434fd08e50ef914d58065d5c01ef211f9afbb7683f5dbb27d859ff943d023843

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
Size 1.3MB
Sample240603-1b8gkshf3w
SHA256 434fd08e50ef914d58065d5c01ef211f9afbb7683f5dbb27d859ff943d023843
MD5 04a1aff2a2d4d2b44119d2e48a0d9c70
SHA1 44dd9a71fe1c12aebe07713936dd22595ce964a7
SHA512 387ba0298371f2cf0c931e47cc6e30073852159f4c98a45db7adc32065477b22808a5a0b916604f75637191cef0a75b381c5acd9cd589684cb5380c58deabf7f
SSDEEP 12288:Lqz2DWUl83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNH:mz2DWvNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1628	alg.exe
688	DiagnosticsHub.StandardCollector.Service.exe
4508	fxssvc.exe
3720	elevation_service.exe
4564	elevation_service.exe
3132	maintenanceservice.exe
3784	msdtc.exe
2600	OSE.EXE
3932	PerceptionSimulationService.exe
2340	perfhost.exe
2680	locator.exe
1528	SensorDataService.exe
2904	snmptrap.exe
3992	spectrum.exe
2300	ssh-agent.exe
2772	TieringEngineService.exe
4792	AgentService.exe
2112	vds.exe
1440	vssvc.exe
2068	wbengine.exe
2524	WmiApSrv.exe
4956	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d901d95c8648821.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001661f42dfdb5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011c2f62dfdb5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f0b0830fdb5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f0b0830fdb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073d00c30fdb5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045359631fdb5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040a90530fdb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1e3c531fdb5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
688	DiagnosticsHub.StandardCollector.Service.exe
688	DiagnosticsHub.StandardCollector.Service.exe
688	DiagnosticsHub.StandardCollector.Service.exe
688	DiagnosticsHub.StandardCollector.Service.exe
688	DiagnosticsHub.StandardCollector.Service.exe
688	DiagnosticsHub.StandardCollector.Service.exe
688	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4532	04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
Token: SeAuditPrivilege	4508	fxssvc.exe
Token: SeRestorePrivilege	2772	TieringEngineService.exe
Token: SeManageVolumePrivilege	2772	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4792	AgentService.exe
Token: SeBackupPrivilege	1440	vssvc.exe
Token: SeRestorePrivilege	1440	vssvc.exe
Token: SeAuditPrivilege	1440	vssvc.exe
Token: SeBackupPrivilege	2068	wbengine.exe
Token: SeRestorePrivilege	2068	wbengine.exe
Token: SeSecurityPrivilege	2068	wbengine.exe
Token: 33	4956	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4956	SearchIndexer.exe
Token: SeDebugPrivilege	1628	alg.exe
Token: SeDebugPrivilege	1628	alg.exe
Token: SeDebugPrivilege	1628	alg.exe
Token: SeDebugPrivilege	688	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4756	4956	SearchIndexer.exe	107
PID 4956 wrote to memory of 4756	4956	SearchIndexer.exe	107
PID 4956 wrote to memory of 1592	4956	SearchIndexer.exe	108
PID 4956 wrote to memory of 1592	4956	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3732

