60a4b23afc341e0d56e4e676adf10de8cec1396d5d8713975de1daa67bb629dd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
Size 6.8MB
Sample240603-mmmscscg35
SHA256 60a4b23afc341e0d56e4e676adf10de8cec1396d5d8713975de1daa67bb629dd
MD5 a041d03249c4296381966d818cd763b0
SHA1 b9cca2a5cb24502aacce7b84f9cbac205205084a
SHA512 2c0ef8f1d1bd767126fd68f0ac9afa75c72d3387ce6e8d17d50227f5737074aaa5a04ff5110be50b6d45f1dc443322a22a7be5eb63c8538b226c283f4d9eceae
SSDEEP 49152:j/vpiZoXXxWEjTdtriSS9gh0A6UzQYOUlYDG7aYUTukkAG624a8EUKucqyrwULLe:zMIc6EUkYvUTuf0247Ku0LLUtq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1124	alg.exe
876	DiagnosticsHub.StandardCollector.Service.exe
1416	fxssvc.exe
2540	elevation_service.exe
3260	elevation_service.exe
4628	maintenanceservice.exe
812	msdtc.exe
3480	OSE.EXE
1316	PerceptionSimulationService.exe
1612	perfhost.exe
400	locator.exe
1320	SensorDataService.exe
4300	snmptrap.exe
2536	spectrum.exe
1264	ssh-agent.exe
4480	TieringEngineService.exe
4016	AgentService.exe
5096	vds.exe
2184	vssvc.exe
1948	wbengine.exe
1376	WmiApSrv.exe
4536	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9714880bc3136770.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\BlockGroup.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000664609b9a1b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0e225b9a1b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024e406b9a1b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001578ddb9a1b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f575ab9a1b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
Token: SeAuditPrivilege	1416	fxssvc.exe
Token: SeRestorePrivilege	4480	TieringEngineService.exe
Token: SeManageVolumePrivilege	4480	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4016	AgentService.exe
Token: SeBackupPrivilege	2184	vssvc.exe
Token: SeRestorePrivilege	2184	vssvc.exe
Token: SeAuditPrivilege	2184	vssvc.exe
Token: SeBackupPrivilege	1948	wbengine.exe
Token: SeRestorePrivilege	1948	wbengine.exe
Token: SeSecurityPrivilege	1948	wbengine.exe
Token: 33	4536	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4536	SearchIndexer.exe
Token: SeDebugPrivilege	1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1848	a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1124	alg.exe
Token: SeDebugPrivilege	1124	alg.exe
Token: SeDebugPrivilege	1124	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 1380	4536	SearchIndexer.exe	111
PID 4536 wrote to memory of 1380	4536	SearchIndexer.exe	111
PID 4536 wrote to memory of 4312	4536	SearchIndexer.exe	112
PID 4536 wrote to memory of 4312	4536	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a041d03249c4296381966d818cd763b0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3856

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3260

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:812

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3480

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1612

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:400

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1320

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4300

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2536

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4440

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1376

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1380
