8ce4ad5db2531f929e77b9f045d8a16de1ab6c0feb28e3b308dc7c207db07af7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
Size 3.1MB
Sample240601-cgppnaeg76
SHA256 8ce4ad5db2531f929e77b9f045d8a16de1ab6c0feb28e3b308dc7c207db07af7
MD5 89405fa409c82eeab12f4157939ba740
SHA1 5cd836ca093c363cb0c2bf48fef601b7042bd9aa
SHA512 0ce1b960b4f565933eae6a71f244bf7767a0a795694778cb23887030b8bc1811e5db0e7b3478fb52472f6fc3ad2cf231f031874e7eb6cf53cde35645d58ea99b
SSDEEP 98304:nHgNDfXQ1veFPk5FaoCRrgGUDx4D527BWG:+DfgZeVmCJWl4VQBWG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 24 IoCs

pid	Process
996	alg.exe
1928	DiagnosticsHub.StandardCollector.Service.exe
4004	fxssvc.exe
4304	elevation_service.exe
4348	elevation_service.exe
1520	maintenanceservice.exe
2132	msdtc.exe
452	OSE.EXE
1084	PerceptionSimulationService.exe
3708	perfhost.exe
1040	locator.exe
4876	SensorDataService.exe
4564	snmptrap.exe
2252	spectrum.exe
4316	ssh-agent.exe
4620	TieringEngineService.exe
560	AgentService.exe
3036	vds.exe
2756	vssvc.exe
4984	wbengine.exe
4352	WmiApSrv.exe
896	SearchIndexer.exe
2892	VCREDI~1.EXE
2996	msiexec.exe

Loads dropped DLL 1 IoCs

pid	Process
5316	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	VCREDI~1.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a3a32a1f293b476c.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\msdtc.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\InstallTemp\20240601020336815.0\mfc80DEU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336815.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336955.0\vcomp.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336815.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336815.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020337049.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240601020337081.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA95F.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336674.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336815.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336815.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020337081.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240601020336815.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020337065.0\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240601020336565.0	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336955.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020337034.0\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240601020337018.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336674.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336674.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336565.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336815.0\mfc80KOR.dll	msiexec.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336502.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336955.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867.manifest	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240601020336955.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240601020337034.0	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336815.0\mfc80ENU.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240601020336674.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336815.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\Installer\e57a79e.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336565.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336674.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020337065.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\e57a79a.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336502.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336565.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336815.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.cat	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336502.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020337049.0\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336674.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336815.0\mfc80JPN.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020337034.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240601020337065.0	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336565.0\msvcm80.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE61.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020337018.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240601020337049.0	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
File created	C:\Windows\Installer\e57a79a.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020337018.0\8.0.50727.42.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020337081.0\8.0.50727.42.policy	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A49F249F-0C91-497F-86DF-B2585E8E76B7}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336565.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240601020336674.0\mfc80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240601020336502.0	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003f3ccc8c3b3921e10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003f3ccc8c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003f3ccc8c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3f3ccc8c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003f3ccc8c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000516e00efc7b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd929fedc7b3da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c4b9ceec7b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f741b0edc7b3da01	SearchProtocolHost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c11ff2eec7b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071eb5beec7b3da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F942F94A19C0F79468FD2B85E5E8677B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\PackageCode = "FA1F9ADB128EB664EAA9BA3CE244C0B1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\ProductName = "Microsoft Visual C++ 2005 Redistributable"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Version = "134268455"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F942F94A19C0F79468FD2B85E5E8677B\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F942F94A19C0F79468FD2B85E5E8677B\VC_Redist	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\F942F94A19C0F79468FD2B85E5E8677B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2996	msiexec.exe
2996	msiexec.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
1928	DiagnosticsHub.StandardCollector.Service.exe
1928	DiagnosticsHub.StandardCollector.Service.exe
1928	DiagnosticsHub.StandardCollector.Service.exe
1928	DiagnosticsHub.StandardCollector.Service.exe
1928	DiagnosticsHub.StandardCollector.Service.exe
1928	DiagnosticsHub.StandardCollector.Service.exe
1928	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
Token: SeAuditPrivilege	4004	fxssvc.exe
Token: SeRestorePrivilege	4620	TieringEngineService.exe
Token: SeManageVolumePrivilege	4620	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	560	AgentService.exe
Token: SeBackupPrivilege	2756	vssvc.exe
Token: SeRestorePrivilege	2756	vssvc.exe
Token: SeAuditPrivilege	2756	vssvc.exe
Token: SeBackupPrivilege	4984	wbengine.exe
Token: SeRestorePrivilege	4984	wbengine.exe
Token: SeSecurityPrivilege	4984	wbengine.exe
Token: 33	896	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	896	SearchIndexer.exe
Token: SeShutdownPrivilege	4252	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4252	msiexec.exe
Token: SeSecurityPrivilege	2996	msiexec.exe
Token: SeCreateTokenPrivilege	4252	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4252	msiexec.exe
Token: SeLockMemoryPrivilege	4252	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4252	msiexec.exe
Token: SeMachineAccountPrivilege	4252	msiexec.exe
Token: SeTcbPrivilege	4252	msiexec.exe
Token: SeSecurityPrivilege	4252	msiexec.exe
Token: SeTakeOwnershipPrivilege	4252	msiexec.exe
Token: SeLoadDriverPrivilege	4252	msiexec.exe
Token: SeSystemProfilePrivilege	4252	msiexec.exe
Token: SeSystemtimePrivilege	4252	msiexec.exe
Token: SeProfSingleProcessPrivilege	4252	msiexec.exe
Token: SeIncBasePriorityPrivilege	4252	msiexec.exe
Token: SeCreatePagefilePrivilege	4252	msiexec.exe
Token: SeCreatePermanentPrivilege	4252	msiexec.exe
Token: SeBackupPrivilege	4252	msiexec.exe
Token: SeRestorePrivilege	4252	msiexec.exe
Token: SeShutdownPrivilege	4252	msiexec.exe
Token: SeDebugPrivilege	4252	msiexec.exe
Token: SeAuditPrivilege	4252	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4252	msiexec.exe
Token: SeChangeNotifyPrivilege	4252	msiexec.exe
Token: SeRemoteShutdownPrivilege	4252	msiexec.exe
Token: SeUndockPrivilege	4252	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4252	msiexec.exe
4252	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 4068	896	SearchIndexer.exe	111
PID 896 wrote to memory of 4068	896	SearchIndexer.exe	111
PID 896 wrote to memory of 2468	896	SearchIndexer.exe	112
PID 896 wrote to memory of 2468	896	SearchIndexer.exe	112
PID 1656 wrote to memory of 2892	1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe	113
PID 1656 wrote to memory of 2892	1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe	113
PID 1656 wrote to memory of 2892	1656	89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe	113
PID 2892 wrote to memory of 4252	2892	VCREDI~1.EXE	114
PID 2892 wrote to memory of 4252	2892	VCREDI~1.EXE	114
PID 2892 wrote to memory of 4252	2892	VCREDI~1.EXE	114
PID 2996 wrote to memory of 6120	2996	msiexec.exe	126
PID 2996 wrote to memory of 6120	2996	msiexec.exe	126
PID 2996 wrote to memory of 5316	2996	msiexec.exe	128
PID 2996 wrote to memory of 5316	2996	msiexec.exe	128
PID 2996 wrote to memory of 5316	2996	msiexec.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\89405fa409c82eeab12f4157939ba740_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i vcredist.msi
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4252

