eaef931c06f252994186bf0815b61eaed67fab3984e6a026943fe4a8d45b7cf6

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
Size

603KB
MD5

05a00341a529a8df1fd06ea314fc2880
SHA1

df0bb499cf88dae84b8e3018f00ad2221dba2eef
SHA256

eaef931c06f252994186bf0815b61eaed67fab3984e6a026943fe4a8d45b7cf6
SHA512

13a279e517b7e4d2b43f17d58a3188bf51d619d3dbeaf3b79dd844793265d95dbe9def9520043ab07948b9b68305d81cecbd78ae6844e84b4dd083ebcbc5ae86
SSDEEP

12288:JAvFPMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:JAvFkSkQ/7Gb8NLEbeZ

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1584	alg.exe
3200	DiagnosticsHub.StandardCollector.Service.exe
4844	fxssvc.exe
4796	elevation_service.exe
1208	elevation_service.exe
1516	maintenanceservice.exe
3108	msdtc.exe
2784	OSE.EXE
808	PerceptionSimulationService.exe
2840	perfhost.exe
2584	locator.exe
3680	SensorDataService.exe
4800	snmptrap.exe
3784	spectrum.exe
3416	ssh-agent.exe
3012	TieringEngineService.exe
3948	AgentService.exe
2348	vds.exe
4532	vssvc.exe
4560	wbengine.exe
2016	WmiApSrv.exe
4808	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\471e9cce1ed82f9f.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\java.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093841459feb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003873057feb5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000aa3a59feb5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005ebb958feb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012fc4557feb5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005ebb958feb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc864f57feb5da01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
Token: SeAuditPrivilege	4844	fxssvc.exe
Token: SeRestorePrivilege	3012	TieringEngineService.exe
Token: SeManageVolumePrivilege	3012	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3948	AgentService.exe
Token: SeBackupPrivilege	4532	vssvc.exe
Token: SeRestorePrivilege	4532	vssvc.exe
Token: SeAuditPrivilege	4532	vssvc.exe
Token: SeBackupPrivilege	4560	wbengine.exe
Token: SeRestorePrivilege	4560	wbengine.exe
Token: SeSecurityPrivilege	4560	wbengine.exe
Token: 33	4808	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4808	SearchIndexer.exe
Token: SeDebugPrivilege	4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
Token: SeDebugPrivilege	4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
Token: SeDebugPrivilege	4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
Token: SeDebugPrivilege	4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
Token: SeDebugPrivilege	4084	05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
Token: SeDebugPrivilege	1584	alg.exe
Token: SeDebugPrivilege	1584	alg.exe
Token: SeDebugPrivilege	1584	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2024	4808	SearchIndexer.exe	114
PID 4808 wrote to memory of 2024	4808	SearchIndexer.exe	114
PID 4808 wrote to memory of 1096	4808	SearchIndexer.exe	115
PID 4808 wrote to memory of 1096	4808	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\05a00341a529a8df1fd06ea314fc2880_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3048

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1208

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1516

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3108

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2784

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:808

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2840

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3680

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3784

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4988

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2348

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2016

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2024
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
32eca571862a0520320267b898df1423

SHA1
3add82c7b47ba7695ffdd2ec7f4f369da4df3cb4

SHA256
5d1bc44ce04baf848e4f8e3ffad8bf83cc04e965c9eb41112307d45bf615fd91

SHA512
6fdc5aae8ce5a38aa5d967ea30e137ec0d5d8f9d42fb199896510d4500dadaaab8c077d253953aaf61bc47fe02d7f62cef4a699c501a5547f07544040a895466

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
797KB

MD5
7c0bcfb5d6aa90fbe5bb6dece6b6e29d

SHA1
2f9f2ffc0a88b364fe631d54cb7029035bf90797

SHA256
9f8af9eaa5c0727aeda1b8050a74da79216663730842817cc1e568b5c6a2faa2

SHA512
13230f73c555da773c4e3ddaa82aa6a99c7767e897794412a12d198cfb306ba1c0bc419f0d838aef34ec1a539ce984eda20aa9f71ee2f86e09a7d517fa5eadf2

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.1MB

MD5
b43b1939988951fed33da237bb3a3ea4

SHA1
9ff3e17bb04e5e32f2b8060f7f397d39bd53a68c

SHA256
597539420c4fe78001bd2ca3ce7610bf95dc1aa366ccd08ea00672825077cce5

SHA512
b42ff50bf3d7a28856a0280ad842802d5bd911c17f8652dfc2a0fe4b9f2cd17cd74746f4bd7ed20afed4100e5055e3f242a71a28201686d75e10a6309323110d