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4564

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3132

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3784

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2600

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2680

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1528

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2904

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3992

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2300

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2696

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2524

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4756
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 94ca2afa3f8a6d25b395caefa507172446e055ce62377b7e5dc7f6ac35827848
MD5 82053b88596e1c6d6317844ff9e978b3
SHA1 7cf92f923be1b62ad7fab24f8c0f5e8d49a5a441
SHA512 b55af34da0b3e6985c15a2fc70946ff550ee494ead7ffe03a0e621a8132c028fc32924448ea0c6e385e0711534db3570702a3ce27acb7611c74bb9b0802abe15
SSDEEP 49152:quYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5B2/Q9boLy:qPfTqi90bkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9b6d3f6cc2156077cb22519bcf022db02ac6408837a990f180ba61fde15f4553
MD5 9977af535d9eefdeb3fc6513817e1d16
SHA1 a3af583a302dd0063a0e9e57441f70622e7d3c39
SHA512 fceb3e2612e39e2d77ff4f47ce13d831c640165cf59119f0434244968a641934bca98d0935063c5ef0198810f33099ef95345ca1b65ae9c794842d0bf7c4c4dd
SSDEEP 24576:JidnBsuEiNxPq4yqF9p9OTG6WiqUtcQX:4SuP2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 53063e6a32c11c49161ceaca9d581700a483b22a34615a518ea558585cbbe0eb
MD5 e4660ca3ab608beb834d0e391fe58556
SHA1 84197f71948111cb93c1bf9a5efc92e9287b2dd1
SHA512 d165b9a20dcf5996a372af637f0c1d44210793d00e6367e389935beb2ec6917641e7712aad7aac36f27fe213ff482b18a355809b79cc45a8aa8460a66b18d5c3
SSDEEP 24576:h+gkEVfh4ComNxPq4yqF9p9OTG6WiqUtcQX:ogkExSc2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 95a7faef5e8aac93bc7eff5b948c5a41c7cd0859ac9267f4d25c81f8d668a58b
MD5 8a52820c8aa35971fc8251fd31d0ed59
SHA1 6dc8d16f774c51601e05446b05539b829782acf8
SHA512 f7fe4994522723e26ed5dd9aa3e956a40bf5ace81c1e906fbb6db9b6457da1f2766fe321b01a37e698ea2a588dc240b111845ceaaab9a3d1d54661fab99825ab
SSDEEP 24576:2BpDRmi78gkPXlyo0GxjrVNxPq4yqF9p9OTG6WiqUtcQX:yNRmi78gkPX4o0Gxjh2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9dccc3eca9ce84ff5145ffd38fac0cdc8616e71e8b1ba622aaa4d62fbcc96a9d
MD5 780bce97bf36dfec6bf623eea31f8b1e
SHA1 b90c1a7d1d19b711bc21052734401de82abd43ba
SHA512 e556e12686208c54d56bc0111bd853cebf92401ab3fcee38463e8c94f1cd57c06f5d6bb1056ebcb31047ac20cbd6b2bdb9e19d880a5afd6bd7b8e1ec3d5f00f0
SSDEEP 24576:uLOS2oyPIXVmNxPq4yqF9p9OTG6WiqUtcQX:O/yp2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6b51e4fc0ff5c1df4733c2c7ffbb5c4bdefc2e95bbc5e39a646f5f4922ad4f0f
MD5 d6974ae098738282707f5cecabee0d93
SHA1 68ef4d6b75027efc2ea42a6f39d0e00219ce9ebf
SHA512 8f3f1c661f2815dc09bbe109f772404ae6b8492e7190fc363c7bfcb2b51f66846a6112769305025c7feed1acd2b97d47d2abebe92753b60face2f29b0b8517b4
SSDEEP 12288:Efn83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNX:Ef8NxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 625cd30ee9acc26f973e7d2924d575488c89711e1e5edd3329dec45140f7b886
MD5 94c304f479f8642fca3758b4b5266e30
SHA1 f8536dfb616d8c9a883983322bdef4eec2d5c5b7
SHA512 60b67318fb9d210a703a409976be9d3509cd14c995edb0bb9b08338235c6e4ebea393a5170282c8bba6b62f4d71bc36df6ae8e610a815989475045ff3e0f3e93
SSDEEP 12288:ReBNUbTVO86Uc83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNn:RJIUrNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bd3995fcfaac9c213b20297f1ab3d68a90c2d59d6cce8206576c81fbf4c8dc44
MD5 5548f9fc1742c77a50580843df5717c8
SHA1 22f082f9d06cd86020bc7af047d6f108cce9220a
SHA512 8182b7d3825e780cffa9d9266e2d3fe7f864353421c27eb06824aeb2ff0782003660384b57157b70ef3ebeb9dd15006da2b67b6e4aa4a0977612d246efaf35d7
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:pQvGAdlCEL8c/yRNw5CNN
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 eaf9fde25341d1df6a59f59c326b2c037b491197672920a0aed97258ebf0ec79
MD5 db2cec3b9b3b8f5427c4686f1dc761c0