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:996

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2180

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4348

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1520

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2132

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:452

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1084

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3708

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1040

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4876

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4564

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1880

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4068
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2468

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6120
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5318CA0C655A71BD78A1B4087615B43D
  2⤵
  - Loads dropped DLL
  PID:5316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57a79d.rbs

Path C:\Config.Msi\e57a79d.rbs
Size 27KB
SHA256 a31d9ab6c4366b08b4d1ffbeb9e7d5d6f701480967da65e9d351c756d517e648
MD5 ff337ba244f6f4e78e5ba83949aa6326
SHA1 e1824ca268765aee43f2e551e694a54c046510c6
SHA512 76f5c0d7fb7b0290112f0838525c6e6bbbaa37829969c32831792cc3d05fa8c624b074dbd3e2764b720206f16626bf2dffe2298ebf7f9a809a70038a8310577d
SSDEEP 768:XBIO6/n+wGphdh5WJX1i8ci1fdfkdnFIehDDhuYqtn/xOH6736mFeiqSmpfOSKpO:RIR/n+wGphdh5WJX1i8ci1fdfkdnFIeN
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 936d48ff9f448989b0650fefa7a491f333eaafff2dce46ab589f7f8b33f8fdf2
MD5 66993c191203dc15e186ffb25a837d69
SHA1 271fc3765cdd987b4fbcd7a0d4f7d197f625c432
SHA512 a082218446a35e5ed229e289b679c421ef320f66664ee9dc4650a9102f35e654a3954bb1351bf4fb952f60891eda78c8cf34c9637e4c0cdb0ecc73b001f097f4
SSDEEP 49152:ouYk3H5koUzfTqkkYLO/W2buywzMbOX+T7z57Dmg27RnWGj:o7fTqi90bnD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 34b19b3d77272f9fa99dab5b8f0808747cbfc27252b80ca6f9591e1e82472d39
MD5 cf38e87b04411e2a0a9137c307e7c761
SHA1 b57f2eb72d0fc5ba272dce02603e06a27be120d2
SHA512 710911964cb27ea9acbe525a93872bdcbfe9a2a79b70fc798735b48bb589de9499b5c72cc99859294b55e281fc4dfeac9e2fcc13fc2e30d7b8b743d634587c6f
SSDEEP 24576:4iPnBsuEMsqjnhMgeiCl7G0nehbGZpbD:RSupDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ba9d25e85efb548191be87f52c712fec5eb7bc679676596992124167a716b41c
MD5 de5134d9178424af52b49c47af949d57
SHA1 a3a1e00c68457d21eafd900de2bfa6a0972a11d3
SHA512 be09ee36a847ef0f7a2c3dd8c7508e9005faa683eab609114616d803298dcc5a6942007315ca3c860c330941d7c6e972647a8ff5141a944fb924531a6a46005f
SSDEEP 24576:z+gkEHfh4CoQsqjnhMgeiCl7G0nehbGZpbD:KgkE/SaDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 82162aff2f177082f09bbfb95d33550bfc4a21a27f68318904bcf5233b028e78
MD5 c6b1a8de23c1aaaa1593a2e01a9fd492
SHA1 4fd176f1130b9cc0e1c61dbb0a85985344cf5ec8
SHA512 44a430404e6f8c2a52a6d4080581c8f559e30a5fc374c78aa7d916cb21b98e9fe1f0d45eb74737738a47825c2d5391d69d2f204dc55105f062553fe5a6eb4c1b
SSDEEP 24576:7BpDRmi78gkPXlyo0GtjrrsqjnhMgeiCl7G0nehbGZpbD:NNRmi78gkPX4o0GtjbDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dfb5720aea039d6028a7878a6f1b2920cf8a98c783b2c034969c98cdf486645b
MD5 1d9ba6748dcbb8b1bc5ac79e6f9bb4ca
SHA1 d7d8b2df487f5dfa609b3f293747c85a0549a007
SHA512 9d1d87cc2e151780f89075816e6ae43de5a7e522afeff60d5b75214c3bb0bd3dff4f8dba6a91fbc5068f9924fa8afca037c87e1fc19b6859a53d3a8fa4307c86
SSDEEP 24576:1LOS2oTPIXVQsqjnhMgeiCl7G0nehbGZpbD:f/TDDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 24771f7803c146749556c97060bda512a7e2ee25c772cdd954d17af9eaf8a959
MD5 984888ec1fadbf0462e75acdfb3500ec
SHA1 1fdae554251fcc8c0dc9477a9fce75c828076b4e
SHA512 80c8d1899c3479e71443853a7844ae4ce9e1173cda62cd6fbc1e3692858d31c426c6ad278a9f1a423f9478a141d64c1b6b4e7115751c3431bdbce49d8bfd9ad1
SSDEEP 12288:It2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:It2sqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3f9597bc2ad1f47986a5638343bb588fa97d5b22479eea2e0f922dae1577792f
MD5 ee3aea9fb8cbd3d9b2493a03acf498e8
SHA1 7b615f872d1f13371f0c012bef81868700afc458
SHA512 43caca7140d3b1e250a5df18998cd7cc46138d3e937d0d0b8415c2d950d0afaab0ff6638df960322bc7d8c5e46f76285b1d4a3a1dae29894070b4318011782c0
SSDEEP 12288:deBNUbTVO86UxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:dJIUxsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3f6d08ce2bb66212dd0eae51acd9ce115b0ece149b88bb68565f22f71c56403d
MD5 1373751829e963daa669f05e56412649
SHA1 967ceb44eb6fee0cd31bccfc57da0622d02d9862
SHA512 8979c2a5b69d388f96efdbbc90a7fff0719fa2884824aaec41e116569e8bde7fef926a6648fb0668d1be00ca7e0a5493950566fe110d8cf469af2bdd45f5c673
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH:LQvGAdlCEL8c/DRNw5CgD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 aee441a1c13f7eb7d7f343aa12b8e2344ee4e551ed3d6eb715b7b8f86ad77b26
MD5 403d1f1e605a8b30e6373a5aba690bbb
SHA1 400f552142f0d907c758132af8eed170d1426e17