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
58945ddaafa22373ee572039b478c2da

SHA1
d893c8bf6dd94dd1acb66b1ac9b273476bf7d981

SHA256
b2a723059cc89760963026331423283b1b779e670d68066b8d3d50529989c08b

SHA512
e058129c2ad5c3fbabfc1d08b29deba27186724dd646dd2361b728e1c97a42828d4078a0e2a0b50dde93661f7faf38f3f8d7581f921d60b3c3cfdc8bfefc13c3

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
47ef950e1adfc0498a85954cd244768f

SHA1
e1cef9b77e586889fe4ce632eac72e75e7c2bcc4

SHA256
66aca257ee0074ca5e655f78e1c65d32404f267caadc0482211aea60f8d445cf

SHA512
801eb57b3601757d383436f254bd9130310b8e3edc9793d6954ed6967587dfd53380d764b36f40cb0097dbd658319ee65c4dd0aadc744bfa9a5397da3842d796

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
582KB

MD5
a6b1c83e475165b8eedff866daf303ff

SHA1
7675896ac0f57b8d99bdffb1a87d16e0eb4dcac2

SHA256
df9661dec5f8ce3fe1333939dd6dc3d7c68b0a5625201c2424bedd759fd9b839

SHA512
0b97b3d1104b9449f5011346563a5cd61095ed1963d8378f35ae283475ba241fae2d813308cb0dcf5d6397bddd343a899c9478147c8c06bd83f995f50e95b68f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
840KB

MD5
7b0e1ad78101548fb17058bba990802a

SHA1
7a1007acec30d33bfe7fd32893b0284ef96584c7

SHA256
1331c28d541b34fd6a3654835a50389985002d11abaf9237f36f00660eee83c7

SHA512
be9f0943db8b02bfc01e05fb09a3b77673971959cfafc6d76134840225bc66529167b1e3b7f20919f7d5ebd14b127c27988d6a16c128fb699e3ca7dcd70e30a0

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
e3dad469dfffa56fb8089c656f355c95

SHA1
c1f33cb69752ab2f987d1a5987142889412e81a9

SHA256
60bdf15b46fa8ca166f5ed3726c31679eb457322ac5e923846fdbd967b1ec925

SHA512
613a31ff8dc2539a1b9b15244fb9cdb259041c2bab899fd8103c166f87230cd53e4bdba9fe1688274db86525cbd5b1703265b4dc2a7894d8470d5c4613c726a9

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
910KB

MD5
344a00889bae02b4d3faa2040ae087b8

SHA1
73ab178cff7c448884b21313440697dbb8ab931e

SHA256
1848c8eed927e319a737ecad26fd89877fdf56383d26f75d61382d00234c6d37

SHA512
58cc3714e4e426750982eb155c331a3fb86178696499c9763ad8e29f15bd761a5682d886f3b2ca08ab6f5b644b804f022569606b5c9c6c8c2bae0dbce0270060

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
7b46dc043be70456e368bc1d04b38cc2

SHA1
3b04d81320205b9949bbc95faba4162fa7d480d7

SHA256
37da68d5cc277e437d254112a35b2b03740d892474928f3c80e1db160e98f5d1

SHA512
3f44b21b55d093b5396b364509700f5061923e9233b61b1258218cbfef89c529407f37de8a625c1145c28ac755aba5c18fdbfcbac07aa294ea3c0e11a05292ab

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
d271077e608af9a9be25cf27dba67b8b

SHA1
07cdf04a26588967c84492b3fb0d8db779b8e459

SHA256
37ee94ef4da32362e5bb936c372b90eecd79ba667d1a7393d24160568be4315d

SHA512
ff87e2cb2cd51d21f8c9c3f5926e5addc7c6ebb86313b1f4fe0bee6972511eecef5a13511ea51582675544e92c769e16b7baa8053b92456a686b8175773fa823

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
765e4df21613fd6fef326c1b8792d75c

SHA1
7bfd97cdf795e0de4ae1f66e80a3c74a7e96f2b0

SHA256
36b27918c3d5edbe126975171c953c6dbf0bf39cd6d67f4dfad16ce303f8aad1

SHA512
f1a3625b036805d97ab64fd771ec6e068ac3a66083a26cd04b88b0c0496e71b1cb19829bb1d03170a6f7f1fd037e16a5e095c3df3fa5c13fc507ea5053bb2d56

