20fc4d8e9aa8b49342ce4c2aad3a2ef8376773e815e811ded9fecbff6d33d088

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
Size 1.5MB
Sample240603-3a7vrscg2y
SHA256 20fc4d8e9aa8b49342ce4c2aad3a2ef8376773e815e811ded9fecbff6d33d088
MD5 10428b8df468f397614fbd8a191791a0
SHA1 532ceb154513b9f1ffce0a0d8c858dc5e0f20521
SHA512 f493ae9c4303ea0b831365ca72f6f13c409db78f272c21af67a66531a070dc230b2da1c3ca7ca26d48f80ce8cace8274a9fd5c7e0301064816c7de222369c759
SSDEEP 12288:HtYqT2VRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:5TcWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3844	alg.exe
4740	DiagnosticsHub.StandardCollector.Service.exe
2680	fxssvc.exe
456	elevation_service.exe
2792	elevation_service.exe
448	maintenanceservice.exe
2796	msdtc.exe
2900	OSE.EXE
1980	PerceptionSimulationService.exe
1672	perfhost.exe
3616	locator.exe
2256	SensorDataService.exe
1196	snmptrap.exe
2020	spectrum.exe
2212	ssh-agent.exe
2852	TieringEngineService.exe
956	AgentService.exe
940	vds.exe
3284	vssvc.exe
4936	wbengine.exe
2676	WmiApSrv.exe
5228	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\df2396f9c3a5208d.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\msdtc.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008af9c38d0cb6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a40a508c0cb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000147b688e0cb6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1e4298c0cb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d499838d0cb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f52f768c0cb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000016c718c0cb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4740	DiagnosticsHub.StandardCollector.Service.exe
4740	DiagnosticsHub.StandardCollector.Service.exe
4740	DiagnosticsHub.StandardCollector.Service.exe
4740	DiagnosticsHub.StandardCollector.Service.exe
4740	DiagnosticsHub.StandardCollector.Service.exe
4740	DiagnosticsHub.StandardCollector.Service.exe
4740	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	672	10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
Token: SeAuditPrivilege	2680	fxssvc.exe
Token: SeRestorePrivilege	2852	TieringEngineService.exe
Token: SeManageVolumePrivilege	2852	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	956	AgentService.exe
Token: SeBackupPrivilege	3284	vssvc.exe
Token: SeRestorePrivilege	3284	vssvc.exe
Token: SeAuditPrivilege	3284	vssvc.exe
Token: SeBackupPrivilege	4936	wbengine.exe
Token: SeRestorePrivilege	4936	wbengine.exe
Token: SeSecurityPrivilege	4936	wbengine.exe
Token: 33	5228	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe
Token: SeDebugPrivilege	3844	alg.exe
Token: SeDebugPrivilege	3844	alg.exe
Token: SeDebugPrivilege	3844	alg.exe
Token: SeDebugPrivilege	4740	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 5668	5228	SearchIndexer.exe	121
PID 5228 wrote to memory of 5668	5228	SearchIndexer.exe	121
PID 5228 wrote to memory of 5696	5228	SearchIndexer.exe	122
PID 5228 wrote to memory of 5696	5228	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\10428b8df468f397614fbd8a191791a0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:672

