10
SHA1 56205e2eca4ec667b2875f1350b214dc77cd2f94
SHA512 dddca7994bc59fa28c69715656aa7c9a9304e13f4754e3feceb6e7904d1cf3fb298becbe83e54f3c6520e74d12bdd906e6f7c1e469982783fb54fa13fd5c4a32
SSDEEP 12288:1dhjo4sVrLzxAUMPa76huDeegxo8vvEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsz:qDMS76huDyqKERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1924	alg.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
4444	fxssvc.exe
4508	elevation_service.exe
4692	elevation_service.exe
4928	maintenanceservice.exe
1668	msdtc.exe
3400	OSE.EXE
2016	PerceptionSimulationService.exe
4920	perfhost.exe
3780	locator.exe
1056	SensorDataService.exe
1012	snmptrap.exe
1656	spectrum.exe
1724	ssh-agent.exe
4336	TieringEngineService.exe
2960	AgentService.exe
396	vds.exe
1672	vssvc.exe
4888	wbengine.exe
3764	WmiApSrv.exe
4856	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2ee8c03bc3a5208d.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\msdtc.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{125326D0-F6C3-409C-BC6D-35A6D8D3AF5D}\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005965a2f853b2da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f339f8f853b2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041102ff953b2da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a401bff853b2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6a09df853b2da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cb3b0f853b2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eddd79f853b2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5004	javaws.exe
5004	javaws.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
4508	elevation_service.exe
4508	elevation_service.exe
4508	elevation_service.exe
4508	elevation_service.exe
4508	elevation_service.exe
4508	elevation_service.exe
4508	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3856	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
Token: SeAuditPrivilege	4444	fxssvc.exe
Token: SeRestorePrivilege	4336	TieringEngineService.exe
Token: SeManageVolumePrivilege	4336	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2960	AgentService.exe
Token: SeBackupPrivilege	1672	vssvc.exe
Token: SeRestorePrivilege	1672	vssvc.exe
Token: SeAuditPrivilege	1672	vssvc.exe
Token: SeBackupPrivilege	4888	wbengine.exe
Token: SeRestorePrivilege	4888	wbengine.exe
Token: SeSecurityPrivilege	4888	wbengine.exe
Token: 33	4856	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4856	SearchIndexer.exe
Token: SeDebugPrivilege	3940	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4508	elevation_service.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 5004	3856	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe	90
PID 3856 wrote to memory of 5004	3856	66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe	90
PID 4856 wrote to memory of 5692	4856	SearchIndexer.exe	117
PID 4856 wrote to memory of 5692	4856	SearchIndexer.exe	117
PID 4856 wrote to memory of 5724	4856	SearchIndexer.exe	118
PID 4856 wrote to memory of 5724	4856	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1924

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2528

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4692

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4928

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3400

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2016

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4920

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3780

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1056

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1012

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1656

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5016

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:396

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5692
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4296,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
1⤵
PID:5756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
Size 2.3MB
SHA256 c6b41ed250c6791aa04592fca8cb39fc0a1e83446fce40f57bbdb7aab70e4a78