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
4bc48d6d513655f90b1efe50ce3fe038

SHA1
852d543123f8aa55f547463da2e2edc6e68a4b5b

SHA256
716811fae2feb54b9a782437d9b37cbfad8867f7a6cef899f0fe7c95ad0a0485

SHA512
563ad5dbe3ebadba8b4a27a728966fda0b58298432523f0d4a72570453cc8c833a508bb2943eb71ba1ca4819efa982395700e69a253b0309b655d733480955cc

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
656KB

MD5
6f8cad53abebbdad509aad4214db21cb

SHA1
d9924eb97496b8bc977ef8537be8d9da23d92382

SHA256
c0def372d4c6b47f20d0e646afab6561ca9bf5455fdd152328a6658c812d766a

SHA512
60c968955a8af085a51bb5ce6540055136b3072539d6f1dd64830a8bbce4c5d85ce10f6502eaf494acd07bcfb4c99f0b39b3f2c0974e8a11e35e58f03a4345a3

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

Filesize
5.4MB

MD5
989493c7e6599aee0b204b653dc054ff

SHA1
aa92b9648d2628938d65b099564c2e68d7baa1c1

SHA256
fc1ba8ddef6aceb5516f9c424c91629d9c14d5928e602ed8b4e09934b7fc957f

SHA512
532649414f8f3e26cec1fa392d35ba084ce558b232faa13681e69dc10af5b132ad2dda76f44fa5e22e7edb180ee375fe498b967216e954305c3c737203def369

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

Filesize
5.4MB

MD5
8a03895b6b232f6428df7f119e2a4b92

SHA1
19d374ee3afe2453488d3a564d96352c2a674218

SHA256
394e021b862ff967600ba3d86ee55080c1daf9c441e00dacc203f51f0cf4073c

SHA512
8cedf6ee1364f2dbb410e44467681558ae3d95030dc48e9f2b2cd082d9c4dd93895a8f9e0686e34a723edb5bf51dfddedaec2a3db1dfd2d8258b765c6439c32b

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

Filesize
2.0MB

MD5
f3bf54007707bc702effae95abc10eb5

SHA1
7df5de8cd2c01bfd427ade00ae82dc86f43c14f4

SHA256
03108234ef4b16bf471b73e7e04d6fe46a79f9314042c30c88eaa36fa6c7d657

SHA512
9d99fc8d04670db41189bf2a26a0488cd069be1b0dc6b15c8812a7902eb19027026e63732b4292afb5800fdaaa85086afa158b571a26f79ed098f25adc36b2d4

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

Filesize
2.2MB

MD5
841c70ec7194d39ec9cc68753814a97c

SHA1
cf8a3a4170c4737ca56d6a10a01ea6fd43f0de2e

SHA256
4d5bc92adfb2df1d36437206589ba1a3a2bc1359df8cfe8a6b76cc645df4c15c

SHA512
53d698f092007463751521e8d944773d4bcccbf35b27e00293179bcc1ef06ed7c78cbe6fecebca5a2e4e199e536e03f7737065f090a24b722081103d73b52b9e

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

Filesize
1.8MB

MD5
b00b8a20d117b06e7c9867c6f49360c1

SHA1
37d370eb70b7608601ef37ca8a8a72e285d8f6ee

SHA256
90ab8d20e286b20175ea4c120ceb72d1bbe775e7d24f201149950288e996af0b

SHA512
e8c3895eb14faf8b8388685443a2e8fb04c557cb41a856e6ed2369b0fefe5739a8b6b3275e284fa04626adcb5cbd5b7a5c9f377bad0a94248594430439e21a2e

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.7MB

MD5
0330923ad8026d39be6885b006d4d734

SHA1
88891420581194dedcbef76ffc35597b5cd58e1f

SHA256
6b1d84975b01b6638ab3f411e9f378c42c27e81574cfaefb2b47e4dabdc2f4a6

SHA512
f4af52a357e64cd1cada819e109763a6d3c9e1ac5d015a9d0cf1438028c961d33881cbd564504e4a1b9327cdba9330d1a5531344320229914adea39fa2cd8d34

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
581KB

MD5
dafb91bae90fc0a290e6eaf1ae0a6791

SHA1
b2cda3e119f2e229328672f46be4aa7789832423

SHA256
2214627982cfef0c0c52414ef1983afec365ac30386232c2a3cb19a4df69a21a

SHA512
2d9331a90d87be92278eea543377d45362b1bfd30fd492d9bf39e206a6f7bc9ed87596d6575ee9bf614de6dd9e9bb0c47fc14de7b6f7e5753b92b83d7c52116e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
581KB