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 7fa5cab86352add3beb0397584095ddd880b334044e752f9f28345a6ab6748c0
MD5 9bb3135b30860a292db3059e7319222b
SHA1 d6139ee3bab5f777cf4f6b7b97c3b37c31d60359
SHA512 ea395b5d6f2f7f2c27a4667df1ac27dbb71318dbeb167ae0e932855e47a788c8a690cf863be970d873ee9e69573e98f2e3b635cf53fa32be4574cfb68b48e390
SSDEEP 49152:DuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5zUpLei7dGy:DPfTqi90bXUtq
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 6946dd2e2a5b65e0ee67e94a9ca2a88597bb8819a70b9a370ac1789afd606505
MD5 fa9d34b8177537922dfd475bbab180c2
SHA1 1bc0f70b3c9e1e6d745135e7f121ef0f4ed71d45
SHA512 ad51af5b0e8275e865312e0a39f60c74b85223d0a3975d26164cb79e1f3f9ed9940d5717a8b55812084afa03ef7f7c4af5fa6755c42be807cddbeb3d912e1cd6
SSDEEP 12288:pcQiQmNJLBsunE9eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:pidnBsuE9et/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 13980b051a1eb51e09fdf7ce06c10c74946342b3a44892953cc71e16fcc4fbe9
MD5 02cf0b9e549d831eda97ce1adfeb2546
SHA1 4072d0e55dad3cee42afbca944bf231f5f79f233
SHA512 dc6b2b82908d2c11c3cfb1f3b6c165cf09b854ea8a5f9f2076bc38a4cdff1eb24a0c0cc6acadf2ab48a2e1666ad116b862ce358ed40cb860ae73ac3cfd39267e
SSDEEP 24576:9+gkEVfh4CoRet/HU9zPjeidP1Yi/dGyA:kgkExSKUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 727f1dfd50c0bf3e3e1b9b1802e413a1438eb297d4c1e6589fd2acd6eb8c53e7
MD5 de94697eace35a124eeb66a95c3e8637
SHA1 73f28f023dc9db64867b3929089d9f23d15c16f9
SHA512 7da70a9c41b6fd356955c16f2244de19bf938718f6e3fafecc948d2cdaa7e1d22e203d66e3149f50a33e9e8486a79e8e8e20e9ce5372ac85629ebeba04a98c70
SSDEEP 24576:yBpDRmi78gkPXlyo0GxjrSet/HU9zPjeidP1Yi/dGyA:GNRmi78gkPX4o0GxjTUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9cece6c6a8ad1dd61869fbfa8fd3902573428e4e97fcce4213654f499f2b671a
MD5 56938b1e51fbdcf9313747db926ceb95
SHA1 bd16384c47f331c93530dbbc04176949539c5e08
SHA512 fd0f53b48e326a6fefb42b3d8976905b4bc79445255e66de24cf8d0e2482ebdfba759378ee5676a9eed8d3000d5ab2a37adada95b825ba26fa1b6a7537b2f1e4
SSDEEP 24576:JLOS2oyPIXVRet/HU9zPjeidP1Yi/dGyA:T/yrUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 7814f541a0c9009a457e7db0f8a41768eca445e64f2c95603236f5379674f335
MD5 32e9ea6c69e4b31b20acdfb6912d5417
SHA1 90b426763487df0abbd6f0edb60f1f906c6eab15
SHA512 110f38087d2cd10e4d5d57d0bcd7e2fb003afbd9b18e64d3eb3ec3df5107fffa663a4e16735a3cd9305bc3b41d8355fb07f6ad682b3756e165c977993fbeb345
SSDEEP 12288:FfjeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:Ffjet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 04ac006a22699efc9ea902beeb4ffcc27235204badc1968a05d4d1294ca5bbdc
MD5 991c5d2e7da6fff95e031fda9e66f82e
SHA1 432d700d198c299396ca4d05148792c92c91be0e
SHA512 531af01af1a67f4ad1901c81e73a5a088750e19eeb9fd875b233f636949dfb1f5c2b8e8ac0e91579c171f7cf618b3d65f2c7a2610ccf8c061a93b886ac75a0b4
SSDEEP 12288:SeBNUbTVO86U8eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:SJIU8et/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3290f218323c5f2acc318d59b20719cb05ec38edeb681d801dc045b1c495195e
MD5 2ccd7969634ba24e543ba73216abed51
SHA1 d5d0c7d3284f13cbc139cbcf04e0072be3c21ecc
SHA512 56a8b3e456da2a7a66e6615d7a35609c3c773ad46e2c0b31c327110dcbdbdd46aec79f24e030f6cd4c10b3f23eb9f3f21c128c893faaae60db634713ddb1845a
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THo:TQvGAdlCEL8c/yRNw5C4Utq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e48b38f3d509020dfda49962ed08b92c7a224ba4ebbc9d31d42e39d5dcac722e