MD5 241792cf2eb14ba445f0603b52f2e0fc
SHA1 3fc8444cccd4406ca90295e4d01fd0f830e01abb
SHA512 88683d42eee566b5dbeb1852624b61f07617b80c995c50e4dc9c9acb1e5e048b4697dedc65098f78a6431cf2ed5e76114fa1067521f4ee597c1f0726b90fc6fe
SSDEEP 49152:d5Y3Y2oN9iWHMokhQ7c49W/SIk8x77AA:fY3foN93C7kk
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9baabfc2dacc33c84117e7c1621547bde7dd6f60284853d9dd1700ec9dd29aed
MD5 93303f3c68f9947f7ccda4adee828ad4
SHA1 00e5554b5470d4440e652247e6b49b7c1f8006df
SHA512 bc9e0fe0204cb03ec85564b55297c44eaa3aa81b9c0732f4fdd6613b470c205e80a8c94d68ff2550d0656ed0ec8949fe828479667ba57bf165b46c1b6f3c88c9
SSDEEP 12288:hcQi6mNJLBsunE9EdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3Rgz:hiPnBsuE9ERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0753cbec2d21c82f8e868c23fc29fccc8e34e329ab92c6563fade4822421ce7a
MD5 c9d0fec481f7e0b6fa2560bb0951186f
SHA1 85a2b5f4e39438d3539b01968307c8f813725846
SHA512 a43ad39c6fd862203f4f2a8325ba9f2b50c634a3a7f6eb974cd22f96985413c1cc53f1fbd345f5262ecc8e2beef3f0844ddde1ead3aa68aa80d61cd45d7a51c9
SSDEEP 12288:m7a3iwbihym2g7XO3LWUVfh4CopEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM5:3+gkEHfh4CopERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0264b8a3ec8c0e05ecaa1d1dd35aa806fce7e61678329372693817cd2db96d2d
MD5 c65ed563b4f2a90fd83b0147217d6096
SHA1 ba6f74384bb87712561a2dde2c20cabca735bbd9
SHA512 dea00f3d34edb36b3227b682aa309a7378c96201ea16f060980bc04dad58b051d6acf78d5a2936ea0c108d19371c8d0e1ea6c657bd53d9b183f3529f39b74b60
SSDEEP 24576:PBpDRmi78gkPXlyo0GtjriERIk1k7c+vDqGJAAg:ZNRmi78gkPX4o0GtjTIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 846d4b58d9a8009142b5137e0f0f6ed655bab54f01495bfb1798995772c97aac
MD5 036cc223769bfcb4e3f5ce67bb951a48
SHA1 fe54103227bbce8e11bf04df51e5805f02ad859e
SHA512 bf73eb644a3497260d1f7e7911dcbcc96ca85081ef8a6f190bd8bc9dfd3934f4339c15ae74fe3bbcd5b537e8c62839ab1544e23c7e9dfc7947f19b2bf21c360c
SSDEEP 12288:MfC6Aj+TN5uixZN+8rKhUdTC/wE1rD0Ca5ZIXVpEdlIIDPa7j9aaV+aXXZdceRWN:gLOS2oTPIXVpERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b78f9a00eadd47dca7f4546cc0c9c49557554b0a399dcba12c056d85342069c0
MD5 a2840f9488746fb7c2ab5de43f916d67
SHA1 a47a241ee63bc704e0321adbbeb55b8f2a2b9bf7
SHA512 cceadbd55b44f73e57c8efa793a14fbd2a8584a3a6aad48dbe23c642df6174c2004f9d0c65048c1de5207026d0c316449a2c870fc18b112e6fc7fb5cf1d549e4
SSDEEP 12288:ntzEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:ntzERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 047bf1871862b380b9021da3fad7cb6ce76231192499e49ddbbd8a20d5b726eb
MD5 cb5a4b01a7d3c3e0a7800b81297ccd9c
SHA1 7cc2da090d519f036ed443df2f91e5cf91afb90c
SHA512 18abe2f23d752b015e7522433d89a706a65baaa7d109ad1c82cc61f3e73ebe0a67892e5f640486c7094b6fe88441392575a776c318edf2c0010d0b748100c34d
SSDEEP 12288:PeBNUbTVO86U0EdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCde:PJIU0ERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 799d94efffba8f3f34c4154e58b26fa8323ae67ff5b6a00c0e68d54c776cd0f3
MD5 7bb1f829d45b75037ff35957eba29423
SHA1 39e11cbc8473ea75307467d47dccbda9ef54f9a0
SHA512 0416ab625907ee7e70ec3070767222fbad916cefc5ee0c3532014bc402fdb7d1c1999f37f1accfabcc237281a40c65f056f03ad42d2c578e39858ff6856ecd02
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THQ:RQvGAdlCEL8c/DRNw5C/kk
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5f31ae591014b88e310d0dffac831d82fc8a562eb161b3d77c11d152ea0c3562
MD5 335e9546be30c5a302cceac8745a122e
SHA1 53a37eda57253161968bfc66e2c69c1e3318bc35
SHA512 7112bdb73bd34a7871c035c050b626597b91ee5e5f33358b60c84e5378167d8298e3c1f4d3d84db1fb7a39abc2dc3ed003781d1d23b33a66c2071ce7cd75b45c
SSDEEP 12288:rAwSfxL/2Dc3RDLLmt0LDQewsAjqEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHou:U0ewsAjqERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f5a163d93b0f47a96e29cddd70a41d3b2e8344f50d857a81bfe894ff838f1e0a
MD5 1d5bb12904807fc313c31ed164f81f72
SHA1 03e304a706d42d4d612e4c4846cd9f75ba93df16
SHA512 ae1e059d5dfd181751626da01b123251ca1a14cd97c210a995d45eaf2af44047714096d057340773c6abcbf17410f33e82f3a753161b169d1450e7ba6710b71c