MD5
0502166782c6d665655ab8c0d9747438

SHA1
744e2a76e858bc2ee05a87fcfef2047e8b6420e1

SHA256
c2c630d68d4dc2d6be85e3a39bcbbead8f72608ecdc728d0844d411d3d49d4e1

SHA512
3bf168a07b7e0a54036d89de35ab50edb218e839befa1133adac0d7a267e8ae2519242f6019ac478013b0db40f509e1c192e1449c65509e8c9035bc59de1b6a8

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
581KB

MD5
5c2fec5611c750e193a8924a08eb9349

SHA1
70323738a4dca87c23f5571830d5a931fcafe5c5

SHA256
25f9c0aebbe3188376f639048c539a22fe10824a430d0daa663643433dc0c47c

SHA512
693de9a12d23d54f88ef9570284cc9711c917258e344c0669141a2802b3af17d7524b8d9981eed9f51fc6c6fa2c96ca326ef80077b5f24a4a300c1169b728296

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
601KB

MD5
e1a5167824310bc074a6d5c01ceccd34

SHA1
97c52ed1e6b6258bf44b5bfa76117ede1549e207

SHA256
3df299fcb3a1689f0bc5a56c886b7608bb51ca8fa5ada37276a9bc87d26bfd67

SHA512
bf9462ec19c7a29fb0bd1fd2ea6300b331e8905982c3da7432ac3353e8ea07ea4bbaba2e1d32641417ea26d6d7a41dddf07e1d1c4feec3afa00a43e37c9c0e47

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
581KB

MD5
455ccaf342f38b1468260999d6acdd6e

SHA1
3235a8bded7eb8de266892f122d9f4c6a3051292

SHA256
be80444c79beb95f6b1ae29437dd9308175468ee9d5e6f01e9ed8f0b54b418de

SHA512
fc89808ea26dee8d2fd9f4a3b6b94776d95758ecfe24cdf69afcb2ce47bd8908c334142f4ff811c2a40edcdcda743ebf9e7ff905e9f1d337fe8f32a410f29631

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
581KB

MD5
b2ed31c30a7e2a81f0e3bdf730e3b816

SHA1
673b550710d960244ea6bba4ddd19b83abb1b109

SHA256
d3e576a5fb56d6869d65c951453f8fa36ed0da8fad0781bb49ef8def303f9486

SHA512
39f7b91f9ed350e47f4a54b40aa71487ad18dd451e508a5465fe255d84d46bc8c5a10e9c4ce8db46880cfb41a3e875f0aaa9d237b84151cda015c2cf9caacd46

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
581KB

MD5
722d96963d78aaec814b47da15b5e492

SHA1
d571c69c96f4b2192aee096c3dc0c3f15fde7d8a

SHA256
ba57b8634650b51640d65a81f0a7b9bc4394aca6499f2210c919fe7b32e03097

SHA512
482a6a9dfd372d77710dae856dc91afc7a1e69453b279aa567d2bf7724e9e89765959eee2431e0a041ccfafbe6b5f09f54bdff01addaa7b484309ace76110ac2

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
841KB

MD5
5721a44cd06156a195ce309aefb19069

SHA1
1e14b10e2e8404a5ac87442a6be825684fbbb27a

SHA256
7b539b5e44097f8aaf26cbe67d9f09f20531402fc47f0a09756a9b964203ef40

SHA512
94951e93deeb64e9fee4941ef495a3eceea9ca57f9522e45a2cd5ceb37a1bb13406dd6175fa1faeb3b39f7902a27acc27ab39e03727a313ef1183fbcf3e40faa

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
581KB

MD5
661bd5638bec1612d67a8628fd17b611

SHA1
b639345eaef1d1808b652f655bf1097ad38c395b

SHA256
ca65b5d713924cc815ae37c51b976c9476316a84f16144c20b8dbf21d4e887bc

SHA512
6e007f0c97bea8cfce05d0d21f9d262bc26f4f8c1c05435d868e8dac9e55f590f4d431311a438ea58b36022cc7e07932141a24decd04faed69be624b6a8494de