SHA512 21d9db6e75931395ca7d315cabd100ac1e17a344c254849cc0f3a66e5ed38d9715c9fa29823437481ef175109c4fd08ba55362e82b2818a389c41ffd1134a684
SSDEEP 12288:BAwSfxL/2Dc3RDLLmt0LDQewsAjjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:i0ewsAjjsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fbd37762c0585105ed5fd55a34aef4f26224303c93beda8640d6be1486108aef
MD5 d908691ecd90447a803617b58fd21b3d
SHA1 19c0e786c94d10df10b0cc622d09058717a05145
SHA512 408069354232be572263ae04f1a09b74f5a3c69d1c12f222b286df341eb65b13a5dfeee96416877b754606866630f5640f1637364a75cae22dd616a589506039
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHvVQBWG:yUEtQevvqc2W1cpV2tI32mB
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9548cec9dbd6832d8fdeb06e78bc23218b9f700b4b0ffb54c40e98bb38173213
MD5 8c7402a103a5e3654f446041238cb5e1
SHA1 974219761e513286551a88cf4a4633602cae92ce
SHA512 b2e3bcf87f9c0d033ba39e3236ae7e6be69269af94579e385c4c04ec3e8df19ff71b343f4f3f46ce822d8c8ca655558aca8c1ac0f56635e8a7e791d74cdaa147
SSDEEP 49152:jCbRquA/m2yL5zTfFiV+XenmE3/zHDmg27RnWGj:coquVjnm8D527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5ee6a9bc9c510a79e68f1d34ad708a63fe1cb3ca5d4ea2a15b9e62a37881cc3b
MD5 b9851b8df2f161a9000bb11e99c92ca0
SHA1 2646acc70a2b668f1f81aea104ada14c40ddad50
SHA512 e3cb0ae35b67b8d8a9076327c142c30a5b35ac774c05c758fe445011599aa80e021facc3cbeae10b380c110c171cfd633551bc8b057242f42a5700e7f3682879
SSDEEP 24576:HAhGL3IFoiwtA5l7S53gsqjnhMgeiCl7G0nehbGZpbD:HAMUFoiq5sDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 16e57993ab3e933581aac5347753d8687baaa7e17bff57a67f25291a3ebddc5f
MD5 14002e741fa0638db2f9d58e86faf894
SHA1 2ab6d20cda69aec2c0c08100af185d60e97107af
SHA512 9f6497f7fe07c173ca4c19e4ed02980daafe8ef71038020b03933bdea2d74be696a7c8d74890a9eaf3847123b026d5920509324b9a8c6ef2ed9bcd1bac692e48
SSDEEP 12288:3mw5HEjsChNVBFgl0WDm+C0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Wwu4OWfsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 14c996f870e0ccfb77617ae764c927d70a34736bb8207f3f8ed37b8575d059f8
MD5 79112d73c1692f417305223c1a558e08
SHA1 716249cfbc7b4a9207a8891dd2b371ae89bf8aee
SHA512 e8ca6a915d351c7ecd8527565d7fad9ac33ca1a531b639cf6b420852612cd7d2168a9de5e0cec8eb1f53b667f8d804fdaf91b283f44e262c77527e14694048fc
SSDEEP 12288:meZ1IyTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7ZuqsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 3a14059520815873323ad31a8b6f26692f8358bd4900e82d1d4b8e92e47dc8e9
MD5 769b7f04b7e89912401ca082043922b9
SHA1 9d7009c0f99208103df89fe015fc1d0e1dfeee53
SHA512 91603d9909bd6f18492dab1bea4763d74ff89a8ae8438f1dc44f36313fba0d7e27c3f207103e5054efdd2bf72aa3b9867d6455d9ebde50961d05e66a9bdd5fa4
SSDEEP 49152:W0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWLQ:AwfhY7g/rLO7yYA3awr341g0D527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 d9496b87466cf4f1a01aa248d6db5b2d622a252ea75c608a90610b63166b5f28
MD5 d058ff48291becf18ebc3f8dd9d60c1a
SHA1 79c1445e0cef7957736bb598f993a1fffd46639a
SHA512 1157699c7ab09f2e8703f56ed2499df94004f259d576c7ab88de516c7b8260549836b0c75133efb4ca161460be4b8de9de6f77eb41b613fdcee0a1b9b1c647f8
SSDEEP 49152:T0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWLQ:/wfhY7g/rLO7yYA3awr341g0D527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 7a29f20605653a64bdf29ce4ae18833b9a31a0c1768130f0ce2ed01c27899050
MD5 bbda11e04b2ea0feebdaa3a67d16bd69
SHA1 adc086b8d243557ed77a80a4e93fe5fcace57190
SHA512 9d58430b8da196f4e9011d54331465dc396734309ebacf885549ca2237747e0d26e1af6d72f0981def17f84ade97936ca95f45a35c3ced912c6bdd4edb25bf84
SSDEEP 24576:zcTyYv0FteQUd5I2kjgD6iQacAfsqjnhMgeiCl7G0nehbGZpbD:zuXv0FtpU5606zODDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 00570890b541a3cf6bb720201c00d7613cc93d47f80ad496d58c5b14406145ce
MD5 3cb0b0dbb1d323fd9009a7535373ed64
SHA1 8fb46f8e12cca8c25b7cd356d5ca92fc68a228a2
SHA512 f74e1fc6024f4751dab0fa0e20ef3854a7c467c494ccbff9d2b2d796a4e7ac7611b00cb37ea954ee482c49551da2ad2e79f1742ce6ff45a9c39fe51499a6601e
SSDEEP 49152:dy7mTd0GxN8jyyncHjXKUyn4GVcbDSKrNTxnDmg27RnWGj:ImYeycHjWjMTnD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 7afd1a29ee906eead4671ed6480282ffb1a9c651ee939e881246dcff655e8335
MD5 bd8ccb8e99cf73813a20c4205ce1ac99
SHA1 87362f829ab0f814506304cc9825222786171e04
SHA512 56d6c80344c7df4a8cdc14e17b7f219ee11a566c5ed6445c972c97bd749304f7f165e6e4c3ed9fd4b694840e058a4eeedc6fda5451839726e960980d3d10fafa
SSDEEP 24576:O6drZn1WEci182IEUZNbJeRgUebgW816isqjnhMgeiCl7G0nehbGZpbD:OWnDci18NNNUgbY7Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 7f3dd68f1187225121f69b7d4b42815cc07140f275754c12b82035992ca0e6d2
MD5 449b542fc17c7a3cc4b080000e23dd41
SHA1 8292ce9bc0ea07c3ce08e0eeee7c636bd70b09c9
SHA512 9bac6cd2bb8f0618763173fb75766a49f75308178f891e9d1aeeeb6d1da8c2f9673bb76c4c7fd4fb7db38c05fcafcf9b40a82d95449c5685ebb7875033b6a93f
SSDEEP 24576:dk5lHW5EzMZupOG0G2reD+melRgTTv/1ny1sqjnhMgeiCl7G0nehbGZpbD:JizMZw0GhamSo+Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b52fb57fd37f2beb8c0af7abe5ebf355e5a7f33e3550723565955c76afe42e6f