SHA1 14a744aa15ae073a1a057580f94ab64713994129
SHA512 0859681cebd60ad7efbcb11d714e8c89b66d4a909af268f5cc603b1198e5d9b6fd35daee8acc85cca64f915601543104a6bf265aea849ad64cb4fff3886b0c22
SSDEEP 12288:xAwSfxL/2Dc34DLLmt0LDQewsAj+83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAm:SdewsAjdNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e57295b9ebfc45c33be365f41c8c6013aab9bd9137b9e0e2ead01f52a526b70a
MD5 0e4c5abbb748fa1a41c7c480a17b3b91
SHA1 ab229730aafbf9dbbad314e714700441aae1464d
SHA512 78079afd3d2a3eec1dc53bedf97aa6f9938c46afe708878658895ae3a2abc333139015e84d6315e6be3aa29789bf79c0f400bccd000b474e529a1df69981226a
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHK:tUEtQevvqc2W1cpV2EI32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 552d4dd422084fd2db5c3a015b6b20855ed1522ecd43a4f6737a731cdd622853
MD5 1298938ac5c561db01b7b66effb28686
SHA1 9b0af22373e9bffb12fa758d882469bffac7b512
SHA512 1ee74d68a67fa3d02b2b61d4177ac11692d02860477a8a08d838a9a182f9c363a4f8ce69fa9df6e7120b938584c05e5f96cc664ca366d055968c38b563e5fd0c
SSDEEP 49152:SCbRquA/m2yL5zTfFiV+XenmE3/z92/Q9boLy:3oquVjnmBN
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2b6ae30fd39d79c03e9b02523d9d832043ad26619f6beafaf4b0fc47e65105a9
MD5 d2b86941ab3821ad6e22569dad60a21a
SHA1 ce7952040598c7554e872e24eeeb306fb6a8361f
SHA512 38fb9457197b08fe479447b507a6b04b2b98c8010fffef6b87fc8cbbdd61f17e09ab842c7877904b5d5408ad8bb22373c4b027fafcb2c5eac37b2c1a156ce99b
SSDEEP 24576:aAhGLJIFoiwtA5l7S532NxPq4yqF9p9OTG6WiqUtcQX:aAMyFoiq5G2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1b4648e418331eb66b6ac1306af37be081ae18250af4e5e95ece35272757b439
MD5 3b25341f81f6c59da7a819402ac9f066
SHA1 9420a977cca1894cf12fc5d77f8b7fc4d8ac29d7
SHA512 715b02bdda21dabe549001da1c514dc80b602caf7c537e5ce57849eb2ce9d5ad81183edbfca59d8be61a2d2395f03a0be26dc9e4d1f3da1634886481648add64
SSDEEP 12288:smw5HEjsChNVBFgl0WDm+CV83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6sY:JwuoOWpNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ca8bdc6ec089013cabd87b9913fb50450723e734aceb2c2027d2a60139cb6e5d
MD5 8827a1b8093808e1b96c86bb48d662f5
SHA1 cecc6485119fc4528447d2f2f70158599b2eadf1
SHA512 37865f342e51b3a27993d17788ae0425cee9a7fedcff6417a1517de269c1a3ed5885be7da8e503a0791aafacf2aa02b9fba27590d28bec17bb133f306e44c16f
SSDEEP 12288:tBZ1IyO83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNM2:LZuANxPq4yqF9p9OTG6WiqUtcQXK
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 e81137d37ed1acd96d79f037c79cb2baa038c609a382f702c7d15ae9515d1e99
MD5 147ff536ed4818aa481b6774fe53f656
SHA1 7efdab3ee08ed8ca8bdcec2e57b8afb1f15e3cd3
SHA512 8c28906549298af1e5c5905938ad716d2a6bc682c10dd416d17019a047808594929ebf8c379a0ca63860ede9cf939b560c03105fd27237eb2ece70b92d116df4
SSDEEP 49152:/0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLN:jwfhY7g/rLd7yYA3awr341gJN
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 d7e59aa6dce371c8b107d48844ef4408891447d66480182e9fd4a1f400e8085a
MD5 12f9d7f32e3d6843e948069fab62ce91
SHA1 260662e8053a769ac2a1f9e2ee372d3a72fd60e4
SHA512 7d08a15d232090a9aff9175fef802486cb625b47f3c8f0bedf6f3913cd29e3a1efb2779f41838e2bb9238287f2f572a25155e6343769f5487d1c8b0ad2d87e3c
SSDEEP 49152:G0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLN:QwfhY7g/rLd7yYA3awr341gJN
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 e45f65f0601f3d5be9f98bb0bb9cc82c5b9a0a348ef7da87bc6aa0d0190253c4
MD5 e652cf22875dcb3acf8b3170c0aad3a2
SHA1 a05bde4037114afef82cf87302e585ab762307d2
SHA512 eeaf53cedda08a5955dd501c6aa71e1a433bc14e4fe70b29af739a1fdf6de3aeb05014b7a28101f19edb60663c4ca2daca5320e3f48b020df5b8975ff9325c6f
SSDEEP 24576:bcTyYv0FteQU+5I2kjgD6iQacApNxPq4yqF9p9OTG6WiqUtcQX:buXv0Ftpn5606zOp2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 f7c446385c8f54f0cec9c4e6b6951dc8206c987bfd0235eb099ce223c61ba655
MD5 9e364192cf8fd73942dd2bc021da3a73
SHA1 97766e2c1422034d3d63d002b506423fe4e2a2b8
SHA512 afc94fc78cbf4f26ee0d292021709cf42abddd7b7a97f19927511df6558aa42e59c9285af9bc330bdaae36b0c203c9acd518f66169a9c055aa019809c63c0ae0