MD5 1c166b6b613865bf1679a340cfbbbe63
SHA1 bbb0973d61628383dc3aa25d91104f64e9e47cb2
SHA512 7190cf2b7c33f257e079b49c77581c73d2686dcc863a26d3d48aeaf398971d532e059638881d6825897472a0c74703b93f522406ba0a3f26ad7c60262b9e36ca
SSDEEP 12288:dAwSfxL/2Dc34DLLmt0LDQewsAjqeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVU:OdewsAjqet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7c56e95f1c7a3521234a0cab739c17cafe6688c954e51d7205239d7ce5a06e08
MD5 6988152b3138b30e223e5e7fbfe7c682
SHA1 5c17ecda711552d28cb186d6957776ae7cb051da
SHA512 145460d6c22570d19c853f4ab4ab045dec562240dc57f79f251bbea428c420045b7313afa124b582f148416e6b71c16d0f6ae6ecd402cb6cc271d41e6e206bdf
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHPUtq:4UEtQevvqc2W1cpV2EI32PUtq
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d102efb131543a8cd38baebc1ff84a7e0b6d4d0d1cbee4ba1036d4c63f45691d
MD5 088c71aa88b6ca88bcfc09bf2f080941
SHA1 6e6d2b21b70f169666f3f6a8868184d4fcfa884c
SHA512 1a9b993363d049bd4ff935253f84d4652326164d164c68eec533641f73e0334a727f55e9efd569e320ec31448c75c2b2b221d81ad91975f75023a6781652f7c2
SSDEEP 49152:hCbRquA/m2yL5zifFiV+XenmE3/z3UpLei7dGy:OoqHVjnmcUtq
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1353a4564e4ea7d549e1569feeddc70c18fedabd26b7796e7ed37b03082999f8
MD5 1fd58b3e2eb287cb43a467bf21218977
SHA1 fec79750b4e47cf29411654bd570bd1262f51f54
SHA512 e4f8a332a47e20af8aa58a120c126d2ed769365dbb948e92dea8de79cdd76b66ae61922f91dcb33432ac1fe943d2a3aedf967d3a92f78cfa5c7b843055066d2c
SSDEEP 24576:kAhGLJIFoiwtA5l7S53Bet/HU9zPjeidP1Yi/dGyA:kAMyFoiq5sUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 275590783e6588cfc65871ab3f2f8ad5ae0d9476209925be86e451d4c91d1251
MD5 a68b11d36eae23b34e77006559bdf357
SHA1 5abe2e9b1823b4c30297814d5d34aedfa7bb700d
SHA512 3c2c581ed4ca25872477f74bcdb26e7f767531edea0e78a7b82466f0b80a43bb12b95de55abfb58b25347954e17d41016ee1f5de38fff64b98749a07900bed81
SSDEEP 12288:1mw5HEjsChNVBFgl0WDm+CleSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX1w:wwuoOW2et/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 8af92d3ec88f48ef78fc0b47523092adf42a7e629cd5431b264283b0aa505919
MD5 249dd459e0f5c7db15d8d983f08c1328
SHA1 4df6661b89c841ed49a6b5de6fa74ea6966bf56d
SHA512 bc7bb27379f2f02fc72391d367b245aff428bc802a66c02f075671d6cff60c2aa5844f6ca553f942299a3a3add832dd5bee12a023d1e42fbd061f8e05dd85ce8
SSDEEP 12288:uBZ1Iy6eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:oZu3et/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 83ef457bbd8a0fc171534f12730387d4cdaa15c4429c781423d3eba4bf5f094c
MD5 ca49568d03ddcad9b0889a18e4811e1a
SHA1 c80bc1b04445a3042502f7dd1d5074d83ce87208
SHA512 71921666e237a9f3c116ade9193d818b0eebf6a6570f2f6448ebcce0d1e02ef77198e13c75729e716f9cb9f92ea60cfd05e04b320071111fad2fccd0d91a1c85
SSDEEP 49152:Q0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWL4:WwfhY7g/rLd7yYA3awr341gkUtq
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 5eac76c635fa0e7f0ae46eb92e2af18f527e88be4cc3786ff3e44982a5d34b7e
MD5 f868338c75d22a2c538972f34370a9e6
SHA1 b4f204cabe56acb4d5ca2915f53f731400e7178e
SHA512 8e16c7cfa36f421d58158c239e58ad670bc699da7d04bd81c0a10d928e488f79761ec2bd158bfcf5384aa02f062762ab913a4c4997b12ca21bbb2eb86cb926d1
SSDEEP 49152:X0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWL4:bwfhY7g/rLd7yYA3awr341gkUtq