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3308

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2792

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:448

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2796

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2900

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1980

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1672

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3616

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2256

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1196

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1060

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2212

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2676

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5668
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4088,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:8
1⤵
PID:5440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
Size 2.3MB
SHA256 899ef2a733d59934b637cc33752ae28523c6ed2ee118f76f75c6b13b097831e8
MD5 aaf25b38c517e0c772cf31850c5e2a10
SHA1 374fbca2e4b009c5dca738acc502e7ff8561c37e
SHA512 fbd587f5ea9c02b77e1c7d7afaffaed3a8aa3a039cbb7c2b5655e4d8d422d0ce6ad5818e66b31e897f90e7f77c80a96902b95d2a10345df412cd0430137c879b
SSDEEP 49152:n5Y3YxoN9iWHMokhQ7c49W/QDxLvsHDG75:5Y3IoN93CQVLvaGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 10b08a0c55a8fbcc7a6b921858e0f89488d9ed6adcf3a6be4ba89b75eb18e738
MD5 b39558bf0c7c215f454dd3387e570e0e
SHA1 0dd85c5fe5a914269296e6fb8adb2b8c84ea7a2f
SHA512 fe6cb0bcebd09edfcbbb6d3e1dcebe65309aa7432a005903922432fd8a470dbccffca59e9cde72bfcb45176791cbfa21ef8ed4616d66e27a45c8713e39ca5f67
SSDEEP 12288:AcQirmNJLBsunEeVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:KiinBsuEkWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 37c4a39afb984c917f48a7b66e347a93de88319f2563eaa2d172bb9995e43f62
MD5 49812236b046f480204da6fffe648cd5
SHA1 214393920014883981c6d8835f9ddbd7455332b3
SHA512 fa35a6740ca864b8ef846889d583953320142d76488998806ab09e203038947c5894b63210e3b046e158296332ef785ca118059d145cb17eafe665167b9c1d18
SSDEEP 24576:8+gkEPfh4CoQWQxpUkCsPJB1iHphIPmE75:5gkEnSqDxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 21b63be5a07a8a87bcc40037afa3bfb236a75ca8266453993c1ff5cdd26ec221
MD5 6fbaec685eb057bf9cff05426dbd5eb8
SHA1 1bdbdb07f807c7b537c733496d6b6aba8a28658c
SHA512 608aeacfcb4fc9b4c5236d57fc0926601705be619418c6a44ff60272c7004606ebf66079c639d6c832246ac235109ba537d332736ead41e2b436bfe3edff6a00
SSDEEP 24576:mBpDRmi78gkPXlyo0GhjrhWQxpUkCsPJB1iHphIPmE75:CNRmi78gkPX4o0Ghj1DxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 17095031d949e2515723afcfd79fe1f95429d8a00d8702833c9f81a7852e194d
MD5 56c2da2317753e74464b9687356bcc3f
SHA1 c31ea71cba2a47780373e115eefdb4dc6769ea4c
SHA512 8deb85107ff21330ad5e9da7b30b0a9eeb1cc9cf32c161ea1101e6e1e763b753d374bbc82e1dbbd9e62ba180acb227ed8dd1072b808e5cb828657e70b858ddcb
SSDEEP 24576:jLOS2oPPIXVQWQxpUkCsPJB1iHphIPmE75:d/P9DxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 bbc78eb29995c5b0a8211c736b715ac721baa75eaecc9e7695ddcd643cc9d8ea
MD5 aa455f3535dff2a013296175a665874c
SHA1 00278b130a6beb5e2fc41536cb61ddeb80c44a2c
SHA512 1131f8a872118965442175bed6c2b8c7a3f2d6bbcb8e6279e380645ada9a327a26172593633a7682d72325bbf99e98b802571296daa1eea5bda4120274871347
SSDEEP 12288:n28VRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:n2KWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 40e57e3ea5beb0db60df7752686b1db4c8e55bfcaf960d9e1784ae63d7a83f0e
MD5 9900b9adb03f508469c972a25317b76a
SHA1 9cb5e34317b6a78382654948e608aca50a27c896
SHA512 c998c937a21749b0ada33ed28ab95a05f808d12affd074e250a7ba5a583de6f0854edf3dcc8654b1455e09a1177bab4362270c12f13b801afae18b36bbbe2eae
SSDEEP 12288:5eBNUbTVO86UPVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:5JIUDWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 17e8f626ce692b95376c8c819b822639473ab05001d3206c01892187f097be07
MD5 2449a3faa8119ae46b908e73f00544c7
SHA1 2bd526004c62b1a3405afa64cdf0c4177b8bb609
SHA512 b5e80015081d2bc5d5b4683574c79f65ec337725e8025a323134a923d6d45d568f5762977389d29492e0834e83d3161fd6abcdd00a33c23fec74a1ecd68dcc58