SSDEEP 49152:xy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxd2/Q9boLy:MmYeyxHjWjMTkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 591de4c71f532483f1cd8b2804177955275868164d1e32ab489250673e4af3fb
MD5 ba29e5ef4ef88e5071ac944d6df43c9e
SHA1 5acb1f79631e96ece6884e61602c2fd16aa51b29
SHA512 fdfefc4b98be70a6c75634f9196aced80cecf63dd1c9ddf1c63849da5eede9721e585fae512321c386f8dbeeb07da627138178d1f8b30baa20d98b788fec6d6b
SSDEEP 24576:B6drZn1WEci182IEUeNbJeRgUebgW816oNxPq4yqF9p9OTG6WiqUtcQX:BWnDci18yNNUgbYB2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 551f377406f26691841a115b288ddff888520486744a2bc55bd775629fdeb86c
MD5 4c33c4c9a7ad5e3cad123e971ba2538c
SHA1 6743148dcea659b8112680bdef1ac680d732e9f9
SHA512 7ed0caa838f6493d3f7244f0d8a16c67f76e3b9f6ca842b86089f5d4ceb0a7a9915f467a4aa0f01d35bd9822fe8a30c185d8f691257d4afc17863d7690b910db
SSDEEP 24576:0k5lHW5EzMZupO80G2reD+melRgTTv/1nyPNxPq4yqF9p9OTG6WiqUtcQX:qizMZm0GhamSoA2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ca5842529b79e4e92a8fa8a06294e399b27bb7e6b7c22e24a8eadbbde4316558
MD5 7a96e23135f9043c33e64ed38b0b20a7
SHA1 07de4af70548b992871226cf85903a116fabacbd
SHA512 e6b730053e99100b93454afa2ca3f56b443875cfd98d8b6125fa315d7112f05d7b39141bcbba09ffa18eac855b8dd21e8750bf7d01674acb1069ddd84f19a365
SSDEEP 12288:nP83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNs:n0NxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8343d181db1e7c06258b1dbaacdfacb8ae252aa234b833689f9f5c642d6fbaee
MD5 f3e395c36454dc4f70124cd75e0cf74e
SHA1 0687ba59ba1ffac8a41e44b800a306b1cf8bf93d
SHA512 bb228ec14ef3ac72123fccd0087b2a1a587fe02cd1a1998de443b1f438947449da050be120975ee66c39fd3c5a35b590fedbd069c7be429facad7ae3930a1a6d
SSDEEP 12288:pK83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNs:pxNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c7f240d76efa91de1d5e3b06cbeb449e126c12f2a07d7af71920f7ba8495f815
MD5 e62d1d6be7acadfc0e7ed6b5e6297ee3
SHA1 0206c9e86a67c5eb20e50c2ca7905791039152f0
SHA512 48d55421f2fc7571e375a80d869b63219d9e2a3b2b9221c37a695aa9e5ef0370a187804478b430110bde868b8f313b186ee3fc9f0e347c19760caee5d5fc2808
SSDEEP 12288:Ck83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNs:CDNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 fb3c0dfc41d7d90e557f3ef993ff8714995c3878b0b54aa0e6b24a6ec8455e56
MD5 62ec49ec63f3870d5b82e72ee18db59e
SHA1 15fd76ae68ffb9581b87f8a569fed4e87f4d8fe3
SHA512 aff7d1932c1e5d9614dc643ae68d49f52cbca726df778802e09a629fd98f444950049f3cc20b3aaf0435e9a6dde4d9fb6ef55e7ebf4ba0d57d4af2a060eb3149
SSDEEP 12288:mVp83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVN6:VNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0108a1a7b7cee4144e6553ffcc631d100410c78d23f356121ac47e00eb1c3b09
MD5 8b43b6bf38ce0535b5f8066fee78a029
SHA1 32db37eaf4cfe1dea0a8d8a11eef11dd9d6b1b3f
SHA512 a35d4a06f1eac6e7ecf310472a574722d4fd055ab629d34ec4440e80787a479cfae77a59743b0e808b1f6843081df0f135cd5112d28c04d798e6419691a07b4f
SSDEEP 12288:7B83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNl:7+NxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2ec5145328d41be51fd54c43e2730030f2107ac07485617f415c35e7851b7fdc
MD5 a3f587dfbbc560de1c603dbe07818052
SHA1 25d60606b5000bd3b090b95ba79a94dbc519b6b1
SHA512 993dcf733eff87d0f5bd72ee4e9c20ccb367a4acdb61f181eaa1d4250438aad1b0fff053495be79d59ee2d8d6c6968920dbeca493bb6ed3748efaf8ee6e87ca9
SSDEEP 12288:YG83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNV:YVNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c669e7d0ddba3ff43d6096d7a30cb659a8551e9ec3a8ef9e8cfb742f534799a2
MD5 dea375d78d60c3b01e2c1660e8e20b27
SHA1 08a11487fd3eea32727ebaf37862dd4d942469e8
SHA512 c6524e598428490fefd5939e41873e03fb828a4c91e107f04471dd5155dec58dbeed5928424b952f571d9eb08866716cb6e6b193f557f3bc1f1cb72515a7e148
SSDEEP 12288:3i83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNT:35NxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 591144da684cf9c15e89239bba424ddf4b076554a0c0f43ba166aacb3c322125
MD5 2d6b7e3f29c1b510cad26687f90e9421
SHA1 afb99e73838dea5ea54e27cfd00d9ed3391e4c85
SHA512 263c35dca09388c7cbe6767ed4eea9cfbcda7ea31d9114f31b2b0a7ea2974b1c29471663873118ec6347604922b770d69070b00973b83b9ff974bc0cfbdd4be5