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
581KB

MD5
b64f222d06c0878842bf52781d2f1cab

SHA1
f4b359222e609c78be440cf96fc0b15be5f0946f

SHA256
4acaff80d7c94319e180f6d5848315106c168d9ea852047238bfea81d0a6feaa

SHA512
776315d9464573af78ee4f05e64dccc25ae7e49dde6c202bd3bd34445e1d3589431c999ddcf8fc1caee35bc96de6992678b992738b87d69acd45a0b88bc4f945

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

Filesize
717KB

MD5
f1cfad1a9283d4b4fbccecd59b5993e7

SHA1
8a866ca29a9de5767a4bd721f6e5d37a68a4aab1

SHA256
4000678a17e108d9cd518dda78eec05106166db1294bd5d811fad6e926e54c9d

SHA512
40ece8cb09d4327346d182c1423f36b630c847381d6a8b3e750fac6ef22a1b20d542e25fa71ef3265bcb6a7043a62fbbe920bded69b444576e0dfd833b12cfad

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe

Filesize
581KB

MD5
5258bcf40e619fae6492ead61a4d5ac0

SHA1
97e96ad5fe0163841e477c5f394781ce05548ea8

SHA256
a773a5d6c6fbaa5299442fdbe965db43d4107ff6a4b00864425aa8035dd45ca6

SHA512
241ec24f125571d60ec448f2648dc9e6b8610195ae09fb4ad9e70b941764a4a37b85fa49d551263a8f7ad7cac00d758757846151c075eacbb57d974bd1739dc7

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe

Filesize
581KB

MD5
6fd559a119bb2b7d42787b32707198dd

SHA1
1c305568721ea6a15ca2af2610a60cb03c41c82f

SHA256
f21e57fb516213079e23b98aa7b509ef0e72ea7dc8d68fe3a601e86db9777459

SHA512
62916fcf12aed3a4f2d0bcf4f74c286d9bab068135500cd9f187f08407c7ea01ea756a44c0d84ea05f9e49c6d487c66ea14e933642c0cd740be8128770f7f2ca

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
717KB

MD5
09e167009eca7249be0666c995c23e3d

SHA1
7bc7ca675bccd4f25aab619ca3fa01e2faccc97b

SHA256
fc25de86395dca8011ac6d551066a59d22c5e05677560326ff0aeda91b07955a

SHA512
efaf7d8088bd101dbfdf710e19b1760a9d923b8bf22c5a5f819a64fa7d659e73c4b210f5680f907d52501f7e4244863b75033ea7d2dd275b8b6db901632d5cd5

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe

Filesize
841KB

MD5
172799ec9a6229ced92a0edcb7e328d9

SHA1
661166cc9b796c632d9d832e22192e7d71bb41c8

SHA256
432364d0fc21c32a2b5e9c364edd415927c99321d6b05661bff9e4c25cb05ad6

SHA512
6250b1cd17b02ef0583aaee666f52b9ee309032bca01a04c5095e7751454075a90f1cad61dcd6c0ad13f59edaf08ebffcfd73ac77f0abd5315eed78ddc74340a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe

Filesize
1020KB

MD5
b0a69dd20e9f7f4bc934fd3895d890e3

SHA1
6e02ba4f23767ca7449f6d194e8f0c6e5b908bdf

SHA256
eaf69c4b6570abc0513213ee8c9c331f2eaf2507efeee5010db93b1ed0332088

SHA512
c7f915e460977defcba8a2a656399d2528a26d6667ff17e013ded5c544abac6c30be9b4b71f0d6dd45bec08bf1897faadc7f551ae15f11be383f5543adf38b42

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
0f7e230008ca3e02c7f270fb86fa9fe3

SHA1
f259c9c0de3bf7d8ab25a8b723667faade9f5084

SHA256
bb76e1be5fc09b8cf5f6d57a73f07353a461393022dd81473915b095d6161461

SHA512
dd0d0660308822438585e9e0acd582fc33fb18c3eb22cbb68d6b0e001973715d0a6c667f3c72c76c5ff8912da1ef6bfc8d521a7b484fc8730d438278dde3aa37

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
701KB

MD5
d293e83cb0b5e35e6342fa99cf7e9756

SHA1
20566a7868f2c263b099980dddb0cc1657bf980d

SHA256
6cdce96720f3c5a513de4dc704e823a65dcbf61ba7372c47c01a9874ff0f5158

SHA512
fd4dcc946b072c649b7203a3e62cbf3905c3c6bf952f880eefc058c91517bf7ffd8cd408396311257b351fe72812d2584dd0ba4a1b2b310fc4c29257737c20e5