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THV:VQvGAdlCEL8c/WRNw5CsVLvaGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 23bfaa7a7b4a392877daf8963ab4e42c43dd11f365e51c065dcd85ac12186b9a
MD5 5c4078e3cd5e41923fc008709cb89709
SHA1 5f0e61cd63e330b77a639aba2aeabf2c31b65851
SHA512 61ebd660859de66e5802525573c55dca95ee933374ddccce8efff7d888ef17ea89848802adc34707b88613c75f034b99701ac1c49ac3bdd13379cd2d5f30b5ab
SSDEEP 12288:VAwSfxL/2Dc3oDLLmt0LDQewsAj9VRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzG:2NewsAjpWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 30b50348ad6997176c83868082b955f239db7203b5fe28b81bf814d7b16d5bcd
MD5 47827d72126469598f16ae3f7ee56f5d
SHA1 5b09f94815680c7287c92b73bd04e9c453a3315a
SHA512 e4e500885ed7f63f0fef5da855f2d7eff98cf8cb5db91033aa3027bc6a675c148305dc377e3dfd957c9d835c4577a9b8aa1a9e00f0bfb604c297c4449ef7d38f
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHRVjD:mUEtQevvqc2W1cpV20I32RVjD
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 89ab521819869a711623bab74eb7fe25eb81415eaf550d3631d96644590ec02f
MD5 8972559a81800b85529eba2119e707f4
SHA1 68a740cdcb16aaac3e080b250a2582c6643fc0a6
SHA512 15bb96b9f835e0f60d46278fd349c076666ad42aed7118c161ebaaac09b85c6d311400886e14e4cc38baa4e534ad77b8ce69a97b7e2f6061c55ab9985c6e8a0e
SSDEEP 49152:BCbRquA/m2yL5zifFiV+XenmE3/zJDxLvsHDG75:uoqHVjnmgVLvaGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 766b583ad4e44bd9fc8de5d50aa6d53752600826fcbbe022eff1abf795b7e948
MD5 7e2af6b35f07acb7ecb5e28f78831552
SHA1 d450d095958ec8aa4445747d6f4982d323f0d50b
SHA512 8bed12714d5371990c6a21be02a956cde9f41e07604cb76bd7ba2691719791829bfc4f66fda6351e629f7a7debf371297997697d8103616f60c797508f51aa44
SSDEEP 24576:4AhGL6IFoiwtA5l7S53AWQxpUkCsPJB1iHphIPmE75:4AM5Foiq5wDxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 ae56fda420917cf3b286866bebb1a8f74be4aa1f3b070e90b4989607b791d6ac
MD5 2c19f07259f40c70740936e40529a779
SHA1 e244dedfae31a261554a5345fa9b8862d047db18
SHA512 537a59bed3e3f93115d0a8ad5f54ce0bba5cfe60a5fd681e0724e231de3905e9f8f363c50948bb5caab38ace793fc3ac37904ed0f3bb7475f4f6b89d310f8ef7
SSDEEP 12288:Pmw5HEjsChNWBFgl0WDm+CWVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:uwu/OW9WQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 2f6bab0b5ea719dd35870e08be50364b81f8ec4599e1ccb446b42a181c9c043a
MD5 350e5acad5053fe855c3bae3423c14e1
SHA1 4b8804d0f9ba9d1bcacba74150caa6e185fb0ed9
SHA512 07af9547c63687904f6f0f17c4ea98c2cb2c21c0c9ca06107be2f4bfb036e43334247a13451f24f4e6f894cf7a86fd3ec5b22597742943378f3132beddbfea95
SSDEEP 12288:uIZ1IyNVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:FZu2WQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 d75bfaa410892912ec5b7c565aeef6c042db92d8305a80a3291a165629c5d010
MD5 2e6133d98c46a29c2730e5a80238b0ff
SHA1 9c63248878f36c8f152c680d379d8dc9ab85f4c0
SHA512 69f83dfa0b4c4657ee97b135867c91bcfa2ac2c16e0472c084e5fde8d2c45226e4ac284db810897c598171c324083912575a468b47465fb91ec4963be0c45d2c
SSDEEP 49152:t0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjK7yY7BHi3u7L/gBUUWLl:VwfhY7g/rL+7yYA3awr341gYVLvaGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 7de046e98a3fc9f51d0adb4a1f41469d2287c5fc5274ca18bb940780b5ae2629
MD5 f6c0ef5c35f55ef1008a250e9e23e6c2
SHA1 c4fdd1bd2d33d6699aa2536d0407de4227f338ff
SHA512 0e7c6dae4d63bbda2c6be1f03cf515014c5bc80266cfd1c51733b8c69fccf81c557add70b19b0eb641a11b6fcbf2bee03ea61a98cf7f1794728e64582e32de3d
SSDEEP 49152:z0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjK7yY7BHi3u7L/gBUUWLI:fwfhY7g/rL+7yYA3awr341gVVLvaGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 8088834bffbb7fb18bda9656e9e5fcb5785a0684ec85430df3b8ad628b98a4e9
MD5 dec84ecc2e2ad2ad327c80d5ae4ce1b7
SHA1 e4edfa47cd12a691352fde0e78eb72a338f92d15
SHA512 d3dcedc83b37572f890ab430235deb184eaa71184302fe77712f3a0b0b55b386eb94dc192cc9204a154c450bcab4268c0ae4a61d4b0255f7d08e57c2be4554e6
SSDEEP 24576:2cTyYv0FteQUk5I2kjgD6iQacA9WQxpUkCsPJB1iHphIPmE75:2uXv0Ftpp5606zO9DxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 6d64a821e2f44c7571e9bfe1f0bd7a19e56c6a8f950381d0d0097bfe856151b6
MD5 5d03e2e0ca3a035d8f3d265393fcc082
SHA1 7a7a75be41b2a2c3d88a07a6e7ab146fb8dbf839