SSDEEP 24576:AZMSzFVSORNxPq4yqF9p9OTG6WiqUtcQX:AZMSzfF2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 08a970ccd5cd4815de353f4a1168b93de3d03129eb7f32dfd4f8c663438b74cc
MD5 ab016aafaf9d37f74cc989c49db54e39
SHA1 35f395e65ab4f8e6fc11e86202f183913a45806c
SHA512 8e1f7ca309d5d85ee12147c62726b8e09ddb9fc83932c2d60813a2e5047bf216411cd6a2835ea65cf323fa0824dc4d77119890796991bdf910ec85eb39cf5ff9
SSDEEP 12288:Lj83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVN7:LwNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e2d2f3757ff705885bac160d8818c712972a0889258089a8a3f2e94980de0ddd
MD5 7b59857e2c7e6e0efd7003cda92aa995
SHA1 47eebba1303e28cfaa27e55d5075a906aee682b4
SHA512 430aa902e40d57840c3e623a5329493c60748a259bb2b131bec4ea3a0cc5e4a9088a1e77ffaf82b00dbb9a47057624ced2e3cdf686f48e578190de36ef0d6eb8
SSDEEP 12288:v383AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNC:vsNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2efd3b152794da5030b2e8db61055844eaf5df5617868eb7d34c9376a467bad1
MD5 fb3e68ebabbde41060add06012e15247
SHA1 bb091504a25c8b1f2d18a8d590dc018e590c15ec
SHA512 61f7c561b2dea6725cfdbc5259e086082d3e53450dcfd058a62f3b1b496360460682c997ad59c59ec837b57d662d1c247ce8ccac55bde6f62fd7cfb11f606e88
SSDEEP 12288:myPz5L8O83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNH:bzyNNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 47e87f215544b5b9e87bde4539ded60b847a1b749987b55f5e97f77c97bd1bf7
MD5 3667af306dac721e2135575b2bb8bff1
SHA1 cdb0e84fb85411f05d690f5f11cf973d1f9ce75b
SHA512 e25843a1c1d032cd580ad38788de5de6f8c9720c5ce8ee95020fa2e743c53bf4345523d2e3ec252b75a58c82b8b323eee8f11abffd8946be2d450f158dbff476
SSDEEP 12288:Lj83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNl:LwNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5545ef2e07f8dc5c0dc88bfe3e3231f762f5ca6c3b68ec2c437f1e49f0b9089a
MD5 34ded94166184086b73bfde2ab13f4c0
SHA1 722bf4cd3a80f99c493d213d156a07282cb53b5c
SHA512 d0947a41ddda473cf9b5591b7c02e069f3aa984aab4f9e5249d13ed9175da2e353e5c058ed513e53b49527acbcb0e0a804940a71254165d505073b2f56d5c5ef
SSDEEP 12288:nj83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNN:nwNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4da8c1c38133aa709bd97a3e98d9f34a52408d60ee5f4234c12fd32a4224ad93
MD5 69ef43b59d0911154157f237d221cbd9
SHA1 779e7aa6ed8d1d2f71d6de51353dbe4a57d24e09
SHA512 355d28a377620b5076767dbc5385f6e0c3207b9364c2542106abda6667a25a3ac56d02e3810150791012d62cc945986524c802e6283cba50d4784e24622305f0
SSDEEP 12288:TyPz5L8O83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNo:ezyNNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8f7133b6f6703ef6e2334415abf6252059698e3b32e86977365678ecaff02229
MD5 a5e1a70f259e02a5d065037906ab49f1
SHA1 0bf29d6131abf315da50f9f016894dd1a4bedbcd
SHA512 e25451f07e5bd95e9b901ba3d4392ee13172e1cc555ce4ba520c02db016ab5e153cf92a42e116243885f09b904a41d410d9920886352367ea2ecbbcb4efe4cbe
SSDEEP 24576:MTHaLl3z0zDTNxPq4yqF9p9OTG6WiqUtcQX:MT6Llj62/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 956ca11475676e84c7ea910a5c5daeb543ab0be7e56b9820759237568fb4ced5
MD5 5ea99924edda6fae21d9b7be7066ccb4
SHA1 b630d5aa2f1cbe03e48d415236780b69c84202b4
SHA512 5c65093b0057508810e26bf58edbb622609bef94053ccf75997b460f80c5bfe3447fc36137f093ce0b998f90abfaf91b20fd8608218efa23a19891675eef8cf2
SSDEEP 24576:b37d9CHKy7GZ3NxPq4yqF9p9OTG6WiqUtcQX:77d9CHKyaF2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6fb191b75b11c30299acf361d755c8411e656388d3b525ef6182f59855d5acc9
MD5 c41a8493c3e99d9b22b99ab05bad0cfc
SHA1 3fdaa1adf0524453493461670d54cbb5cb9d8390
SHA512 7df33df87e633ab3c6c512ea6c62ec8e9b7ef5e0acf0f5604cc84546ffa75fd798570c9b34ec747fc0a3e3888e306a3b12201b622e600f95f033a6df6753babc
SSDEEP 12288:oE83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNY:ojNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 a7cc3a6a2d542abaf4416350f66edef8b67a2084d088e15eca439be8f1c514d6
MD5 09984014da2e7019c1a3f0bc81cd18e3
SHA1 6f5ac66e39839e366f8ce82c44e6cc64de67f2ea
SHA512 372394fbadb404860581e09eb29e46b391ef425817e599364957808bac978b3ae647c7bbaa6ab108645d92b061d04910bdc9bd7bc642f913b2337a138850e3a4