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jcp

Filesize
8KB

MD5
16ffb7241789ea0c90970d8c3eb2f21e

SHA1
8cae02115757630b5a891921c011c915a8fa84ed

SHA256
926c95d3b8e9730c775495af0360a65e54c3467ce58ac646776552acf0f26b69

SHA512
20032ea3e1d1b8fb1b30ef499324255012029ebe715b6e7e81e817c6e7e8c0d9d426183f786b8baa4459865ca11820720a784561205be0971ca4f6e371dba990

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
7c476ae8fe0b8ebbc7d1eddc2dccc3da

SHA1
d666da7dc929484a12e8a6d58c2880499b032067

SHA256
b75627132c46d7c95a474f152131075408622304218d9f8dde8496933f5781d4

SHA512
61a10ea56f8501dedfe05a8ca8c79e65a59e2021dd71a92f6876b1ebc76172e7028a8c8f73ade6594a14b09a6625d241cafb58adf1249d7e6a4eb683842b7330

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
2880a4cd2ed487e9f4d9c7d487de08db

SHA1
44e9804bb424cbacbf8e6d8d696e83d2eabf7d49

SHA256
5c892f92436fd917cb17a1954ea4a5277128425b203963ac0fef361d0236109a

SHA512
a30856bc512f5ef0ddc6970325fe086de30d97b7642be29e3a7dba59a1b915cede44396eaff658defda349f8c40444ffdedc00c9a4b39de6b9701223437b51c0

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
0b71b7ab423c8f3b81816cecd0282564

SHA1
887f3e41e62091de9239435fcca0325a9c870078

SHA256
9fdff1d6377ff4ca4091e330da0665f3b87f40178e6c4ec516bbecdd1298c68b

SHA512
66184756c61b803afd8b76f26f551d929277dcb3da05a1e3b83eaa5d4e53da7f41fb776f8aeff0daa69e4c4bc0b294f1dc3f4be8a820bf01e16df0f4c8b51a46

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
004d5d7012f4fa7e0df1d998c73e46cc

SHA1
497ba1a1a78c5c48faed83946a23cd88971357b7

SHA256
45c41728246bdeb480d300de9372764a26251b553a9d4681ab08e2a67ba7b39e

SHA512
e3e56746c05503b33b69add3122f2b73fde52a26736374a5bfdea4320065ca7b04d0e224c1e04818f263878623bdf9e6326368200e0faa35d82454e4e8858371

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
c610dbabcf0adc688aab7e1d431eb4fe

SHA1
daa20786af5ce1a1dad830a40a08565ef563c92b

SHA256
7140355f9dee93e3a76c72f6277b1a7ea0220ad5bb84048af7a8bbc73d14c5d3

SHA512
8c0044caee033b8062a734873f41cc742f952fd704992fe661964e461ae9e0139713027e1b49caf369c6076141f7d445cf5ba37ba63dab2dbeedbfb0c2102822

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
8d730e448667ba4a3bcf04848be1e3b9

SHA1
59cdfa44e26f51d10f86ad47c7eb7132adf074af

SHA256
e508168084d7fceb63258e3a0cf8b5078e556d6aee226b97905983a017e11a4d

SHA512
716147aade39b1f86f16bd5e5f7cd3d115aa20ad9f74f548ef1438bced5585acc2650b5bb8c74f21c45428590769a2371ff4274a06fb80a1275085cdd9645007

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
d592fab719445565ac468465c6d05400

SHA1
285245b6f4f1b1b9725d0fa1009a09ee1da67a7c

SHA256
9ddb09924ddeb7245f2bd26e116c6bda49e2d67f4d72ca776d2ecdf09cc3996e

SHA512
f5072599cff6853717c788f3309dc43b78f92490d5eee1dfb350c3b13bdc056aacd9d80e958a9a03ed1a5a6e8eb84636fa1805447377f75b361e2c436d4666af

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
27e71f56372f33301d2023b353212d16

SHA1
f60ba0d12a00f051d50e0f751316109b9341221d

SHA256
231743274735a463e9aedda3fd0080c74190e67fd6375f2d0874d95bc9998352

SHA512
d172742a654a15ce7a7c31c94c46a2feb87da6fb131e4502573338c295f555076e41e3b789371b1ab5cd64c8172d63ccc984bd661c287c90c86788c5456289b1

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
758147b0e719ebd8cfb093edb08cf71d