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 57469e0206b162c3a6830c659420175f1dabfb674dc69779602e8c5ee5a991e4
MD5 da061a9c8003cd1aeca647a81ae0e41c
SHA1 18576d7317cd176858e0f313e1b937ce0e9dcc68
SHA512 08d45c1c7402bfb56864bdd224becf554c4cbb2a95b49b671146c8ae05a176af4c65e327a45a05d18a48e86359e639e173ed5a45cb4f8acb5cac838aa6cd713d
SSDEEP 24576:icTyYv0FteQU+5I2kjgD6iQacA2et/HU9zPjeidP1Yi/dGyA:iuXv0Ftpn5606zOrUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 6b19d3b01baf0a5125a5cf39ab65e364143e3e05ff6b80b2bae31969d864415c
MD5 86f2a2aa6ec907b96499df952678147c
SHA1 08851d09717accd208f417a707d7b91fd3d1c2fd
SHA512 ef2dabebd1d716353b229eddfae83f4fd820cf88b9b4bd32fcbb214a355866782a83c02958042424292bff9466e986ad9bf15d7232ab1c1635817042d186a184
SSDEEP 49152:8y7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxXUpLei7dGy:bmYeyxHjWjMTXUtq
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 d78fc20f81f51b4ce90b8ad9464520ed7e9f724385fcdc9b1c0d4d0654872acf
MD5 0c298ca5ccec8bcdbda3a94b7654f484
SHA1 d51a105a4e91d28c5d9314617c6bce463c6727ff
SHA512 e163d6e5d59e811924a87256a703efd4f5fe9f359fdf52fc91a5da574cf8fde0d1d6a9d371b77d57ef941dbe3b3f833a70cfb010ba37e1c9183ce725cbc3dc80
SSDEEP 24576:U6drZn1WEci182IEUeNbJeRgUebgW816vet/HU9zPjeidP1Yi/dGyA:UWnDci18yNNUgbYzUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 10942c4e371f8ae03e33b7047470d44a04723b9c03d5a8efd1749f894e5e9d51
MD5 b993d6116a3dd22c8d3346ed71afa55f
SHA1 89b00dd33b9db3ec19714e46e6d5d32e20c1f742
SHA512 8bdbb918b78af56251536bd43a49a015243973bdef529923b53f402e9918d69e2a00753db9c93d113a0bacce17b311287c0621cbba05bdfa222437fbabfea901
SSDEEP 24576:yk5lHW5EzMZupO80G2reD+melRgTTv/1nywet/HU9zPjeidP1Yi/dGyA:cizMZm0GhamSomUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 41a3bb8a143d1d92b5d91adfccb54f63e6643de182cdd3ce2952202f61da8267
MD5 a56e1d3f2752e498f1bc1c3664c66039
SHA1 bb6498ab62316b7a0faa8b41493843814c9eb529
SHA512 399aeb82f8a90112656c867284d689d74ca925a95effb04a03c35e60cad1c29a15259f7bf130584384c2ea7f4f78d1c580f6de9f89585fb8bf9aa12ab0fdd065
SSDEEP 12288:1reSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:1ret/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8b132038b414f89bfbb3ccca0551dec5430d08969c41c00cdc503bd9dece8817
MD5 a003d79f23d19a88289b3856a5daaa28
SHA1 70aadcfd82ac6b4d1549765ca523289bc20b2dd1
SHA512 35f9dc663c69215e70f42a31bff0e4a43ba09a6dce56964897b68fe4b2ea4cb7d28d3073c062ccd59bdf2847aeb8b4eeca37989e4200823a33abbcc601f10a4b
SSDEEP 12288:EueSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:Euet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 c3e3da4a10363c18af96eeb40f97857b33f2c3eb754c84ab128af1704ba770d3
MD5 3752038ccc8b57eb3a4e66b0ed8ec256
SHA1 4ae7a28d15b6a1bc0eb4c45a6a862c54d7cee2a9
SHA512 3c548fef90eac6be5a08b0fe1200d7443c37ae0034cf9676200c6ba4ec17af43bfa234ae989e903fb94e301dcaf51e17f15aa169da9d629d23e84813c87ff7f7
SSDEEP 12288:1keSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:1ket/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 9ae6ce2892b038c60544a29db9b967eb91ac9a8513208ff86e2083f93ab3a87b
MD5 a80d598600785d8662bc4d8b1b477eb5
SHA1 0b7a58e523db1990dbfaa1271a3788da867c7d73
SHA512 af9fb535a961b187ed6f53a9be474622cf8a4c8ce51e9f6905cb237c396987a9343748973f9231073617f2c43408b831271d01523a42847220628e24f7e078ca
SSDEEP 12288:NVheSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:5et/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 3ef47327c0a23c9563b5a2274d65d2116f192d43dcd5fb9398d38f5658181a15