SSDEEP 24576:1cP4mcvIjkGOxhKP2l71SNKbrh/8KB4NxPq4yqF9p9OTG6WiqUtcQX:aP4m4IpOO67N8Kq2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 18ec0f65a3e3726506fb78825398f44013deadde20b655d1cb57e3b5cda53691
MD5 535cfc7b3ec9acbdb888f147bd378325
SHA1 f757db3967f96085ae33f15060e2ad45c27dc14f
SHA512 635cc4ce52b7c2dfacc955c0df85298fbaa2034ae42785945da61e7cc783873e09da3e94a93e7bb1eb6b5553854e0ba7919f08bd55f66cca83db6e1a4a0a0eb1
SSDEEP 12288:EUFmDDLQ83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNa:2HNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5ea492ee38b009f9360d937962932a5e7a156f32eedbd3cb2a9f146465766900
MD5 6c78932c3eb1ed297b8f13a720de93b0
SHA1 2d55b9621c5be61b9756a361639958f170ac5dff
SHA512 fbc9e6029f08237363ae8edc31b2d5df73e3ab93e4cf54d72f1af999a5924350c269bd75cb6a9de6f7828b99b80b1ebf119e9ce056269d905f8cf19ba2d05759
SSDEEP 12288:yz83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNL:ygNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4a945a6bb6d19c9504abbfcc8e6e816662548763c8f9cb252cb80f83c577da9c
MD5 8009d1d95be6fb09b33344056a38ed33
SHA1 2c19f2828fdf0a3bb1a9b8062b387243298d6743
SHA512 d53947f78089a17c88858ea8775bb6dae35af609da599f43886d098a82a21e54607b72c0eea101d7ab1b64cb92b338d17b59099ad3d5f24a2bcfe0a945f19fdb
SSDEEP 49152:wa0h2GEkuAe73q3pp46zwwQ+2/Q9boLy:wa0hNYG4JwcN
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d61323c27076cf7e1eebec15b336d9b96125ca6399668d241dc05bcdaa1ef42f
MD5 274819b4d5b8d9a34569a13de48b30ee
SHA1 2fc13c0dbfd377cf30cd4a7fdb57170e21cee703
SHA512 18594fe7cff20f6bded5762fce6a9163acc1b2fb9642023e76e517d6c5e026233dd8cdb69b2c8567ec87f6f9d65de6e9dbff743646fdf77d988804582b36871d
SSDEEP 12288:shbHjfX683AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNN:shbHjPBNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c7c1ccf59c3046080eae97df1c7b81534f999cd6a444cbf63a27f65dc398a1f9
MD5 bc05358636b53b370c09a1ae0541fcec
SHA1 1f0858d79c625019226949651646772befc45e0f
SHA512 169874b56b5668d095c0dedeb1d2940b964c1a379832b299fd3451298fb2e6f0a89d7a25cfa2c2a0869d6c51720a56792d6bfa3aa2bd6d6f8c965603282deec7
SSDEEP 24576:f3YgnJcRTk4yti+R5dpR/pNxPq4yqF9p9OTG6WiqUtcQX:fIgnaTk46ppR/p2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 1a0c7208a316c2a9f8376340882280af27f9e92ac4f81815ebfc1b9e5801ecd1
MD5 24b3766e72f2b272f5d5821f50302f31
SHA1 cda81c0dc05c24d0aee3c78fd9aa42124f3ef6aa
SHA512 dcb7557b6ca9489ac9730322f656565a1aee1d644e2d85050362d2d9b48023cbacabb83000058c8cd63d37ef1facf734cf30f71e260eadf884b05b8d69e69b3c
SSDEEP 12288:RH83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNJ:RcNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 7d2a2b9639e616c0eeedd96420f546adb0b7fa49d018966f6b929caa4d52bb2b
MD5 d02932f765b10273e714e344a2c768af
SHA1 983b25a08fb0d1dfd129aa4f855b52c669b518b5
SHA512 27f54dc03d5ba35f59ac79ce074360eaf51d49938fa2cb56f59b420faf5022cc303a33872682b46c7e0d7511260b45fe77f2e4b476fb2ff6e604db0ae71821a4
SSDEEP 12288:IOb9A4LWOsvAYFTY83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOd:lpL3UT/NxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 a866d329c953b4e8a633d6015a25553fd29f7870b76b33efa9f1b82e335ce6bb
MD5 a3c8e5e690d97473b9a245607408d1db
SHA1 03ab82d2a2560c5f7f5b64a86e78ac1cadb5c354
SHA512 2f9f63bee439e457d66e979c046b85b7ecffa0391c8f8f1611f56c3070017d27478f1ef65ab7ef1c478a95ea31f2a776cd5bd682fcdaeebc51c6d39a7b29641d
SSDEEP 12288:IpFtpO883AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNm:aOLNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b2cc7f0ec5fa3d5f6f3b62c0c3871f656c966f0bf5cf50323e97f4f990cd60a3
MD5 5bd1e2d6c64effd4a08a1357be936cea
SHA1 3c9ab22c167d2edcd9d82e33c7cdf64cfa818d95
SHA512 07eeaa5b7f56b940f935e96d119eb157491eafd4e34b2fdf52e79b19219aa748c233b1563433afe1f95f17ea2816830ff8b295bb04d18e756f4ea80ddcf79184
SSDEEP 24576:57NM9YmZqmWMUkPjZM48Mv6bEhswNxPq4yqF9p9OTG6WiqUtcQX:57cBWMpPjN8DbEhh2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ac7c81e85953da1ac0388d24046b9f8dbb830faec1d7350c33f0a406cb47fa8d
MD5 a9d2c0e5a8988553df1308ef1a44bc6e
SHA1 51a549b18f1b68b5de128c01515299a7d7ca40e4
SHA512 d9f251797484ec0eebd3e10ddef403607405ee58b9c7c5c79322cde3e6d6697cf96d98debe0b630a88996ecf781db9c8fcef150922b7078a7b3081b3219e9f41