SHA512 ba1511f0fa1ffacd7ea234c7eeb34c2075615bbd792144e450b7ddc7de6a94a692ae7a9ef2ace0bf5268dc37b9b60e1737304edfd7278bc05ab22bccfda3a664
SSDEEP 49152:ry7mTd0GxN8jyynzHjXKUyn4GVcbDSKrNTxpDxLvsHDG75:WmYeyzHjWjMTpVLvaGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 9850b275db94dcea5fe901cef162e13f3da37a35a9470ce6910b723d976d45e7
MD5 3839b960b1ee8ca1643b2a88954bee3e
SHA1 836739cb1d891c05dcfdce7f88136aa848566644
SHA512 875e6894d4d67d393b59caaf0f54c4be814e2cba0daca1c4aa97fc23150f700bf87f5dd5393769bff5e3303b63fcb8088f706ff2fb20b789690bf8d470c81f1a
SSDEEP 24576:z6drZn1WEci182IEUINbJeRgUebgW816zWQxpUkCsPJB1iHphIPmE75:zWnDci18cNNUgbYYDxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 ee66bcfeca0d705dc091d8723eb5c27faae0e0f4f7344b646fe9680965071fcf
MD5 898a407cd1b19b685553a77e9a5cb730
SHA1 e6a4e882a40643c36a44235f2e3d0df36b44d9f8
SHA512 997ef42bcbec39b39f309a274d6f36b673485c6e61fadd78ab2a8149a2ab3a7ad6a7cdf825640b25f222255498feed807b77358e2a6de856c4ce6f71cffdc177
SSDEEP 24576:Mk5lHW5EzMZupOM0G2reD+melRgTTv/1nyiWQxpUkCsPJB1iHphIPmE75:yizMZO0GhamSobDxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 01a774400f3f1ab87cb193685e06dce19dd6ab2aff688b863d2e1e3c5a6c6317
MD5 cf262663e1edd29d024f9e004b258558
SHA1 5be502a4ade9630c0f032933f2bb90fdbb92f98f
SHA512 6210be0468f472eca45c423e57e2114a393c87f796af3d5e837500f85888d1caf5d1d4e6f7ab3e008dc7d24d97b482875fc2bbbae6afb14724b70abe2f96a365
SSDEEP 12288:TbVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:TPWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 d410f2ebcbd2def72cbe73fbc0ffcb4cffee399864e3f07b7a083d479b638351
MD5 e9f6d801339d2eb1c8098a34e367d861
SHA1 b8d643f314be324e1590820622a1262b6adda767
SHA512 796289cd64e2476a3846ca0dd426c6784641b037848a9bf82293a34934a36b8f718f90cbd320883e1e8be71706113e5023a5e1adfc4d363c08ecb8fce8047365
SSDEEP 12288:6iVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:6IWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 734abdb64555eea70a0b99531cb2b3f28b76f19e9861881c56d01209b08c84b8
MD5 4cb2a6ceca67de574c6d72cc91818501
SHA1 3f1fe81019e91c54f993ad4cdf13bbd71969a375
SHA512 a6be77cc9a503d31d5f59094da1bd849db3a5770e11b2a33302634ef7c3b2c65c64c13da1f394469e44e2a334160bcd5d4460a00db917bfd21cfc9e10b60e7be
SSDEEP 12288:mYVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:mmWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 c09c3ea927fc4bcd6ddb17312051d10650bb951d49be6c43b6a6e1fedbf12a5a
MD5 05dc21c7d0e2229ee8f1e551112f3e94
SHA1 293f96ee0950a66ef5fac3aa70c090346b4963e7
SHA512 b97228fa0db34867299a1e15897798153fb6678f3faa558ad69438944175f3087e61973c24cfbd6e0be227c87f8b90883bbd7973189f66ddaa96df30833186a2
SSDEEP 12288:jVxVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:zWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 c1b3c0b068bf5cb55b7635722fa3fd943927678803920c876a41562e998db03d
MD5 37a6162b1c8d207984383613da73eafa
SHA1 ea9d3fb1da18d14dbe3f728563677d9dcafc5940
SHA512 e13a66af39b99e70b0a9ff3aef8e3914f523b64bc993f0d3ca991290224e2207dc2dc9d5bf217ba5539f19efb0a110a76bbbc75df76d0bf4f3ad2c09ee60a5e7
SSDEEP 12288:KJVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:KlWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 4592e08070e8d36a5f6fca9acff7b5ba8d631febe7d02658655b2f4a3036a261
MD5 1dedc2a36ee8a2319742caed98dcb95f
SHA1 317bdf7c06d716bef11507fb0870ee9ce8460a41
SHA512 00eb1e98c294069d2f7479fb5227f0522fa10845470ab082ab892bd9ab191e73f6d8aba91da04f0428e069699b301942550602e91836623b84a70d3adf5cafbc
SSDEEP 12288:JmVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:JMWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 a281c27d8276fd1f4f7e8d69cc00d48bd70a0c1892c83a60f89431bbe9b0e7c1
MD5 d8aa7de4c123a99e9da63f9b6c2775f6
SHA1 d831e694883387da60523b9071618cc9e2e1edf7
SHA512 fa77eb444a43de20a8da72252c6433842cb999ef07183a6e3cdfe71e87b7a7fc2c9db5eaa1535dfa1418b4e98d7a76aadba0cd47a4d82030c8fd9afc9a6d3431
SSDEEP 12288:baVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:bAWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 1237060e29b2186a8ed8580e90691dafbd575894b00983a124bd27f9b3455604
MD5 f7820ff3e433435eeff55ba37e11b36e
SHA1 bc026fbe82fd77f3a6b762e087d5658d87be313c
SHA512 ba8c35d7a576dc0c731dde4ea74170abfb709ed2cbb1e06aba102f301fcb67dd2c6e5ee4eb99a14500aa14135ea45e84a9d60ee84576bf04a8fcc81d32651dbf