MD5 b768468fd0946a9e1c4e488f52f6add7
SHA1 bf88df172678b6553f565543ce78c9f9053c8968
SHA512 696e9483d34da55a6b4d94d2d865a398eae6b17ef9dab2fbdb6b2f016d34ddb9ff818cef81c0a177b73dfdc2a4d0a05f2e0397aa7dec47d49368f6934a8f1177
SSDEEP 12288:b5eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:b5et/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 d12ea25931a6b2e238bfdb26ad651d6e4f908f26dbd85d7a9eb15688b62effa1
MD5 431057c62d241aeed782e9ba1d4135ef
SHA1 7653938142d59771897146925ca453e1f4c165bd
SHA512 d2621c23182b7c3b5980677a7ee7325a670c2d2ab0f009091589874b2a957f879994e786127da1d363c60cbf43401bc9d322f8977444b13392d63c334149869c
SSDEEP 12288:uSeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:uSet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 d0d8043dff2ae8e6b909555ace0e3a4e0a7f8f16e1df9e09c9918c2785816dd8
MD5 b745708abd6395fa1917a3d859e0a7f6
SHA1 990e741f2d7f76f1872eeb01046ca19afb119eeb
SHA512 ea08973f8670b9820176516211435458feb019cbec849599078c5052c9cd7fffa0dcdeae39564622bdd8b69a69d27cc471bd144ff8f656459c39ff5e8bed4538
SSDEEP 12288:emeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:emet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8a901c6e75067e5c59970fef661199cac684555b237860ae214e7c6e0eb27b35
MD5 cb6c17a47978ae61c0edf98f967baf59
SHA1 46a5acd32fcf5c6a48c226cf75248c3361b54994
SHA512 8209941c45149947d409bfaa1514191179ab35ed87e50c45ada18433f6ace0b4a521c00e1691ae3b1b0f4eef0b78e46ea9478328c93e011c28e433a309186d2e
SSDEEP 12288:biZwb6zzFEoS2cPvyOeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kk:GZMSzFVSOOet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b84a1620013fcf2f728bdfe162ee2d4d78cefb6a8f7574b1ba56a2305b2bfc5a
MD5 5865acfac8135668035e88cdabaf7c8e
SHA1 ffb8ef38fe1fc6a38bf7d9f6273e3d6a9e5fde6d
SHA512 00721a2bc94bff6a342513d57c2f131307bd7396934664ca79611fbf806f7dde7ad56c212840144d90e55f2ed153ca075e88c7b1b52e44607b6dd0c2cbeb8644
SSDEEP 12288:kHeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:kHet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 fa065aee62f4711f0aee0804118adc63f09fc023e7ebfdbb52b0ad91c69e6a4d
MD5 7b722b2e77f2902a442ba933330671cd
SHA1 9c2c9d47885650e75febb599f0c6433069817a1e
SHA512 b92972b9e605f15353b010652b522ec267d6820dd8c81c465de5de0cba3b7e12e6257fa93046035978821dc604cd86437f1cf9f14ff46936aa830bef91810f33
SSDEEP 12288:szeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:szet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 b6f6999661ed98af6af5544316fa1c94f81becb89c56a3dfcd049953dd6adffe
MD5 399991abd63096b28d06656e9c87afea
SHA1 da86ecb664376bec4e112c34113582d98997e2be
SHA512 e744e65e7388e856108bce0f83ffd6933ef095a07373b65ed98f2161363f0c7212034c8005d7395ebfc1c5f78c97ddc299218b7868763431c33d856c0403d124
SSDEEP 12288:CyPz5L86eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:fzy6et/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 91e718c8a910c242c7846ebec5ac6952c4ba1cb8c27c55d57f5d9748d8f119bf
MD5 3610cc2bbc6832d28cfe4c0f402b9f64
SHA1 2fdfe7d1d070f23b3e217dc5dd46b4af23d66e22
SHA512 bcd8893303b9dbd822876aba83c1197aca680a8d6bf4f9d38584344ae8d91e6fc2bdb19cbd9a1c8d0b00d539f7e6874e588303b9e78d43d934a1f9534ce774f0
SSDEEP 12288:1HeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:1Het/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f347d03132b6c07ab5e9f5ca410f339f2b251e018676b75e58b1aa0bba1ef2ec