SSDEEP 24576:aW6BApg2YuyuNDYTabvcRvNYf8km1CNxPq4yqF9p9OTG6WiqUtcQX:aF2YuHNETovcvNYf8kmQ2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 44170f43befd51e29f3f38f70a9978efdd04adc371ca82da89f847340ec722d6
MD5 9fd7ff1edbfa16acdf0f1ccba3ec5d54
SHA1 0266d1beb9e867175bdaee5ad38ba0f641bce603
SHA512 1b1bf13c27d3fa38e81f4077abd21d44b1678ebbb469bdbd21babcc5402d3d9c397915cc00f19ba683d9809ba8933f8312fe07595bd31e1fc4151c16cc4cdac8
SSDEEP 24576:aAFs06+Omlf3NXEbTo3NxPq4yqF9p9OTG6WiqUtcQX:jFs060lVXue2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 b6958cf10c833216366f007d61f100eae3a28742bfb0f7985e9f566d145fbfdc
MD5 c615bfaa2244185a067e60f012900252
SHA1 a091c44c44ad6047c2e1ca1aaeba11e7f5ee7218
SHA512 02e27084d1d750dfcf5f2914c7fa5ac47be38070def8bacf4ee509becf7d042f83b72e7417262d94c629146a1486f83a12978bbc9522954e1bc0133baf6bdb2c
SSDEEP 24576:fJnJ5D3WteNxPq4yqF9p9OTG6WiqUtcQX:fJnJ5DGte2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 85f66f6d492ed8117ea8c951c8cf92aab54efc9bb26568133e853254f7b85c2c
MD5 2895b71c67e6ec427a212a32d35cb208
SHA1 8665c1daefbcc68dabb5909010a6b428dbbcc99f
SHA512 40d871a6ff7d16384e63b0cdca39e50c08dbd274cf1ecd6125bb24aca40bdc64898cff5a3b92bf65792a7ce8246ff7684e519e80e5333d348bbac8d984b061c8
SSDEEP 24576:BEPohm6/7IIXdwcXrif7qQncjlP65i3VupNxPq4yqF9p9OTG6WiqUtcQX:mo06DIKdwc+eQnSt65aV02/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e3ffa82b0eaa1424a9b382838b3db9af2bdbd898aa5a203f32e07c1317d18fe2
MD5 c319eaf25f6ad0b731abb71ac27c8c11
SHA1 8c2c618599f7401b89b1245414a7c14b6214cea3
SHA512 a7ff13d35c785de815fab24a70a75b27c61981349018e40bc68849fad480bbda2e3dd1b1e087c93d0179688f01754e7c03f85824972e1f3ad19f7f1f82079088
SSDEEP 12288:8EP3RrV83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNj:3raNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 50772b44b539786c64ce24710628a0491e24751b1c75654c9d9cd713f8f46f16
MD5 e2f8f2e71444c995a2496b9c538dcbf8
SHA1 41c6739987e3718f5d37b9b490e83b64b35cafd1
SHA512 d2494b43f02acb6c861565386ee462e1458e1fde3a1610a78f6056fc2be2d6573a1993f816bec79050f4d452a804413e4f0ca6d9f5127189e6b760a973360ecd
SSDEEP 12288:UjkyK83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNn:UIyxNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 abdb3c5a5d92303ea6c6413ae2fdd78df37aa60da4844e205db2db1549c4a02b
MD5 83fdfec3331e3b5e45d8104f901a04b0
SHA1 687508906e16568c7998797d44387be77a9fdf78
SHA512 cd87ee059465d4f0108266028727137938a44aa1f318ba0d005d0115e54394c581b49ef6d1ac095e7b0f599e0bb05053fce0551b25d0cc89234782d00bf04742
SSDEEP 12288:TFM83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNK:h7NxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4fc04af7533e0886408a9a5137e8ff97d0713f857f036c5a66772837aab174be
MD5 bf0fe2c52ceccaf953202a34fd94d1e6
SHA1 ee744bd5f1eb0a9d51b83b634b4cbc886066b2fa
SHA512 1172665c64ec221ef32682b65cdd06ada9afcc68f42a45aca50300e2279be8ea6ea740cd09331624d1e1c7722abb0069a1e4578e37737ac9671dcc69449dc8fd
SSDEEP 24576:8Q9MxZKdcz97w3INxPq4yqF9p9OTG6WiqUtcQX:8VKXI2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 5ca2b25f8763414fb7c025a12faddef09de53373105b7efcd69354597fe0c9d7
MD5 aad9367c208f994660c3bf920e50af1c
SHA1 c19111fe6337be9f8fbfe49a35a1d42c110c803b
SHA512 50f32a3d677a45cd59c2729b610cffe30b9d8669ecae494908a84d8905be3f6e78e92e2b0783f0437d1fa07df6f8bf15ec346827f1f62723ff97d2a0ad8a5001
SSDEEP 12288:ayoKo2HRple9p+83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUV/:ayocxApdNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 46bb0484cdff6665a2ef1cd22f3f799a956cec508f9a9e57b4c39f9051c0b30e
MD5 9ef48f597f842df88aeee2867a0610ee
SHA1 f5300a988e01ed558113975de7fb196e245c0180
SHA512 f57ca96824fb3f80d623aa167ee5dccdec0b470da1f5cee1d054dcb0b693b729f69b1a018c2e8beb43d83993719d926895c4549d99af95fc8f32273251530c8d
SSDEEP 49152:GWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKd2/Q9boLy:Q0zuNIIN
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b6fe1d9cecf2fef9bd6823ba50531de9879f35a3253a8d7c7318ae51afa8c16c
MD5 97c34bf8f0b21be7decfd213376812d1
SHA1 28aad386813b763e7315ae850ae13a2813878f84
SHA512 8999b8c787fdd97f7aa1c673d803980e80b6c2fc079d23281227a4aefe46aed5e81ecdc626cd9141d08b166b0d59b40d1c3d7f085a0bca9fc847587ee201e84b