MD5 7218abf2bd1fc22a6f781e61422add5c
SHA1 2ee34439bfb538a80c511e37b910c5f12bdedee1
SHA512 615d9e5f32004f53ec58aa68b0e20690e6293bb7c6c04406b0e25f21c38839f2012c411805f168a99563dd0d5a95d59e1fa032a0a736e562ddbbd759ca23f1b7
SSDEEP 12288:ReXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ResqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 89b4d368bb2a307f3cd2a70620c820e21a9bfd07bfc86eb2b7aa7f44501ba209
MD5 231ff6c362390a9d29e0fdd21ad7564c
SHA1 6866efa051ca55ac7dd73073bfa37d8d0b584a67
SHA512 08578a7add692ed4bec99838cc273c2df9cd5019bd82c1783e518f3f482d6d9094351ace80f39742039ccfc6cd338e45e3e52a2047baed0dc76cfe2b244434f2
SSDEEP 12288:yXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yXsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4056176ecf10e76f4079cb26a2fc7bba10fbaf6f872176176c9d3fa9b10b99aa
MD5 f765b7b3b0159ef25c646a34f040085c
SHA1 6029cab566b57b6a500594e2b2555dc8869d26b6
SHA512 bebbfe10ff7aa650f6e16e8dcc4e48beb6f4d26f73c396db38969b2788544ed5c03fd3c78eec29ce18fd5885daf2047f64da5211a357dab8a117f5c312042157
SSDEEP 12288:p5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:p5sqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6d5f09f0b3e2a0be5b5653d78788194cdd25c776aad198210d87c7e5f6a73a9a
MD5 89e9f902d664a6bc0e6c05e6d1873b62
SHA1 4ced2502ced7d37eab448b4010533eb1ae6fa9a2
SHA512 2c3480cd44a2b161ad745de6dfd3e9f38f9c8cab9114a8de86dbde5a974f3ebf88075854348214956f6b913748bb550ff19e7406ea82935b31203dfb8cdc6c80
SSDEEP 12288:WVAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7sqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 45be46fdde3a62966f59597d100dcdc0b66ea78bf156786d717001c506669f93
MD5 6bc4800cad7f31fe488914bd30f5f6b5
SHA1 cfa26ccbc15ce778c3078a0006bcf627f77fd499
SHA512 31247dc32086f09baf8c71dac60102918825091ff0c2c4d9595eee041ca7b5ec9f1754123beab9303b11c0467f785d568bf81aa84cfcbd088d5394590a3cbb8e
SSDEEP 12288:OYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OYsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ac66e61ababbf9617bb9cb52558df4fea84e62956b4342e694d11158113d52b3
MD5 a9c7580d52fe4e4fd78c1e165056a440
SHA1 b50e4c127332a37004da5467a6538d478eb342ff
SHA512 f87ec46a744679975a8b4ecd281cfbe40b8d2bd8d8949f37808a4277f4fdf8535f75f9a4e7b2a502b9d480ff392ffa64b877cd17a9246bb0cde83263f717ceb5
SSDEEP 12288:9rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9rsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 38badafb251ac3aa667606c1125ee418900f4fdf218f6c987bc65f27059fdd26
MD5 833b96ec1f407f541df8c71533e15815
SHA1 5c49b9751010cac833834f7d24dae7c6ea71204a
SHA512 6f0d1013c5624ce945fe7332923c216bc8ffd187105fd290b4b3428356bc07d4eb444da8bfdbb05b2f3e704e3ad75ce1760394975ba013248cb990fbe03b6e14
SSDEEP 12288:PvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PvsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7b2db71ec4dff24d7dc423889d728af2151b39ee75d478bf1f4e7c0604f5a4b1
MD5 6e2e870b29d593ad5605e53c2185c60a
SHA1 b6eb6b87b004388bfdded74fd0665fdc856b943b
SHA512 e1a21ef904a4081e97b69c8a5b53b39f1b1c52af36ab1994b8839c066b67f273162a90f9300a68df84528e558034eafdbab07e4176b8b0127af5f1801fc2e425
SSDEEP 24576:pZMRzFVSO3sqjnhMgeiCl7G0nehbGZpbD:pZMRzfPDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0f1c535f4c3ae25694b120f6dcfadaac4d7746a83560a131dd3d1980da148afa
MD5 1cb44ef82fd3de66c8bd05a70a5cb4e3
SHA1 8bcd50947ec4d2486a393d7f63b498690bf9a59a
SHA512 2944d298c432fd7f7f182ab237b91898526ccc4eeebc421963228ebb48f11eeeb7a0a0a3f60968d081281043eda2c0180cdd146480fb25bd19ca57a2fd191fe8
SSDEEP 12288:BaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BasqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c7a45ac610f1cba0a7d3bdd300da589801b4bfe78de7392273a2b4669cbff89c
MD5 59ec291200a6c4f4aaeaa9894ab1dc8a
SHA1 60bc48e2f69225c02e4f2938201277ec74bf7838
SHA512 a767ec4346264ec696b92a1b2c1dc29bc581b208ff644f1537e29cb19a428a5f8e67391e7efa381219d1c12ad12c0bd95adad88a9fb26f2723ab8c82a94342ee
SSDEEP 24576:mcP4mcvIjkGOxhKP2l71SNKbrh/8KBysqjnhMgeiCl7G0nehbGZpbD:hP4m4IpOO67N8KgDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0a153d8213419eca53bbde9ff35b396688fc135499dcb87d0a86675146df0007
MD5 ec3fb3d105dfd0abad41425966b5604b
SHA1 bab5e51280143fdb4203ab4fa087fb7aefbcb4ad
SHA512 a4a7caec1e3c378b61f4d45557f171d2b47957836a141504fd78607a1c081442470bce990d60765525c01e6866119d2a26830ab939b1d1a5241704b0712576ed
SSDEEP 12288:1UFmDDLdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hdsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCREDI~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE
Size 2.5MB
SHA256 492826e1aacd984a00dd67a438386e4de883cc923cb1f25e265525a4cf70ed7b
MD5 f031c0d2b460209b47b91c46a3d202fe
SHA1 95040f80b0d203e1abaec4e06e0ec0e01c507d03
SHA512 18840649d19c5310d274bac69010514872a554bb5ecadb4af5fa3667ad1a6bf9d644b31393edbc1b60ace6eff907c79c078f8213948cf90fa4d1529c68ccc629
SSDEEP 49152:pXHAEyS9gETSIA/HY/6fYdXBeSBZl+2xxSq+oL3gMvnRF/lP9D:ZHANSgwfgHY/BdcYjzDlbgwRFPD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredis1.cab