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHBk:YUEtQevvqc2W1cpV2tI32G
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fc7dba7209fe6866fe76336f4a69c6fc10a426783ab8dbc71aebb58485695491
MD5 719e44ec48f2efc6220f0e0d694ce007
SHA1 e9b36bfc09d20a19f902f855cf7de9ddb579d514
SHA512 cee431b3728f21481dd2671b3cc03366d93906c78a358de80de49f103f1cc1b2bf1266087c7dd3da4cc42422b79554052c978b4c57d24258049a34557f8a6570
SSDEEP 49152:OCbRquA/m2yL5zQfFiV+XenmE3/z/Ik8x77AA:joqtVjnmLkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8f68fad31284176c0b89d367f38d961579803ad1e29d77fa20438d46e88ec861
MD5 a19789229c3b9275fd1e78eb5839f8bc
SHA1 7601396465a171b774fa534de7c44dfa7c1122fc
SHA512 6240af1ab04dabe386fb23bbbe30e58b02d100d58b603f40310b39df5a373ea6e78742fae38bd6758cb189bc120009c556faaa92bd3b86bd5c35ed2202a6de03
SSDEEP 24576:zAhGL3IFoiwtA5l7S535ERIk1k7c+vDqGJAAg:zAMUFoiq5yIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 dac8b40e7d7c4be4c697930ceb333225fcd9eb0b6a8fc4f1652bd02007a595aa
MD5 2054d7119b5d6356cc32ff1550453132
SHA1 d87d29438f63f4472d56e35904e5d96655cf6171
SHA512 ec9a4e1946310a6a21e478499676350aea68dc4e75a8af9580de79c8a0d14965d6e8c0ff499802383a7840223d2740033dca61b17fea52ad675b781a1c242e6f
SSDEEP 12288:Kmw5HEjsChNVBFgl0WDm+CVEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1E:Dwu4OW+ERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3852e568a57c0dc00167e598cb9a20a01ac985148ffeffd28a7b1da317433d67
MD5 7cf2fb1f5bccdcc79a1ba4f539af3ce6
SHA1 2937d4eb94f81e14af9a3e15170c9a9b1ce84d2a
SHA512 e9c0728e7b284c1fb03a087b0b8555780ce74c242fe7c580bde9002de72f44e26ef0a9e2635d05e4d03db62cef8f94858e596ad8004cd0cd235b0597046d89d6
SSDEEP 12288:BeZ1IyaEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:UZuvERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 9441f623ed2ae5fba0a3965240db82d35fd5fa3747ba1231367f6c6aa259c76d
MD5 f82ce7ffa43b55f78353ef58d55e220f
SHA1 59f04cfe7d6d48207e31e1f21fc6ef20ab56a473
SHA512 6fc4122a99b27c5321cccdf85e4615a53ae59f905ab3d8d769029f55c6ac630870a1cc4605072e9aa27a4e0e38fe6cc113caaaf0ea183c82af618d3cc5362a4c
SSDEEP 49152:u0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWLg:YwfhY7g/rLO7yYA3awr341gDkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 ddf8d68cb1c4df70b4aa44c371378994181c8930ba45de7e1dd43c841c690eff
MD5 8dc603bf6faa41fd23343d6855e55aef
SHA1 4190c6c5831cd9c72b8a31de09ca5c9b09b73f1a
SHA512 7f52ce4a877aa723e3e3b8ca4b9bdf17476c14a122efecaa9e140fef653ec2b2fe46b10a435c3a0ac76340a49beda2fc0c0d014923294dd12a45b6f43a9f5e5b
SSDEEP 49152:n0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWLg:LwfhY7g/rLO7yYA3awr341gDkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 3128ed8031dbffb4702372fed1bd45ebad21d0b8723050f0f5066b83f6895200
MD5 01ef084d5b05d1f821879a86e7ab79d2
SHA1 75ca65036225a530c391a7468609ee3f7c460cd2
SHA512 173290f91f9b3e8e76d1272cd5671cccf06c00f68a7e5d1c95e9812ddbafd5938c2535a7f822d567d459927889d344cafa37e6610c96f2f3cb1d9501ddd8623f
SSDEEP 24576:AcTyYv0FteQUd5I2kjgD6iQacA+ERIk1k7c+vDqGJAAg:AuXv0FtpU5606zOrIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 fa50ab9bd85ef8cd43e8f4d0481aac8bfe82f523274dde4fd8bf620c3094b2dd
MD5 8b7eef4aba83f86e1dc1cee96b2aea75
SHA1 c2d4cbfc3df627b6cc1e34a5c2381e7562c9fc74
SHA512 20dee9010f33eabdc818acd48cfb750f03bb405745e5c28ce8fd2d559d908e18184d918b147ef8f0ac13b5c744f9eb3e4ae1c10bc14c974490e9cc7b385f8fe5
SSDEEP 49152:My7mTd0GxN8jyyncHjXKUyn4GVcbDSKrNTxfIk8x77AA:rmYeycHjWjMTQkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 7e1c9f12aeba0de7b3e189add994c7e6ecd1c5cecb4ec1a0701286107808a03b
MD5 92c3d8f34b6f1717a4a2295367c2eaa5
SHA1 adec313b30a8e67872c943f87e7db2b0d97319c3
SHA512 15259616c200b0a41a68a5f5e1d2d581e69a9d6e3ad505892f8172cdee0c2933433abb273d1ae05498124f2f647a8e556654367b212d945aaa169dd278628f8e
SSDEEP 24576:E6drZn1WEci182IEUZNbJeRgUebgW816XERIk1k7c+vDqGJAAg:EWnDci18NNNUgbYzIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 18059cbdc30aa62d9b15f59784532831abf310af5730d9dd56a4e0f9648a8f34
MD5 78ca78e6e71f193ae0f897d5b50902ba
SHA1 71dbc63995f7217ff6362e0f150cee806ff6b9bc