MD5 6149c6d11f875ca70f29c375ab990c08
SHA1 5f7c407d5d76389423cc1f46e0c66c010b212412
SHA512 010e9662d093f482283a8d8b1e29acb69d050a8e443b93a78c7d297086dd21ab166fc37a2e4470a1ec6bbf2c3ee98890b02705a86774af2d56697d0e192c70ee
SSDEEP 12288:BHeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:BHet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 7ff6b34841f2d172caaea3a643c378d330a6d382ec4c3771f27f719fa06aeaf6
MD5 69db51e56f4e8824b2405f484c2dc81a
SHA1 d5403e15b141c83e4c0891fdef04d501058b7724
SHA512 89c92702b03561af25091a7540791da36c3dfe59e98fe64319c9cf3a3fcae8229a12710088b705209b916b9d7e2c8cde04104ea1fd96acb52d99ca21394917bb
SSDEEP 12288:lyPz5L86eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:szy6et/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 f6e9888091d269baf37082ebb3fc7921b69d03b98938ff369bdabb9e424fa887
MD5 d97fa8fd6506ba7232ed9abe6457e4b2
SHA1 8e2700daaf7c5b300398e8350ced0d9ad3a83dd3
SHA512 02a92e5d4e2e73d8c8aeb4d9c57d04c7ed1d4788591eb7da6e8620f314c10e03f222208202acb5ae5422dc50edaa0ad287d7ed597480443ea8856b2f9c8cfbe2
SSDEEP 24576:uTHaLl3z0zDUet/HU9zPjeidP1Yi/dGyA:uT6LljoUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 8d0b702bd27fb070a9eb6521da40b55624b2c1669fbee50d354107c40672e10c
MD5 9fedb97ee8668516fdf8830f046082bc
SHA1 42a074cf310863592f8e19281b4a1ab9ad936c3b
SHA512 0d7f2ad1fbe897944709a9296277cac5e8d1e005f64335799ebda6941d46a2e902187fb1d6c5da57aa20544e6304ce2a0d5d945fd8236d81c434709a44aaffb0
SSDEEP 24576:s37d9CHKy7GZIet/HU9zPjeidP1Yi/dGyA:W7d9CHKyavUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 a380d79ee155f168b5a66d471fd7569f5ac10e6f931a7ec96340ba56c767d8b8
MD5 022e25f674cc2ada68acfad559effee0
SHA1 8e8bc1e543cdeacb4a16d9696d22ebf86f413a38
SHA512 caf28ba14f3711480ccf27860a50727649c19c1d6c3f08a920931f30629d3828cd7f636cdfb6653cae3ad7ba9e5785b2af9ca4b80b3d0a6b71c9e0415d6c055f
SSDEEP 24576:RcP4mcvIjkGOxhKP2l71SNKbrh/8KBfet/HU9zPjeidP1Yi/dGyA:GP4m4IpOO67N8K4UpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 7077b5103f7aa3652cb2ecac95ac2f60ef9d19a90baa214d4e28077ed1db5dcf
MD5 bf2ddda8f9dac1a93e74676ae07889ba
SHA1 fcb80300a78de9d7923aad382bc8cc9b57e42d18
SHA512 42a151e945c4abf4d4c137b3f990c5c509c71267badb76395f90771bbf81db963616bdf01293708acb4ee7279ecbb387de611fbbe94907f37d5cb60707cb15c9
SSDEEP 12288:JUFmDDL4eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:94et/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 89bd9b11f1eaa6bee7f19bb1504e185c29dab356851698e7a2ac1a8de36ce236
MD5 91c2c87fc3bbda9b6384867a17447fa9
SHA1 3d54d8569512873950fa9e49691b9367b865c892
SHA512 c3cb2f188b993c5e3b0c74c813d6dfa01fb3befaf0b2f53a6b55af6ab1d49fac95f6dab314c4b53949d48581cd5b6ae77c7a3908658f2a352a34b0b69b9adebe
SSDEEP 12288:pXeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:pXet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8104112603a3dc6b562075eb7d709269e723ce643c5c96ccfc673af8ab79ae91
MD5 747740986485d222c7349dcc955ed52a
SHA1 25d5ae10452ff16b4ebcb1f3149cb3750d31fd6f
SHA512 e4df2cb7783d4da1a94657fe9f746168a1939914e8d17490d16d71bc575a7570d7346ca0ad4b2bb20c60ff07630bf362e9846f3ac40f4d7e1f04fdae2c2efa97
SSDEEP 49152:sa0h2GEkuAe73q3pp46zwwQUUpLei7dGy:sa0hNYG4JwPUtq
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 b3134307b8c2eb459e73dd429724394d9dbf649a059996f06146d7e3ced0a3ee
MD5 0c04a2e9d01ff56a638707d735248d1a
SHA1 c488dbb0c5ca6c43073128eaec696421e6eab19f