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab
Size 245KB
SHA256 f2ce7873a39f7f8a2a2cd888a6b2f0a25f62bb3c475ee73cfe54988982ef65de
MD5 00d3bf1c1e82eee48fdf3361dd860e19
SHA1 b2f45cd2791ce178b45b06a95e7f58f298512d6d
SHA512 cf5c06c4052b103d0a339d5535db2d8a9f069e928ee8c985f03e321b7e1977ff2f2200ad15671d6e93b9c706bea7586cd3df11fdbaaaf8c63a0ea4291431bca5
SSDEEP 6144:Z7lescysaM4oMjmgIBfA5pe70Ghefoms8:FleMdM43jmlAQ/Coms8
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist.msi

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi
Size 2.4MB
SHA256 b5a652a1025f194f59e1349a1f26709d7ff7760067439b2d52d988a55d9340f0
MD5 b31b234cb0f534069ba32aaaeacd7b2d
SHA1 d6f90459f8bdbf7e75cc85affe9b137dc5e304e2
SHA512 138cb14f6018d3bddd78012c5b36a591fe70d1b2b7f9d3774230639302401be57e1a4d6098c66a83c47e67138ac6dbe79f64548e4c317bb804a4e9a3ffdf94ea
SSDEEP 49152:7ObGV9x199TOZ6ETXgA/7C06yYCsvVSkZI+zC8BQEuadg80H99VM:N9fDTW6wQg7C0KC+dK3wgh99W
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIA95F.tmp