SHA512 43862a95c28489c219e682ef474ddec52e4344c246aebd970b971d95ac7df12916adca5e12ca775de7ac996adb8aff39997ebcec2911f1da4e3f848faddbe589
SSDEEP 24576:rk5lHW5EzMZupOG0G2reD+melRgTTv/1nyQERIk1k7c+vDqGJAAg:LizMZw0GhamSosIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7018cb0ef882bb01c35ee18e4c6273780885839a179312004fa6e54f390ec59f
MD5 22ee22ebc0ac28fc494a0df33e6fc969
SHA1 1775d845dbd0cb0d9c295c08b4a3eb8e6a5f14b8
SHA512 e111b307b68dd749e4a8fef91b27926372b4ac45a9dff0748622be9cca7747deb6f32c27e24603ad8740fb9522bd26ab1aa3187b6115865d6997ec1e01b8e812
SSDEEP 12288:brEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:brERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 baab84151a4be90fe002f4653f301e6ded6151a02bf9718bc7e7fa5212281c1a
MD5 ce6ec1a96013341c626bb107692067c8
SHA1 77222868dd5395fc9a73b6f687ceb128bd80c205
SHA512 78333bc5a7ff2f7f71c83ed3f527fba5a241c25e6d9a69f42220dc6b298365c49b04ff7c3c48cb718fe3a85229cda5a2bdd1ca9c2a697d821b42215d277f77d1
SSDEEP 12288:DmEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:DmERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8b0eca314681abe6f4e58dba47c9227745ef1b0a5649fd3ea6e20cbabd38b2a5
MD5 a8d5a3e27d552c15edf3a9283016babc
SHA1 cc362b3937ce40fb1e6c375f7fef2f1a9ca59161
SHA512 57ca19c355d73702c41fddb9db00b037a9c2712e006725065e95a708e80b7cb66d219740fc81d4d1d3b639b7170708f8311a6aa0dbf21c324e790d541cf58fc9
SSDEEP 12288:HsEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:HsERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 5300c2ffbf85f338295b8e53c200c73f5d907de2fd2a08a6f04523a873f76736
MD5 9f2609acbe8d3b37625840bfe26bfb91
SHA1 0d8936a6de07df9b47a483f2136dafc2d2c736ac
SHA512 3c39877714a1c0c5e8c5ba18a35e3cccd5f5361d563ddbe812d4d022ba2fe74c7075a9c2e5c60a8255922b30ddcc5c04fde0ecc446a135f73ff3b26fd445efc6
SSDEEP 12288:vVZEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:jERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f143737a91ca3503eda31b9f8e1cf6c5857e32c11bdc929d16ef0c7a888fc983
MD5 adb8f26c54dfdd70bca822a4e7838778
SHA1 da31329aceb3904c55fdf702b13f6fef200b08e5
SHA512 299f2f2f923ad8e330402d14df057de8718ea2365ecc9ad0c63e47dbcf76f69c552921283a0e70f671ef9e153c6c9b1ec79742870cad68f754832a924f5ef527
SSDEEP 12288:OhEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:OhERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ebc2230e61aa003ee9b909bfee3a403bfae99a2cfdcaab9548e011b66b5d80ab
MD5 10647674b86d643bc9fafe5a8c5b3bcd
SHA1 7ccf8bff49b6d49f7e380fcc62ae1f1c2225b4cd
SHA512 1cb5fbd2c738a56dfc651455e578d8c24972130c22fa41e18072bff6f058243ff7ce49ecfd0b1ef5c5f3a89d772baf7ec173879e76ca32ec275c800ca7e5ae25
SSDEEP 12288:XiEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:XiERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a662f3a0119cd3684e254d56ca84892b52e1fc45848ab5402d9a311c55440b25
MD5 ddd844afde19d6f946701cc7893bfeaa
SHA1 e1f134ed91d71b59fee225652a469fd75f196c8b
SHA512 4675f4620f6442585ba37861fc9f954269f2bb153cc9b1c4c46ad42db73718b0d1d24796511f0303565a2924ad6bc52fe9cbedf2ca7537f2a9e59a6b83b1a26e
SSDEEP 12288:BOEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:BOERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a7590674cd6efc8bd1876f2014576eb733317d904bf54906c3c0678c0421417c
MD5 5c09cc23c0174a2996e9869d6ae6f0d3
SHA1 c5732507e49da370218cb1f101e08ae33b2e685d
SHA512 d533a96b75363abadab569c56477578255d3c7388f7da4c2c65a95a5186d288a0276600b769c96e0b943831902d12bcb557fc8773827b88c154052d293f528f2
SSDEEP 12288:hiZwbVzzFEoS2cPvyGEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLIg:kZMRzFVSOGERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 90e1f1b032118be76dcc50d62352794bbbe9e6e561cd14cb4b78b2acf8f0e6f6
MD5 d87c6549394b4c9386d9adddfc3881d2
SHA1 09e669579d0335e850be700e42d4c7105cec2cff
SHA512 56f3a1d7039ce2981dd2de596edb7e090616fd1d3f5e140980c725744df78cccfc82b4d07b2fd77e698ac55c1b8a21c6a1a1b827269fe0b086010410c1b4126b
SSDEEP 12288:MfEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:MfERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0cdde8f38dc1ffc2b935c11338cbfbca95866dca363c247673075390fd59de87
MD5 47e5cd82c8ed500a14908c280bcd0608