SSDEEP 24576:/ZM9zFVSOoWQxpUkCsPJB1iHphIPmE75:/ZM9zf8DxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 14125d9d62cede76087b29f449232f13c44d6de632c10582183cc6286021b202
MD5 2fbc2e20b4cab3d24fbf39ba8f2cfc6a
SHA1 47db85f9fda4cf65903b99cde2e628de5f67931b
SHA512 b62dc16281ce9f85f635dfed5014b2a2cdad7b763c544a92a943e99f5b02049369e03eb79b18d295ef42dda046859604b206abd0b3e1553e2d936a18a055d1bc
SSDEEP 12288:bXVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:bLWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 01892c7660cdc2443849978e6ea888876eeb3bae498b86bb5fd0025cb23a07c7
MD5 a6fb5cfe14937925df902b7f08bef876
SHA1 a3256673c0454d361e47bacfc29c44079ad633cb
SHA512 7e72336c7d0646c3459e08dd4d128ea6227f7128e9f8c169f506f381c65e43797776400adab0ced3a5d06d586ef7d721ed68d5158f75d7c640ce51009b923742
SSDEEP 12288:5DVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:5XWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 b9dbf6f614d7d151c3bb0619f9224900175bc2f9f2db3042d9ee0bef61875e6d
MD5 ed923b63962e32c61ebf045c80646656
SHA1 9abe9a42796a562916b1d18d0b96532a99c3ec37
SHA512 181b9984aee8174808c70ca7f8528809911970c72f21f2736fa723151754d4aa08f1c0b437452388bf0ad390a70751822a5ea1f31d21aa4e6e96fbcb30307bf7
SSDEEP 12288:4yPz5L8OVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:ZzyUWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 fa9166d7deec94c2b71f9ace5d8e23efd1c2acdcb39ea3653a42336617970e64
MD5 477918e4db99213809826862496ded01
SHA1 a5ad24c71b9333e4726f19ddf7ed2cf44d4f0da7
SHA512 3b6b330f10bc58a740e0c7be521899282ebc93f4c0fee1901ac6382fc0f71fb8aae9bcb043ee9e668628b50f7dc24dd04d774952b1d5e85b3f63359c199682bd
SSDEEP 12288:oXVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:oLWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 6a9f7243f5a12f0ea0167d6287491c9574213b00c8fb81fa56a68650ecc29789
MD5 ccf09cbbb0a479dfbc8673494fa80f38
SHA1 4b6f8e9cdff4e790bc8bf0b6ed92fd3b4b508131
SHA512 24fb3a45f6b6eb114fe35cc59588e33d99ffc347c7ec75d7b8a730625dd966730802aeed9bcf877cb94086fa52ab6f79976da32298a526f6c95d1ce904320e36
SSDEEP 12288:zXVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:zLWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 f4b53f9cae8deb76b3c16672c5efd7a62db45d13a70004d0c8287e2dda427fea
MD5 3453f59f237a595f3ca2e7e45817bd73
SHA1 3094aabde10ac12919653aa3bd33bebc3a5e4d61
SHA512 2fcebd750ea8deddcd8d9493e8a2575c5820f9c38090d2aa54596f75d430f3d5eef2def01ac04cb9f9828c53e23e95206c0031a8c7d8a1f0c5485af3a41d42c9
SSDEEP 12288:/yPz5L8OVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:yzyUWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 9595868261d259c4fc815b832ac04893ba95c03fec7e97223af1340311c4f0de
MD5 d6e37bd122d16f1bd77f6c6762c48c8d
SHA1 c309b5213f0c6a199e55f251efe1dd45c6cc2668
SHA512 79dd9af4c73d8d54ae4e9791bbd9aef009444e72fcf2dadd1d0d0ae12fc6c91a77d2009679eaec202bf12e4d8b31c1a3521e927ed4d3a38e7289666832ab29e8
SSDEEP 24576:tTqaLl3z0zD2WQxpUkCsPJB1iHphIPmE75:tTxLljhDxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 30bfe64bb695bbdfe9e271ab264fe297624ed535bd62168ee1c837bde2aa7167
MD5 2db9d9b3e10510cd52f1cc24dc3f47fc
SHA1 28366f3ecf38d84229dbe6a8de6c334ef95c3b5f
SHA512 cc345ddf9f48400b0902fc6bda08eecb98b957ba47f5b8a5f3dc7bf3a9bb12948d84453a702348c6838e534b7d83cdb972adab68a949d701240346d2cc814c4d
SSDEEP 24576:83Bd9CHKy7GZ6WQxpUkCsPJB1iHphIPmE75:mBd9CHKya8DxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 e5fede0e179628a92bccddffd2f9522886e95ea853b766f6ec8ae60e8dd0c5c9
MD5 a7b46b09346d639e4b08e20313972c17
SHA1 351bb6dc543cc27e88e146b8ae8dce5e46d8a9fb
SHA512 7032f66fb9db1fd12c4ebc629f2bfda41edcd6adbd219ac16781af2bf8fcffbce0a355ef2135a5d9728dad52d4970d50192c7c4172d928f1ecf22f5953492e70
SSDEEP 24576:RcP4mcvIjkGOxhKP2l71SNKbrh/8KBOWQxpUkCsPJB1iHphIPmE75:GP4m4IpOO67N8KsDxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 75045af421ae8a2ad1e1092cea6fdc300890591407104615c19fcc4c452f31b4
MD5 518d5591181f72dea1095fc68bee6751
SHA1 37dbe759da18c7c45a9d96cdfa359f29df80c4a5
SHA512 8c61d847eeaeb872f4ee1d80e64fe9ac04e82f346c812c5a9be92cbc22efda89d72c5f540694678067b028bad5c92f088aed7787c3bd7b95f5e84d6b9359f5a4