Path C:\Windows\Installer\MSIA95F.tmp
Size 24KB
SHA256 6eeb255e1d5333a7b4f1b62e36afa1bea5cfd6c7e32058bb3a9efebc4d9f2ad6
MD5 7bfa56d222ecc4267e10c01462c6d0d9
SHA1 9b3236a45673ff3bb89df3e690784b673ae02038
SHA512 10cec6bfd08a8b7cac1acbc3627cb014554ba71f44eb4bfe5b1471b81d6d292fd83a352d553af0de75fc1668a1f13d7f6f6c7bf1c6524117f363a3a7fc9b09e9
SSDEEP 192:DcR/6GxkBy7Za+8Q267xMmJn5zqSHWAESMSMer77kOyIjB0Ek0gAVennL0NVF:Dq6Gx9Q/672mt2ApTjkOynnCen4N
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4c820ab260d1b83783e3a28d397e492d73b3a0ed91481ea5a10b866118251f03
MD5 58e5c4f57a9c00d3f17a8ed28796eb3d
SHA1 0f06f3ab0fbec4fa2c6047b8545ec6e3c381c660
SHA512 85f4214af9401be6458e45e98d515a87658158111c2b01ba1f77830326149b66776d84893463f73c37901bbc178d06cf0928f72f41ba54afafbe14f802c950c4
SSDEEP 12288:dKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dKsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 3ea1171999533b7a3cef6e5e03fad251d678c17c256ab1b392089aa9a005bf7e
MD5 2d2ee54ef8355cf7dcf071627b500698
SHA1 61fead914bd8135110fb77c732d885206730fcde
SHA512 19fdb06f923fcdf194e57429beb2a15a178286782c726576675fc154dc09f0ef72dec086fcd41b30ad52be29063a038a4c5db3d6fd827984538e49a675618029
SSDEEP 49152:Wa0h2GEkuAe73q3pp46zwwQEDmg27RnWGj:Wa0hNYG4JwvD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 13ece2227414be6ad767dfe44de59196d51fe116b8a02c4042393e4d2594affb
MD5 1a600d7fac50dfea2fde4820ba037a68
SHA1 045d7d27983296e945f42039ff64ff4938889a6d
SHA512 85e7eaac386d8f94072f00244edf9d051a21e82273eff39d8c6f45fa18a536ac1272b9eab80a071b593fd0b264f2523cdbfd71b47495280a432f38fb910c6009
SSDEEP 12288:jhbHjfXnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jhbHjPnsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 223350193b6e84cf90e17e8585787653f938bcf883b16cab8c721fd1acbf3aa7
MD5 7e7eaf75765977ccace12e69f02ff837
SHA1 3c2a2d3d97b345b501149f4e82d8cf3c9010e82a
SHA512 885d833349e238b7922eb9f2b55a98834ebcbff49294114da6c4a3bad5ba85fa671349c869f07cb1aea20a8942181eb03377a78da36a44373b83db4e1ad04ff8
SSDEEP 24576:v3YgnJcRTk4yti+R5dpR/fsqjnhMgeiCl7G0nehbGZpbD:vIgnaTk46ppR/DDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 5b1a05879c57bb83b085fe526b8deef716f77bf7ee656a3b17ec35b78301b46b
MD5 d90cd14928cad431ed28e0de6943aacc
SHA1 60390eae657712b63fb97b84deac34d934eb2955
SHA512 e76ec978913a6e4847c5846e40e503e42a3f45195cc6dbe1b476f0090cbec366cbaacf9890839d507b68ce42b9fba0aa6dfeee5fafef49221227275f8be09e7e
SSDEEP 12288:WWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WWsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 8860eae6c2cc0d73d139badd28981a616ebaf1ba2578e93b62ddc7f9a2d45d6d
MD5 10d654689251d720e122a1c0812e2466
SHA1 4d0d98f3e518a064ed71f1126588d1ad85284b68
SHA512 832fa264ef893f884963644554e77a579fdaef634b4a3d2a27fa52ce44543413656fde5ba17a89de6e63b5b1cc15293fbf11ade39b6ad046e90726ed9f65125e
SSDEEP 12288:fObfA4LWOsvAYFTlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:gbL3UTlsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 aa9ba783b6bebf2374b7c04992e134b5f47265988738c3d5cf10d42e0f5e99cc
MD5 209449f704eaaa8fd0e4feef1fced1a5
SHA1 e906d7e6970558dbe015fa3f9bd80c40c56712d8
SHA512 b9d6fcd5e4f88691fdcd15dcf7a8a228ce321c995f65afedacf313e4a81440d119533d473facc92b0e0ea0836b4b8bd8a1a0320167a7f3c36f0241557e78cde6
SSDEEP 12288:zpFtIORXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mORsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4108bc9282125b1b28a95de3a84be703991e436ee8418bafdfd38f777670570f
MD5 5914a47338b414a443cad8f3f731470c
SHA1 a86cad83ddfba04fbd8f60095e2931409fe4e07c
SHA512 1cc39a05946d490dd30c8df21b3f4fdc457c1f6168f2e80a50d0ef57dabf7722126fd270cd6fc58288edda66b5af313a181a3cd3924883e510c14531d626446f
SSDEEP 24576:p7NM9YmZqmWMUkPjZM48Mv6bEhsasqjnhMgeiCl7G0nehbGZpbD:p7cBWMpPjN8DbEhbDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ee5f17218797d5a9c1b742d014a49a05bae15e52538609f1afdcc6851425d7c3
MD5 259443c2e96dcf1108c3ef95c2eae34c
SHA1 d9ffd47a4fa4be2c02b78d66a2e7643ebf88459f
SHA512 90a6984fbe72cf089b2ba4856ff2fc0132f1e2c432ba01c4057ff8e8f93df910cc85211d93f04ad58ef4196c852ba6c91d3c44078bdc2b3ed9502d417230a1af
SSDEEP 24576:KW6BApg2YuyuNDYTabvcRvNYf8km1ssqjnhMgeiCl7G0nehbGZpbD:KF2YuHNETovcvNYf8kmODmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ee530a034823abe5dbbaf1d616e22196adf2178433b563b77e81454fd595b362