SHA1 2460dd4dfb9833f66f50069ab744fa295249110d
SHA512 4d1f872e4d34fdaef11ad3763ffb5a347b542e0040f3325218728fbd4c8558cc118111678da8e71f63da92f48fbff0c670a9120b61f9aed5da97d5ebb6b6f218
SSDEEP 12288:cjEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:cjERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f474cf3adf3bd0ec22785b52da53577b20723fe308ef888b41af3f72e45f9390
MD5 adee3bf6a376eaa3d5ad9ac791fe857b
SHA1 5b53135dd2f8945fa4c4e256f45f7ebbca93709b
SHA512 c55b95f48308b6db18ab2dc096872fa19bd3ee6b9c4f7400c032dc228239ab0471fbda90053af5f4494ed9b696353ad8c4b8f0f24e27aaa2cda47f90c8b5d7ba
SSDEEP 12288:UyPz5L8aEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:NzyaERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9ee4f66b76e56fb1914b8e5342239882258c16d99b076b9efc64e9aca0eb07b9
MD5 1268a893f21afe057aa3b2407912b195
SHA1 27f7bb6cea12503b28b5cd0ae40d9ced8650baa4
SHA512 fcfcad926b25be10d0eb2851adadf4c4a52dd3a00a68908a1de7e9b04f184dd0a1d13d3d1d19f4dda9e8a08f6f160a0a0b393d79459a9a079a67164c8dad9613
SSDEEP 12288:rfEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:rfERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 39ca2d98605cf4a83c15c13907e6c36aa64e6dd77fc7206917480f76e2ca4e94
MD5 5ebc85692186f2f8b59f90786c36bd8c
SHA1 ad2ff44f1bbdc423f1a6faa827b183067f45e275
SHA512 76fd93dcfc66629e783ece1f7ca28c713db5f19a6a35cc3182119331a56e01ec80bc900938c3b8658f086f20fcd75a85c608d307ca60aacd90f53c7fb03131f4
SSDEEP 12288:HfEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:HfERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c142f3955251b77ebae97259400e2affba059a72f5baaea81e02fa5cf8be2f43
MD5 fc889017b92123ced459f84b4555459f
SHA1 9bbd5649949d0121051ef3cf58982ba42c6d23b2
SHA512 7cd642802ba231599213932eb985b6879d0f4f0a730248b667cd8b39e7d7cfad80e619602a336c739354578216c096fe04d36b1862a7a533c19b3c8b6b33c32d
SSDEEP 12288:JyPz5L8aEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:ozyaERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 e120ab725f9c6964df7ef047507bec93dba549a66f2487da90545a4119a8c8c1
MD5 34fb1e073f4c16c570f63758447457ba
SHA1 e579b9800f9104a131bbe6cbd2512e0b89335385
SHA512 197b5ca202b2e5a25afc8d08c626e6d019d19836bab7ba39376c6349b1f1ad518e530c59f10244894c8a52c3d7d9dcc690015618a053b539a88fe172fdd3c3d8
SSDEEP 12288:SCd9CWYoaLHF3z0z04PDvh8EdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1E:zTDaLl3z0zD8ERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 96fe6bbbd7a36941bc63397f882e20ba484cfad9d37c21b0c2c972b1ae63fd25
MD5 0b6a099668628a657a5c2f45091a30db
SHA1 442e344eb62af62bd1c5220f7648eb2304d8a2ed
SHA512 bb7f378f881c12c1a306f3261ef0fc96f9d08ce48f0c794fd511d8488cab35bc3c5c9355a9912f192268fda9faeadac69f0463dfccc89bb7eff1cba7223b808a
SSDEEP 12288:oi4e7KRdTfgwCHKy7GLbbdIv9EdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jG:o3vd9CHKy7GZ4ERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 09e6392caabb4efd3ae1ab27b5d0a699641329bd08dac3ddf084a2a00a393478
MD5 7199078b01f2dbdba9d5af25750ffdc4
SHA1 ea21c7e620ddbd0ceaf9a2ce9de394efacd7d83e
SHA512 cedc39ba086affce814a616508046feab17c8bfa5dbe3bc73189e765493a3b00b2295f511789ccd2b4bb9b9d8c37bd61caa8149ca04504b3017064f3e4d661d0
SSDEEP 12288:TMEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:TMERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 48d18328ee31f3cfa8085dd33101a0ea6aa477a6f754abb2df594d0fb5f58134
MD5 91bc8dee62365fa7c5c4de1724026fe3
SHA1 47c74d67e32a36662c09880ba1d03eab0c18b1cc
SHA512 15cf73c2d9a6f64fd0c8ae6d3240d2c60afdcb0944c742f2b9ccff3b033130ece1b112c110b269a0e6a97ca6fb2904dc1fde23d80684e7c67d6ac605b39e539a
SSDEEP 24576:3cP4mcvIjkGOxhKP2l71nNKbrh/8KBnERIk1k7c+vDqGJAAg:MP4m4IpOO67W8K2Ik8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0ef05bec309a63fd89f98c883465c57b995467e4e0c391d5d8eb8b28f1a53e13
MD5 2aae817cf1f5500397dbc69d7058abc3
SHA1 44c62cf5931a7017d9cdda2084695b4d976b8cfb
SHA512 4549a27a062772722216879eedbdfd56face92f4af382036d824f2379792b285a72154db44419dba0336e6a331bc146941e4af1bca5254755c1b1438db19d9fd