SHA1
916dd3188fe23a34f8ea9ffc5fe177e39d6f1d7a

SHA256
cca7a5dcb64c7e21148ef2e7bae7bb26c4424d73119820bc51c6440967a27c01

SHA512
4f9beaae08c284c794029985ff51eac13e1ff1292a6ab19cbf637c4e98c8b15fb932cfd24cabdae2decc5a6f7c4a6c5804075e70fdb71a8804f0ca139d984324

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
69a70c6415203f2c2ba84385f0eeb959

SHA1
6dd1dc3591b47fcd2659342e5b93a80b496e3f05

SHA256
d848f50aad7678e0f762b9b0de6c6c552f2daf600541087aea802104a9c1ff50

SHA512
0aec42d7c97121be23bcad446127da547632209d83b85ca9605682cf3127ff9fe90b433965384b79e5aac9c3262c2299738c1724fe2c6c0c94d7f0ba1b81364b

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
78f392dee895475e7a7216ba2b148f47

SHA1
a310fd60e662f1b8e7333285e013d652c49e8892

SHA256
f9e9773040bff4429a949aa65ebffe27a6298eaa8534275ac3976ab2c67684e7

SHA512
a5dc7dea43c66fe56a34a01a51f806e926c9fa3edc4abca5138ca6728154b5b314c25e7745de56d1e4d131ded1fc1dfe3514327e6abe305ba44b333d846334af

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
da0428975629ab3b1e8e85fc4140535d

SHA1
58cf3a7f68356ea4a09cc325938a746eb9a29e31

SHA256
631aa2a117a40124625387c1477411a9348768fdcd5ca9b71c3b73fbdd0a1da8

SHA512
506438407c97353396ee6184480bed796e8e42a018fb84e87469f50518c3ae3f6cd2bcc5d64913a5cbffbc997ec551239e8b57560932c839394eac77d3506a46

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
549cfb51bb9b629a84be0563fb737bba

SHA1
2c89410192db3b9fb36a54983af2a13925ea7ed7

SHA256
439b47c59ffc713faa642c3f0df0ce681a060b1bad9e4d03f97fc3f471db0e78

SHA512
034891189dc3f924580ee00abfc026e922b5100e90cec673b3db8419e8baa1cd3fbadbfefe977e23bdec7fb663719e8d210ead2b1f40bd47a87ef2126f5c1875

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
e965bbbca4cd91834e180f673dd8f87d

SHA1
008a0cb448706cbca627bf3281123b4e55b32875

SHA256
525a11618a4d566b75d7824d24e94f53178150b9f4afcb56c62bf7024a28a7c6

SHA512
4ee20cbca783f117ebc1ac58c6026c9560b7ff74fc908c5fbd9f7ece33d256469e1e1a51f0b7718e1c8c79ca916449340deb4f299c73053d8df0efbf840ca0b4

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
954cde5aaaefe9208da96f73ed4df002

SHA1
0121eb7c2fdc145f34d79568cd56c2044fc70093

SHA256
2e4ad134c184b34799c6543dcfa22fac35851d9583d8c0d49cf75f1d2b61050a

SHA512
e9c59a76b392fd496b47fadc6bcc18788a512434095fad06356ad6450481ad9e76bbe4808167340b3d81b35da50ce62fa3e2cb907aba57e56b07284668ca0f2f

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
6ae438591c0233e38dbfd97a88df2605

SHA1
aaaf0d98d36458cf29eef6f7862304b0c05cbe41

SHA256
b87af6b3210dac9fa0ddee606685f0139adf99f79638b9f1b6ae674b6e91ce01

SHA512
dd0fe79836ca6b8fcd44422bcbec92a3fe50adca92a5f5e962462f8a1b2d733be2ad9c3bb489ba4c89ff2b2d253c40d376b3b9ade237629ef82816dcff6f208c

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
ae8922143062c763bb945164493e20c3

SHA1
8c30e7bddaf3b05040e60aa17b9211c2c5b48e48

SHA256
55635bcad9a6ae76786a636879aba2f9b42b3b00b9d990192848d4ccd1e0b352

SHA512
b1eceec69d4ff787d16697e13413d73b3ab3b7a072ac61193d2a39117856c10fc12b4e7a2abdf359c63c8b11027afd77bed13a8db8ba1d9e3a3a0253d0a27147

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
0ad38c8e79d7a783e56af0690fd82957