SSDEEP 12288:rUFmDDLzVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:jHWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 f9953bed8b28c5d0591e2adc582ef8a1eba3135d4656391b297f1f5cbb43d69a
MD5 7e15872ac68352726ce68f4f7e6564c2
SHA1 c9c1ea48f7966cac6c7349b567a2384ed611f20a
SHA512 e0a8304658351ecf0dab841435670dd01695c2a583e9bb81353b6167144c6fc709680c9846fbe5851512bc2e099a7e25b4e59a06a2ba568f8624a45e1168167f
SSDEEP 12288:zIVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:zWWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 82324f3437747660ff72b0efb4e8e619f52e64169a199d3e1975cc15bdedfa8a
MD5 dfd31b2e6892c544564f09f2de13bf1c
SHA1 e7265dd3fba9d031b3070bb88161dab7edcc1447
SHA512 c2c94c68fc80ff20c657fa64e14965891236fbb462ffd7a946ff0e6d55bcbfde6e3b65fb2f2d40ed930a1948794b4f8e8d0550490d28b3b41f9c21672bc58ea3
SSDEEP 49152:ia0h2GEkuAe73q3pp46zwwQIDxLvsHDG75:ia0hNYG4JwRVLvaGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 93f1fb79b265a05a62c447f4262fa5f4e62b83c71cefb53a970422ba48897644
MD5 75a81b6709716784bd5d5fdf1c4bd983
SHA1 261fd9cfbf6cfdbdf1e543fe3c10c595a93d4132
SHA512 55edc8948364d6686529f9e7c231b93c3a22f51192ddb6341a3334e163646fd8036f86d8b361730ff2ab78dd2b504ba8472802541f8816450818d696f7088fbe
SSDEEP 12288:khbHjfX5VRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:khbHjPVWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8a3878352a53d99dce1f54be17fba58ca00277acbc8d83723f6432a926e2a25e
MD5 acc6f8822fae50f4c44445dd683c6eeb
SHA1 7588ae08b825293ed0a1874a3c032d2520c6d670
SHA512 8f1884a829c850e2ef432021c9491c30aded3b8e15e607be39d5ab95e8c2b2c0f1c120ee47d17135e2bc55c8ace60c81f7545763d6a6c8b5438a6f567a47bd45
SSDEEP 24576:U3YgnJcRTk4yti+R5dpR/9WQxpUkCsPJB1iHphIPmE75:UIgnaTk46ppR/9DxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 6962876c872f35e6c4db2aa337f1142c9c5d2b2231b8d4d96aafc752c34450fa
MD5 23379a0b9b0f08983c5f0a20b2e717a5
SHA1 66b405f13f6a255083fc67607ba2c3e47022b665
SHA512 52c966c2a34ed7868bc0f9b14214830aa3a254ba6c125529a4fde42bdfe1f72d47127a7b52b2f1ff8a021141a8f1d71e9f044cbfce280791e4e259f960bd381d
SSDEEP 12288:rcVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:rqWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3686995f76610618d0282ab5055b20734faed6028682fcff0114f2e96ce28a60
MD5 00000ebdee4430a67d067ef8afd4acbe
SHA1 f38a53eb7b58bfe2e744c4a620f6704a05085a4e
SHA512 71525c85c8709c4b20c8bf487287557fe105b601e51057ebea3afa5f8ae1a4390bc36d34fe0066f33f6bfff6c379612ace63185935cbb96c07015a1238d84a1b
SSDEEP 12288:QObeA4LWOsvAYFTrVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:NuL3UTfWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f2fce36c5790910681e1e26bbbbafc440eefd699aeb0a4f91e6f262970e73337
MD5 6656673832510ecb947440f4420d7619
SHA1 f70741246ffb7d524ba19698563d41a5873dac58
SHA512 eddba579802cb4cb1ef62b61ce5341f1332acae57f08fbaae055a7f94164843078151dfef4976bb2e009e2704eba63fcd044755410295ddb2ab9332adce48560
SSDEEP 12288:VpFtBOvVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:1OjWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1d61786b1f77518e34abfabfdf4e6d343eff27f621ed92b355450471aa8dfdd8
MD5 a233cbbf1d908faa6f5aa65e486b139d
SHA1 64975c28cb3364877a5c0496c4c6ddde35774eb8
SHA512 6ded838b69bd504218b56c05ba2568c1b1d7a94c03d08166a4674afd3ab32628f6a009d207493fb7057463fac6d16098ea3a563774cdb2341153f1f574af8cdb
SSDEEP 24576:v7NM9YmZqmWMUkPjZM48Mv6bEhsGWQxpUkCsPJB1iHphIPmE75:v7cBWMpPjN8DbEh1DxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 6b896c702d2894ba1d2c08e541d0ab2ceee6f288710745d3a3cbfeb2beb34af6
MD5 a4f9aad76eeda186c29282d646faeb40
SHA1 5093a3b49560d574e5fefce9000d3d79286379f7
SHA512 a624a5cc01f6451a731a3e7342cf3efa422de2d00db53bd6424fc044df1c4c6abe69d3400d5721231f2243baab0501be9141f7ebaee76d5ebfbfd03380979286
SSDEEP 24576:WW6BApg2YuyuNDYTabvcRvNYf8km1EWQxpUkCsPJB1iHphIPmE75:WF2YuHNETovcvNYf8kmmDxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 779936edc13f5fa072d550bd294eae32ef61d0d301aec3f11672c031bb202414
MD5 0349a30052c073ded9353f429e016080
SHA1 ab81fc95a1869dc125671ba12e15485eca2fc852
SHA512 e39f24d3551f70e7c31fedb4c5ef7e822fccd459be4e335f6378ebd4faa28aab67c22edff7d6002e03409b903b8c6caeaf0c47c2e9a6af3ab606755bad9820fb
SSDEEP 24576:SAFs06+Omlf8NXEbToXWQxpUkCsPJB1iHphIPmE75:LFs060loXuoDxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 41d51c3c58bfdd3c3dc1e0e89988165468f734419b268e2750af975594c829ff