SSDEEP 24576:F1QT7EcpfxR+N5AWAz3ooiYtjMqbaNxPq4yqF9p9OTG6WiqUtcQX:gTDxR+N5YzTfjMr2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 8901de58df87ff98c4b6d2f22030774ead10563d7abc05864648c52f0b368791
MD5 fdc79a52d5603f7a1f514eee59176dd2
SHA1 0158b41bf862a46c1528ad6d164a1607f303b55a
SHA512 8f9e41e692ca9497007f3048a00356d38b33314f9a8e8410da36dbe64ef4a60e06ccf28565a2211f81f5f5cdf33110258491aaab3ef7e7b014ab6e290cb5b3d9
SSDEEP 24576:ATMdOz0FFS+imSLWNxPq4yqF9p9OTG6WiqUtcQX:o0K+imSLW2/Q9boLy
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 eeb0aa79ff96c2fd7571e1ba4998618cd4c7bc9112a9d10df89ed83c82a847af
MD5 37521828a5a2bf6d697face1e2bb3419
SHA1 baf9a05490a2f32d409642fcaffb5c84cf14883b
SHA512 ab1d0d400e20c173a6ab20b095a912724120ff97cd69a9c71ec7415ce9c6edc7efa9aa9bdd13817a193d621bb37a207548e190e66ebfb5db824ac4f8696373a6
SSDEEP 12288:E47Y83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNM:D/NxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/688-34-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/688-590-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/688-26-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/688-27-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1440-627-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1440-265-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1528-487-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1528-257-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1628-14-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/1628-20-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/1628-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1628-589-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2068-266-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2112-263-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2300-261-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2340-255-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2524-267-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2524-628-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2600-251-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2680-256-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2772-262-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2904-259-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3132-79-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3132-81-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3132-69-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3132-75-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3720-56-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3720-48-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3720-54-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3720-625-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3784-87-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3784-250-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3932-254-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3992-260-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4508-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4508-37-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/4508-43-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/4508-85-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/4508-84-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4532-437-0x0000000010000000-0x00000000101E6000-memory.dmp

Download

memory/4532-1-0x0000000010000000-0x00000000101E6000-memory.dmp

Download

memory/4532-436-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4532-0-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4532-9-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4564-65-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4564-253-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4564-626-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4564-59-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4792-196-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4956-629-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4956-268-0x0000000140000000-0x0000000140179000-memory.dmp

Download