SHA512 b5b20c739def95d9d37b82b9f9325524042f967da87eaeb3293108ef454c433cfcdc6fd68c445b78017be6edc3fa22f35ba39066cc1248e4f94952e94e4ea812
SSDEEP 12288:dhbHjfXeeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:dhbHjPeet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 fb2b2b4e732479071023a2d887b77594fdacbf25cc88d15963ed3d39accf819a
MD5 3b41e5a93565b5641efcbc33b0e099c1
SHA1 be3e6c2b6c46f9daa0a1c9cef6953ada8f4a1d87
SHA512 a47f02403eb3b35b219096189588ce7fb9b88c1a7a5dc71f4b3efe57c4a21c90382240b3594183a9e1b926f43233cd9a51c6bfeed625393a83d65f4091071c00
SSDEEP 24576:73YgnJcRTk4yti+R5dpR/2et/HU9zPjeidP1Yi/dGyA:7IgnaTk46ppR/rUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 98855eec70b7ffcccab6a3da17c858f9e0d5beca58dc1b016d2dabc2bee4849a
MD5 02e4ff62ec1423f3722d12a03b94bec0
SHA1 572c8deb27b60302238032063ff3527010e85628
SHA512 56cfee76b24194843ef0333e7c4a0ffbc04af122e5855a393f114150fa2bf23508924d194dff8f76ed47fe2d8f38d9d6101ebacc9238868eece7f2cd3c046b40
SSDEEP 12288:sDeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:sDet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 e810aff3a430d2f613dcc780a5e8e6ff6e8880e45309c9d1eb252703d267248c
MD5 ff939f5316cb286b12ad6d5dd1a95e72
SHA1 dc6ac54679725696f70135b13655aeead722114e
SHA512 657f4ef05a6923f5002a50980089e154036313c4fc14df9ed71cf76a19f3a56e11f8af87e4422412191ea8cdeb9562c39acb7b4f7179f40f49fa272eb5dccabf
SSDEEP 12288:hOb9A4LWOsvAYFTAeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:WpL3UTAet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 35d9bf1468015b28cf981197f71b51a7fd51f719f08a0ce41152cc0c7c0fcdee
MD5 e81944538d8fdaacb0a84bf6e060b500
SHA1 0cda69ec61780dc8c5228c6590cf2c5dbba9be74
SHA512 1a1438da2314ebe41d5db38aaa0e60d01efff2c4356d28ad28956a5a5ba4193ffcca7963403bf2ddfc16a2349b2aa1a381183e1288916b7e3e8c26535d0d1e4b
SSDEEP 12288:epFtpOceSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:0Ocet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 00d00b05df764b121d887a1500d60e87847ca3c6e56aab0f93d72789b20cca08
MD5 1aa1f529d7a822cc779481cd65261088
SHA1 a134fd8e5983408cddc0add9f7966084d134350f
SHA512 ca5d5f35f0aa82edfb68a3c209e6078477cc31f7ac72078e8787539766069b26def66af33cfbdc93434ad5a2486c97102861c8f1442e77a348b721762153e89c
SSDEEP 24576:g7NM9YmZqmWMUkPjZM48Mv6bEhsHet/HU9zPjeidP1Yi/dGyA:g7cBWMpPjN8DbEhTUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 10dc833efadf583bc7751e5dec8222bf1cb4baa7c489ba265c147277b322ec99
MD5 6384fbec3684ed58965955a53ed94644
SHA1 24af3d4d7d3f48b89822b5d261b1218b08429b44
SHA512 59b7d68fef622aca372f8d764d26625130c17ab0621ac1d54b0587b4fd9e77a6e793ef968ad08825434ad9fdd91eee0cc7dabe5fd64260eca6548fc20492b7fe
SSDEEP 24576:GW6BApg2YuyuNDYTabvcRvNYf8km1det/HU9zPjeidP1Yi/dGyA:GF2YuHNETovcvNYf8kmWUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 de231474cb405e3d6de2a6bd55d92a9bed60e893cd3f54c0827258a5c5a77d45
MD5 d9ba8798a48f3e73c8de98f00d0ecc6a
SHA1 974b71463ec396ba74e581157bcd4d0620ba6b1b
SHA512 7e06fba7397299f1dc0d50d66417427aff9c3bec5b9b56f14076b59c4057747e1902f685935806eb449c279f176a09ded7e7830432774bdb4e0eb1be02e40ca6
SSDEEP 24576:ZAFs06+Omlf3NXEbToIet/HU9zPjeidP1Yi/dGyA:eFs060lVXu0UpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 bbc7cf33b993aabe006fd794de2267773e945e1c0962af6ae22ce66dfc3675a8
MD5 83bfa602ba7925718e49574f5e8520cb
SHA1 0c5178c57ff2cf0395ed979ffba591e2ffc65404