SHA1
5a463c8da895c99393baf605b0b5780ec8bd4cc2

SHA256
4d7f3307386289bbb522c5db0ac9cd376a2912f635ff2e67e3390dafdda45423

SHA512
25dfadc98f6839314af711a0b95495bda716e2b205854eaf98f033ad39224e57a8de7ebec2feaac41d6e7ca1a12fdc3f5090fe18deca25af218ef399a015f70f

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
c02a7a3a8af5c1be90d5d6f54f202e7d

SHA1
aab4324946008f0fa78d056fdad2fa73a4cca024

SHA256
49a977963000a4f6f365a29f4eea7dc9fe81286045f5fdbf7708be15f34f8cd7

SHA512
1c86b25b0177cba11db2ab75136cbc808093e5e0db7b5475e35d7f04dde63a13e4dd72b9095b42f3730d295cc2899a825e4bbf1f9e3f2053446e2bdb86c4b998

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
877KB

MD5
4e26a0071b177a1fef02eec223574a00

SHA1
4bace5f67c8c432e84eede384e3e291744ada0c5

SHA256
ecd6adb76658191241dd25435db40c39b7ade74ab774e8064d07c3dfd6549c67

SHA512
f5040a243f6b7436510f25001b98f215883e636f2c1e8323f5494d394d3da15445508923593fc9ea2780380ec23db20e1e7146f46e2b6b084533906ab642bea0

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
635KB

MD5
d793af5e4c4bd8c7641f0fec99d2beca

SHA1
cdcfdea611f6eb7784f5b6e402ba56a74d68a10f

SHA256
0b77f56b0bc0ccaed75d2fb32191a8a7d2618bb8c1ac653ed9dd26bc0bd99899

SHA512
ead2abd8d8f14d35a08d7a171b614cf283f6350f21237216ac57d0d8079d1092dca9a1f59a0c096123c7b81043dce89d92450bf52ce762abd2db05ab286221a6

Download Submit
memory/808-122-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/808-235-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/1208-193-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/1208-62-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/1208-70-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/1208-68-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/1516-86-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/1516-84-0x0000000002260000-0x00000000022C0000-memory.dmp

Filesize
384KB

Download
memory/1516-74-0x0000000002260000-0x00000000022C0000-memory.dmp

Filesize
384KB

Download
memory/1516-80-0x0000000002260000-0x00000000022C0000-memory.dmp

Filesize
384KB

Download
memory/1516-73-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/1584-17-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/1584-19-0x00000000007D0000-0x0000000000830000-memory.dmp

Filesize
384KB

Download
memory/1584-18-0x00000000007D0000-0x0000000000830000-memory.dmp

Filesize
384KB

Download
memory/1584-12-0x00000000007D0000-0x0000000000830000-memory.dmp

Filesize
384KB

Download
memory/1584-109-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/2016-260-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2016-606-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2348-232-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2348-600-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2584-259-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/2584-138-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/2784-231-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2784-111-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2840-128-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2840-247-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/3012-197-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/3012-598-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/3108-89-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/3108-216-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/3108-90-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Filesize
384KB

Download
memory/3200-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Filesize
384KB

Download
memory/3200-127-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/3200-34-0x00000000004C0000-0x0000000000520000-memory.dmp

Filesize
384KB

Download
memory/3200-32-0x00000000004C0000-0x0000000000520000-memory.dmp

Filesize
384KB

Download
memory/3200-31-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/3416-498-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/3416-194-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/3680-501-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3680-157-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3680-272-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3784-474-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3784-181-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3948-217-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3948-221-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4084-88-0x0000000030000000-0x000000003009B000-memory.dmp

Filesize
620KB

Download
memory/4084-0-0x0000000030000000-0x000000003009B000-memory.dmp

Filesize
620KB

Download
memory/4084-6-0x0000000002270000-0x00000000022D6000-memory.dmp

Filesize
408KB

Download
memory/4084-2-0x0000000002270000-0x00000000022D6000-memory.dmp

Filesize
408KB

Download
memory/4532-601-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4532-236-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4560-604-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4560-248-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4796-56-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/4796-54-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Filesize
384KB

Download
memory/4796-48-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Filesize
384KB

Download
memory/4796-180-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/4800-438-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/4800-161-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/4808-273-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/4808-607-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/4844-43-0x0000000000A30000-0x0000000000A90000-memory.dmp

Filesize
384KB

Download
memory/4844-37-0x0000000000A30000-0x0000000000A90000-memory.dmp

Filesize
384KB

Download
memory/4844-45-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4844-58-0x0000000000A30000-0x0000000000A90000-memory.dmp

Filesize
384KB

Download
memory/4844-60-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download