MD5 bc097f4e36c9dca8f00be1cd396da43c
SHA1 8f3eca2771249cb01194f3b95e72ef7214aa7d81
SHA512 faf3c77d8acf1cbbbd63c8222eabab63211b5922f22fe6e6ea55d66046ae628893e565630f22526e6c484c2821acb3ba62f01b8039bd12f66d564ee26b8e6c04
SSDEEP 24576:GJnJ5D3WLoWQxpUkCsPJB1iHphIPmE75:GJnJ5DGLoDxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 29275801300a47bebfcfdef5f5f658a5be7d885e8ef66c08e299187ceedfa16d
MD5 5347b097eb9fe8fba60da44d677882ed
SHA1 ce90b82c7dd4910e7b118c76adcf0064620751ba
SHA512 4c4081669d3700c10e901c5727fd2f9b78445e5944afdaa90bac4677f6464b594c7c9bbe44b775f317c1fcd519051363e800dbe7739cc21110e999cc0a107fd1
SSDEEP 24576:kEPohm6/7IIXdwcXrif7qQncjlP65i3Vu9WQxpUkCsPJB1iHphIPmE75:ro06DIKdwc+eQnSt65aViDxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 b2fa63342db30ad7cd7b1e405de837462c173113c0477987fd5be182ac2bd748
MD5 d54335055d7f96b0e87c54c023483ab0
SHA1 202d3f2854b676bdec90bd977d059bc5aeca8a63
SHA512 dce047d626b60859d52dcfb47c4791d1cdb84891380e19b8468fe3df411c8ce178c94bfbbddb2679c1ad917df7702d9dbee48dc4fdf3258d4d969ca96c3285ff
SSDEEP 12288:YEP3RBWVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:zB8WQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 62ba98cfad0ee38fc90cccb32558d78d29c823432db7ba93e967f403359ccb7c
MD5 2843ab4e5aa17670877c77ff5c4dd669
SHA1 e8c1090e369a26458dbfc1cb50598cc30c8f6a65
SHA512 8ef099e604810861504a0a4fa77994cddbb08c3d21bd6e20dab3a7da83292241a426af013296b6c652bc8fbc5cbcb40a915975eed0030284d1982cd0820ff033
SSDEEP 12288:+jkyJVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:+IylWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 6e789b0f1c1790c0300d6df89970d1596614b006d6ec345c8aec7aaf5481cf24
MD5 e70c39b47818d83b18337c1a84bb35d1
SHA1 ea89b6ae6159c0888b0e754f28521cb95831f4e5
SHA512 8674cd655e479e7161639f5d1f55b2096061392facd87f3fc29ed335839d4df24d2519284c050bfd5dc4377283693c4320e7afcfca582c7782bb6ef802179cdf
SSDEEP 12288:jTr/VRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:jvzWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5f0761d55a1e44dc2800919da70fe4d81a5caca44d8d3f430d17a187e9ac0ae2
MD5 c32857dc46c32c329261c4e7f256fd8d
SHA1 533b30762bd1a8e4b8dfc5db4c657310b394cc42
SHA512 987ff28e72a2da06bad56fe6b57fbfa225be5e849e18fdbd82182f69a7d198b96c1d32a487e29b81cdd0766b82d2aa802ebd73806071d0e07a2be249fb421456
SSDEEP 24576:yQ9MxZKdcz97w3+WQxpUkCsPJB1iHphIPmE75:yVKX+DxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 72e10e12d5aed87373262c959539de5ad1c76af03fbea7d542483843f26ab58b
MD5 d947044301722960b77afbce2f15256f
SHA1 57ee79748681926a4a4299356870aa69b0da87b8
SHA512 5d820605d47e8db3e5472cd2fcb12541373a442ab5c95d2cd7a755424929019ef0e91de6b78aa587016acaa51999d89478cbcfcb53059ab2cb3f986b65ada22b
SSDEEP 12288:/yoKo2hRple9p9VRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:/yocbAppWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 97008fc62a29b874212e13145113b10092ecc04850335c74d8e15f6ffb8675cc
MD5 d5b3c2609cd8b533f7feafa5c66e1780
SHA1 e05d033c45bf3c6738a701cf560e883d2d9b5ea5
SHA512 fc08df34b60a6bfb8bd71c75fac49ca2ead6598668d64dd6c36285e4d46177f44e57df8915d519ff228c022257b62da59d9855c736483a4420535ae8e0337b82
SSDEEP 49152:tWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKpDxLvsHDG75:N0zuNINVLvaGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4bc1f8c6f681a1094170b8e58d5933cf2ee57d9a59525bcfd41f3ce55767a350
MD5 802e79a51b64329a73edcac076741a42
SHA1 5a42960483e940b368a795c7c0e2c8551c5750bf
SHA512 34232bba64c3694e95974e1c4c945a2eef23b83b2596720afdcdddbd641cd017249dee101578c96e4f4459a33ed71565d3db8cfaf5ed7928bb863fcdf3a6d1db
SSDEEP 24576:S1QT7EcpfxR+N5AWAz3ooiYzjMqb8WQxpUkCsPJB1iHphIPmE75:PTDxR+N5YzTBjMDDxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 19c5b1c01d40fbe0b6f5f69b8c624a583a24c2757706d536001074ee9942c25d
MD5 536dda74c1f893d6001e7103f168a654
SHA1 f6a34bfc209664401c89b421e24b94dd21110a69
SHA512 e83bab7f85831ab6f964dc90615beffc16f2358c9b40cf489795bdfd80668f9cac84e0fbad610d2f0487bf3981f35c38b24cd2489f3a99163bf653a61742ce4a
SSDEEP 24576:ATMdOz0FFS+ymSLgWQxpUkCsPJB1iHphIPmE75:o0K+ymSLgDxLvsHDG75