SSDEEP 12288:wUFmDDLIEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:KIERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cfde5716f688332ba1ce6e05ec8de144d83ce59d1a19f3d954a3d11264ed211b
MD5 c31a08d0dd89ae91f517064d362af0cc
SHA1 4e95b58b565311af7a4b2fd72574bc8d7db755b5
SHA512 d811bcc073b5899be8a9ea805e19f1f2b6273c0f2efb29021aea45ded389dd02abc72d948699f67860a04a3e5d577db6bda25998bc9db327023f6a5c78cfc575
SSDEEP 12288:ZPEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:ZPERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d353fd2aa48d14c9e1b84c6bfd9b6230fe5db2fde7d066f98876dbed9a03e583
MD5 e83278f379b745335e487d392ab0b462
SHA1 85f274b665d48483c9736833dc3f03dbdcb87d76
SHA512 22d3ff4aaad3160491c7311657ee185ea85290ff5069dfe81f40b38330d70022f461af45fc299f882bd7a53e643c8bdb8ea200c6095be0609ea3d00442b13a49
SSDEEP 49152:+a0h2GEkuAe73q3pp46zwwQ6Ik8x77AA:+a0hNYG4Jw4kk
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 550f0c620d13eb04b3cae95ec2da3f46aa686c258accc71b337e51e36cad66e1
MD5 c2a35d6d9822bbf2fdd5f399bc42f58a
SHA1 a62612f19a29980e95cc2e9e32977a61d012d555
SHA512 c8c0f7916ecf8b47cbf614ccf1854a4996032927e3316f26cf1c3e0475d2d27382ff75c8da993abd9c4f58050486e992070f22a3c67a49b8e25882ed441586f6
SSDEEP 12288:BhbHjfX2EdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:BhbHjP2ERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 98cdf061df586acb85264f71f85c4cd88369d38d23bc44820fab81f161f10971
MD5 39b9020d29a70c7e287fbee9785d8fb8
SHA1 7c91bfa509bf207f6982e39e2d8c9a872c2d7dcd
SHA512 d84aa8a9c3c16bc846ec4822de52154f0dd97eb51ce7644c44ebd6fbc10f8da8645eaf33b49a15144386e5a057c41829a1dddf4ed239337a38ee592d9e5ac300
SSDEEP 24576:C3YgnJcRTk4yti+R5dBR/+ERIk1k7c+vDqGJAAg:CIgnaTk46pBR/rIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 55f26bd307aa404b497a36c743166e9945b9e3269845dab3b490c98512baf213
MD5 a77b957e35faa6ba42970a02ae0047f9
SHA1 db42bde198f054caf553d7128aaa07f32d464107
SHA512 494f4c32bec137ffd78f893d17ed6deaf3b5e63232d2444ae54e52f03df10d55b7d6be47686b721f116a5a000771e164fb12311f5abe2fde44bfb83bf1dbeb7b
SSDEEP 12288:LTEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:LTERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 83c81b582b96cf16dec5f47eb73bb13ac0d42ff8b91986acfef8d218c8795ec8
MD5 becb15305d979882e99b37931e9fd23f
SHA1 3c9888641acaf4af7ffe9cd6723db8776ecb44fd
SHA512 70873323584d7707fe729c8f8a1741af7edb49b84ba283f9aab06cef70cede6c986ce247f988eefaa609edbedaa1e4bfa64c16a90426d590f28bd047e3ccbde2
SSDEEP 12288:8ObfA4LWOsvAYFTAEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RC:hbL3UTAERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 04474400a89cfc079c3881311edb2d0dd1171561935c9a4a0e555a884b615fa5
MD5 5076ab286ea2b76537c809c986af13da
SHA1 d245a468b913727cc77532f55b5ce2d030918b18
SHA512 760f76c1792f47f272fc2d1c19e735ad97824d9d64ff925466319adb1083fc22047d1e94b81e535dc8b1bef14e81ab4d41dc4439828312f14da1be1b45670abb
SSDEEP 12288:YpFtIOUEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:TOUERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3d666bde790a9a6065ea2a0f7501adb3a51c535846ed15f6a5fabd338b7d381c
MD5 e48e679e5eae293d35220b73977c64c1
SHA1 5502f3ed3a7b764e2de92efae60cde86c0bc6b56
SHA512 e5a1f53c47a4141d46a18e5de7ad5a9c9311ea80147abe3431340557fee4b0ebb6b6a50de2168944695158dbb8a2590f67a927ac5a2e5973012e1f02bdbda20e
SSDEEP 24576:87NM9YqZqmWMUkPjZM48Mv6bEhsfERIk1k7c+vDqGJAAg:87cBWMpPjN8DbEhTIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2ffdf9ae458c16193b034b1eddfcc8f58f17a7bc757a83ae343b1cea03ba3a78
MD5 4aff34fa89a7803f8daf5e3d7caca504
SHA1 df917626cf162ad0886102ea2e1b74121c158802
SHA512 73f34f404233449fdbdd30add1782c8d2c4b3c97303a0cd51d50bff5295dc22cb3a4f3a7b9821c2482414f5375b437e4f2cf4551d2195454b88ab2428d927b6d
SSDEEP 24576:FW6BApg2YuyuNDYTabvcdvNYf8km1dERIk1k7c+vDqGJAAg:FF2YuHNETovAvNYf8km8Ik8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0c46a4e1bad47a12d2eaa56cfc7a18fdd27c49862333a810efa033e191a1ee0a
MD5 87119b226adc4922f2b14f110de39c7e
SHA1 b07ffe35b5412e8ea78cfe4e0cc904f25cc0b760
SHA512 bc5aef648694b693746d2f24de7cfcb12f4568bd850842f9af7346b9371bd76f7bd0d23f970f6a01e7b9830f7d8aca5c0b44d33543ff0c08fd195d4520542560