MD5 1f0ea1047f45b354cc345e78cbf405eb
SHA1 81edfb034544996b9244d2e8824269fd5e2dfe3c
SHA512 c2e407b379dc0738ab9cd99a1b68b2a11aa28336f18b8cbe9f9779398b35a60d8f808d383afa1a895dfa3fc678fa2ce22cf81b8bc78ee5eefd070d64ce68b779
SSDEEP 24576:vAFs06+OmlfkNXEbToNsqjnhMgeiCl7G0nehbGZpbD:4Fs060lwXukDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 eeaa246e5ba1b8319edfc1160edba493c8fbf65cd050b11a02037d98d3162812
MD5 0618b524e815f9c98cbca9d3ce1578f2
SHA1 e5ae5aeee4a00f52910dd31bbabc1ec3c9089a41
SHA512 c704c6480bff641b0c98ec40ac82f3ef78ce32da4f549d7b0e49898364b52978296cb5f781c665c2d6ea649ab93f00d698e96ae6ee18b888e488da844ce7507e
SSDEEP 24576:VJnJ5D3Wt4sqjnhMgeiCl7G0nehbGZpbD:VJnJ5DGtkDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8c056806d5ce03e2796d344e4d8ad0d37bc47cd740c857ed8f4a05400b2aff52
MD5 54ef9261273815fecc3bee382ece9171
SHA1 41dd5171781b4fcdbcc38b59e5ea0351350e6fbd
SHA512 ef2da71affb8a7f7aaef8bcec7295e4ec9bcfcffb2464721169397fd39d2e9d67cd3abfaf93712574071a4bdbf3ad430023af1c07c72df397fe0a37a3bb9581e
SSDEEP 24576:WEPohm6/7IIXdwcXrif7qQncjlP65i3VufsqjnhMgeiCl7G0nehbGZpbD:xo06DIKdwc+eQnSt65aVyDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 5c01ba038bef92b1dc4d589d3b49e0150f36aee354b7efbbb0786bd874c7cd71
MD5 d52e93ce6c864ee916abb14055fdbad1
SHA1 6f94a475cd17efd30f7cc5ac32afd54932d613d6
SHA512 348d575434698c2f5f70ac57056a226dfd4c2067508da6e5fe7de4684723e6c9ead9a03f606e2d03665a571eaa0386371eafb0c696d173e1e366011d89a67276
SSDEEP 12288:aEP3Rr0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5r0sqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 5ed17d3f8bee103d48fcd742070cb5e4ed97ead3594aeb15c63c4dd59cf40178
MD5 1c15d5a16e9e7c81ed8a5a6bfa8fe94b
SHA1 a4e89f1f806a92675840bead6ddbed760377cbf0
SHA512 dfdc0a4828173c31118c0362eba7555380c2c1fb7f674996dd4eab70b3844110e12dd3265ea1bcd5aa6dd45cc25071e1cd4c1579c7a639e4fe1ef84f422b5018
SSDEEP 12288:IjkyXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IIyXsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 d99ee0f2777f7f6fc3bdaf452b70df9c8448b150ce1253055679471466bf7c6f
MD5 b69204626cbe082a07dedc7ef43006e2
SHA1 1a53697fcff3bd2a4c6a18ded50273f309254dfd
SHA512 61a37a5752da3ee951574e83b0d7bbd485261f514e11c813a58192c09d50ba187e5bf1d0800a82fd7e790a9b96dc1036639dec3ca6fb759c24a176500ad2cb8e
SSDEEP 12288:VFBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LBsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 709f28a39054a06d593e4be2b307ce61164131cb1c6ef71ecd354b42db61a72a
MD5 ad4ea6c62ed79b52b6caaad9b3aaa539
SHA1 e92e0601b65dba1820d1f0c0e6efbcf46e9d2649
SHA512 db9fc22ddb1ee91ccb2a77afb4e515b0a0dd3274a8ae71712036803a966dd3f70db882dd8b69669b19af253cdd8ae2558b8dff561c0d3fb9cdc6546ccaa0e243
SSDEEP 24576:uQ9MxZKdcz97w3CsqjnhMgeiCl7G0nehbGZpbD:uVKXGDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 3029d29a9727784f4139b4fdf95007c20ade5b29a78c5f07b5803a33d3612231
MD5 59a772fc33f8c4a50c7fd3ac14cf1a8c
SHA1 325756f7677c033f6df5608d6d06097b5b447aa4
SHA512 9e5665b8c46ce18133da5894f1b8dc4cd018d306bdd5333e3f37552be17858d3923669d6afcbbfb0d4417695dd42545d0c7642875b9f0038f764635e5ba1f1e5
SSDEEP 12288:PyoKo2HRple9pjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:PyocxApjsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 529339a3a89d7b1b35f7a5b5ea4d627a1dcdc58a6fa53f5ef2a669bd8ebd2921
MD5 c39ca0cd8d34310b2dd6dd57806c5c46
SHA1 59e6a721dc79998972b1e70dbbf2a03f7beedab2
SHA512 f7085e39e5e8b0cebac698f21aba9f768b8dde9f9232db9f8fc776c4de1d9dbc82bd7088811e322bbafbcc16487aca646e82dabd7c7825bb020814086fe9ad22
SSDEEP 49152:6WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKnDmg27RnWGj:80zuNIzD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ee01a760d48c7ebd9bbc51134e796643a13ee262328334b5cf6cf8c4edc5aef2
MD5 6bd1ebb908179daf07515caaa1f5b10c
SHA1 d1f245e5cf819e9a2080fa824fd0af464183c1d8
SHA512 25520c8f83b623f7d97209e313c6e5025eb17eb922690648e926ea06eab201d5fc08f98b09c879a3c71256b737f31169ff2812a22abfdb7d1762983633b2c952
SSDEEP 24576:d1QT7EcpfxR+N5AWAz3ooiYujMqb0sqjnhMgeiCl7G0nehbGZpbD:oTDxR+N5YzT4jMFDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 77016ab4b75f4420225f7076b31ff1e94c8e4799cb5f25d1b37d4f38a43d0310