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 d8c212172d9d3b209e9594fec61a388b18b0ee5991e2a45722dee0eda00918f8
MD5 5348ba928dec710b52d51010a6ed6724
SHA1 24d718ad4b122af8266aac2af4dc3119450e3c1f
SHA512 10cf314330937a2281bbbcc9397c6a4e26958f2b0129ee613b34c6e6819ed315918bd5cd5cafd06f4fc251ce2be7da2b6c4bfac50b9b3cb50ff14471b87f72d2
SSDEEP 12288:74prVRWuZxpUkCuPPJh0i1iGO9T0xmh56PmPMvzLFs:8fWQxpUkCsPJB1iHphIPmE75
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/448-74-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/448-80-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/448-83-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/448-85-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/448-73-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/456-54-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/456-56-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/456-48-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/456-179-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/672-88-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/672-1-0x00000000020A0000-0x0000000002107000-memory.dmp

Download

memory/672-8-0x00000000020A0000-0x0000000002107000-memory.dmp

Download

memory/672-0-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/940-570-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/940-230-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/956-218-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1196-168-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1196-563-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1672-435-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1672-127-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1980-124-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/1980-276-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2020-180-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2020-564-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2212-193-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/2212-565-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/2256-500-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2256-156-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2676-572-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2676-277-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2680-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2680-44-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2680-38-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2680-59-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2680-57-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2792-70-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/2792-192-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/2792-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2792-68-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2796-90-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2796-228-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2796-89-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2852-566-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/2852-204-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/2900-251-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2900-112-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3284-252-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3284-567-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3616-145-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3616-518-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3844-15-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3844-123-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3844-19-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3844-12-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4740-35-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4740-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4740-34-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4936-263-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4936-571-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5228-573-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5228-278-0x0000000140000000-0x0000000140179000-memory.dmp

Download