SSDEEP 24576:aAFs06+OmlfkNXEbTo4ERIk1k7c+vDqGJAAg:jFs060lwXuaIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 3c9f2b37908862d6dd6333d3d7e9702dc4df18da6307ee9bd07b6552c3d66052
MD5 a65e13e8207d47bc4f85b92f2226ca09
SHA1 dc8b891ed12db1913bb54760af06a45117d71ec4
SHA512 0c32a157498894f58d2d93b954ca685ed870bc23681b406fe9356de6492681bbf51045af871ea0973c7a313f8e8c30b2b4981f9a664556e4d0d21f5854c39995
SSDEEP 12288:DCJnJ5D3VkrDzx/EdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3Rgz:eJnJ5D3WXBERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3ecb492fb73f4dd8062ebfb2d0875e5859d9d3873387732aadabcece419ed90c
MD5 04a9f7e16891106aa7372f6dfde3ea0a
SHA1 702c474f6b24f5496dac00325ef5e584731ce8f2
SHA512 9af9bf77fbd4bca81687e010dfdeea34b4d36b5ba1fa495495db96730709c08f25f1a0ccd378f3b32cdf40fb2d382c1af41c9a057d0aaf0bac0bb616dabd7645
SSDEEP 24576:KEPghm6/7IIXdwcXrif7qQncjlP65i3Vu+ERIk1k7c+vDqGJAAg:dg06DIKdwc+eQnSt65aVwIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 13bb9985db48b07523f7cee2daf3b0adfea52b1a9d52c8c3bc27ccdf8a0ad800
MD5 4a68dbcfa3bb02808e4bdbb7ba0fbce5
SHA1 b4d014717ba984020594d0b8be0008f0a07f73f8
SHA512 e854c6431781a670b508c9586dc713fc9d7ad0f274818615e0e06117e6bfdf66f6f616bb900f5d8b2c6d83a99310650bbd58ddf218c9b48afed35c73f26946ae
SSDEEP 12288:bEP3RnVEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:gnVERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 5336bc2d657ecaaee01536a40bd71cf2d6c972b48b26ea034a668a1dfcb93372
MD5 2a96afaa666bcda3291304de8c63cddd
SHA1 1b2e78845260aab4cbf4fcd65e9b73a6f1aa71a1
SHA512 934e5cc26bc84fded18cff766e78c21162d2f8651a9d32b11b51c199384d0a5e638aae34766b7fc3fbaa4a9c1887ac331deb9de9f3be170d644b9555e6f82494
SSDEEP 12288:ljkymEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:lIymERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 23ad5836de63131d104cda347726968967cfa71f73ff79b1915a959b900c1473
MD5 d94129003078ec1a837eb3b87969b235
SHA1 ac75bafc2ec24b470b1c3856873f74fba307cbff
SHA512 79f22ed3812ba3a05c430f5bd24d4d62a861f4ee79d7e51f03da2851619cb0731c6862cd52f41923f76d580cea725417514870755a861ad277035e32f06f0877
SSDEEP 12288:SyEEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:bEERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e6b386e33e4b4d69cb08682fa7916b6444e9098b5a77de2a65a4ce452044a706
MD5 a3c2e51aa8ab272716b9dbd723a6f4b0
SHA1 3576d93ef417b4d2f651e0130d045c2877151998
SHA512 18c996f1e1aa2192f17b5ca01ddf0234db66dae1d32806b33901cacc0a586a7446d62654c5baaede91ae04411491bac5f69152606f49a74c2c202ffbdf97b357
SSDEEP 24576:9Q9MxZKdcz9dw33ERIk1k7c+vDqGJAAg:9VKZkIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 069c389ba289a240f99e2a36d5a56fdd45a04139bba4eeb3d50338e9f674e867
MD5 3b1604b5cec60ebd30b36d9ee6345d7b
SHA1 3817eb82bb692566066b3589de018c739b58f135
SHA512 2b78dc6af7d59f6179b38f39c8e076a401a5f196d54ac219a276293a23fe0f268520ade351fc36cf9bfd775764dd5aec6d560c3a5d444fd104b3662770c99738
SSDEEP 12288:OyoKo2JRple9pqEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgC8:OyocDApqERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 145f032313a167550c52c54e3a8457f090b28baa6d900479eecdbb254a373341
MD5 2f52f12b5ac1fa16565b0b5d6465b382
SHA1 ff00e4e30cf697df2cecf9c53daac6723e2fa231
SHA512 c0618d0ff34a822a3e275f272c07d452ba19737f89eac42eb3f59d0f11990aba05177b3ef4eb87ae0952b290b3e1881e7444ad3bc8da0bfddc480be8d9b6a529
SSDEEP 49152:GWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKfIk8x77AA:Q0zuNI6kk
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 926e5a0a6a04c377b5dcd90ec9f4a86b5be683a37b2d904eb9bf07427a519913
MD5 973081903e41d78fa21bd23acdbddb45
SHA1 d1d4deedb4db645af396d3730b3819216300ff9f
SHA512 b59748fc219146b054eab48fb251bf1838b59ccb37c5da1d448373cba769bdd971fe9e09495adc4cc1bd75a81e8bb0996d0405de97e3f689644719219ef72d5b
SSDEEP 24576:L1QT7EcpfxR+N5AWAz3ooiYujMqbVERIk1k7c+vDqGJAAg:2TDxR+N5YzT4jMdIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 724afc9405b9aa7746ff08c22d8181b8bf75e6e1928e84bca12b24e6b6ca6b06
MD5 901e9ed4eca9cd6902f7d8c957b1f84f
SHA1 6eee9b8652a8cfa97126e7a49bf00aad1c27927d