MD5 c3268b35d41bdccfe1caee6feac6a8d8
SHA1 82221254fd02123846b0a70958fafe66ae0d9e2b
SHA512 51104c291333d1c0a6b83980710625041c05c113c9593ba5df4720979737fdc1829d00b2a6ff8df551714bac90b80022a226171fd0ef450523a44c3d584e21d8
SSDEEP 24576:gTMdOz0FFS+bmSLAsqjnhMgeiCl7G0nehbGZpbD:I0K+bmSL8Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 f47449ce187268251796518f9479cf87b8efca43460c6ed68b86124ee44703fa
MD5 3c11fc00204cb1714266d735793232d9
SHA1 d2cfed1ace8e2b2070ed568508afb2695bb11158
SHA512 189cc206afec5f99b429af7a22bae3f81081c16e39399d10603b4c9f586de5aa20c8c4cbc75b284d9f71f1aa2b8754de58c011578d0e7329c5ccbc6a19e111cf
SSDEEP 12288:V47lXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wlsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-136-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/560-207-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/896-268-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/896-668-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/996-11-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/996-17-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/996-19-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/996-160-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/996-18-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1040-486-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1040-146-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1084-159-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1520-74-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1520-85-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1520-81-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1520-87-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1520-77-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1656-617-0x0000000001000000-0x0000000001320000-memory.dmp

Download

memory/1656-1-0x00000000005C0000-0x0000000000627000-memory.dmp

Download

memory/1656-6-0x00000000005C0000-0x0000000000627000-memory.dmp

Download

memory/1656-0-0x0000000001000000-0x0000000001320000-memory.dmp

Download

memory/1656-119-0x0000000001000000-0x0000000001320000-memory.dmp

Download

memory/1928-25-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1928-35-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1928-34-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2132-97-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2132-89-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2252-255-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2756-549-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2756-252-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2996-669-0x0000000140000000-0x00000001401E4000-memory.dmp

Download

memory/2996-380-0x0000000140000000-0x00000001401E4000-memory.dmp

Download

memory/3036-251-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3708-161-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4004-60-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4004-61-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/4004-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4004-37-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/4004-43-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/4304-56-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4304-54-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/4304-480-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4304-48-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/4316-249-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4348-69-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4348-71-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4348-63-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4348-485-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4352-254-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4352-550-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4564-163-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4620-250-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4876-162-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4876-477-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4984-253-0x0000000140000000-0x0000000140216000-memory.dmp

Download