SHA512 1fbb7ab0055bf24912f7906e29bda20c87e1a6ece1c460f5952ceb1153caac3d2b2a967259a2ae9f8b468c41abbf7945c259a23fa5623d5747fd9efab32d96f0
SSDEEP 24576:wTMdOz0FFS+bmSLZERIk1k7c+vDqGJAAg:40K+bmSLCIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 5306a60bdd661f2c51e03063ff54952785ed24da4c49c5187df3a195430383b0
MD5 34308d43bb4ba34674c0a51a7a0361ce
SHA1 bc6be7062b922ec36f214257e84d08f97e00ea09
SHA512 c9df4d9dc6c61c81bcc68107416e5f4937f9d83f4ca6f385b917a424735d54480229cb3b26d6a2f0808fba209d895db9f1f6c6d987b294fbf55fa300f7a45d56
SSDEEP 12288:J4KAEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:tAERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-203-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1012-144-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1056-403-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1056-142-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1656-145-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1668-70-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1668-503-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1672-509-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1672-199-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1724-165-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1924-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1924-138-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2016-508-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2016-88-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2016-94-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2016-96-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2960-146-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3400-507-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3400-74-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3400-82-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3400-80-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3764-201-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3764-510-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3780-141-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3856-364-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3856-6-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3856-362-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/3856-0-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3856-9-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/3940-24-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3940-22-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3940-23-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3940-139-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3940-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4336-198-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4444-41-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4444-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4508-32-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4508-501-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4508-38-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4508-39-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4692-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4692-52-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/4692-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4692-502-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/4856-511-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4856-202-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4888-200-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4920-99-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/4920-104-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/4920-140-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4928-68-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4928-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4928-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4928-63-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4928-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download