SHA512 689939122b742a680df074a2cfe2b7a2ed740093933ff89a6368b1cf553108dcb8bf7b92828f3febf28dfe1aa5b7dad817d95496acbfc82204a9f1fda95ee1e8
SSDEEP 12288:fCJnJ5D3VkrlzxneSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:aJnJ5D3WtZet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 266094be2a32c9dbc510afd918fede8bf85815f82c8d62c4719210479a1de271
MD5 3ff314a7b1bb732d2563dfb362311657
SHA1 be12eb4aa0292bef05b9098a474449b8c043a0b2
SHA512 50fec8f006417a4700bc9ee83813c3038c27803c14ca0b2458816a2a860d90fc8965160d9d98e19a451b5ae819dbdc83db7a245a5efd908570fe7703c457ca07
SSDEEP 24576:XEPohm6/7IIXdwcXrif7qQncjlP65i3Vu2et/HU9zPjeidP1Yi/dGyA:Qo06DIKdwc+eQnSt65aVSUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 5a5c0a580db681121d0888b4d64044770d4b82a5b5f29aae7695b09015efbf99
MD5 8cf0958c69c4cbe7f6f5f3858a10a2f3
SHA1 d56e1e323dbe352788274971fe686034d303c8a1
SHA512 d9bfde80e2b971f81717fe0fd83b3514c60c18e0b5afaf1a11f229a874d72a0140b9bc28079c68e138468533abe823ec36397680dde7cdc3c703860326824c4e
SSDEEP 12288:0EP3RrleSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:vrlet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 801c9919463250deebcac17a8cc86f26aee67dbcbc96cef3a93199aace99356e
MD5 4038afb5e4163540d00359b3ab226e25
SHA1 6d7210a6d8b9cdf81175163c8ca589697901174f
SHA512 f78174258737852acab1bebde0c12b0f59cba191ba87422dd6562ae9e2e7ec816e252e5e0aa32cb7c23a16fca140cba57937317deffa3cc183481e411599e9a8
SSDEEP 12288:7jkyueSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:7Iyuet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 6d3120ce87b6a9a39dce08d92ea4938063c199994db97fb98fcb8e8b910b07b8
MD5 619d001ad13be7785389b0452ec687ef
SHA1 fcfb5781556ca06cbaa73c7775338083ef99ca45
SHA512 e7ce1962f903954e2bc33fb04e0ea59072cb591c2b43107a781d76b97852f304728ee2b67b8014526c41ecaf35865884ec9e3d250eeb2d4b72f89aeb73b5a6fc
SSDEEP 12288:oFseSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:mset/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 f6fb42270e1ddf901927d810ad28410a94185c32f779a19935800e509a69e4c9
MD5 3d96125b51443ddc5e8e11deda549105
SHA1 7bb6d0777234401af08bdf0fa56135334367f770
SHA512 bdaa58cbe359b7587a2fe9670363001c41c5a2dd7d135d74d093f31e5af17804100f952c9f8e9872ccb1b44ffa0eab13db14b83967cdabf8268d9cca01a6f050
SSDEEP 24576:lQ9MxZKdcz97w3Pet/HU9zPjeidP1Yi/dGyA:lVKX+UpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 3933f581acc52cde83bd93ef966e35db9b81430203a20202d35b03ae8b7ea92f
MD5 eda6650dbad378d7414c452e40aa968a
SHA1 de70c1286894b0ad5b316ffcde6d1334b1b931c3
SHA512 ac395a3028bc59a3d135fd010dbda669b55d23dac675907ff0053cddaa6e47c80dd6bd4d656425f34ecde7bac1dd76ec86c4184421946c70aa3675a21d0dd206
SSDEEP 12288:fyoKo2HRple9pqeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:fyocxApqet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b24adf6693f4c6fc9092858766cdf14f949366ce4a98054da222c23b6404a65d
MD5 6fe18508dc4ffe56ebca524a40783fed
SHA1 12bd65092f54316f6e9b71e8fd44d78203029164
SHA512 8173c61e4d7b49889daa410985d71c47ec1ec7fb2deb0af28cf1bb47c65754a19bdb0d168000870b7018ad01abade525981250d7f022128e6785fa9b91d8215f
SSDEEP 49152:8WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKXUpLei7dGy:20zuNI7Utq
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4f18cf6a582f7ca94addbbf9c17f7fee748d481e59404e48b5ab1e8a0a38a718
MD5 b3647c002e9dd54019087d95a39a0b5d
SHA1 65a1e2230df9e589c907be1f62ed29ed73fb8099
SHA512 8d5ddd07a7dde5196cd4cc4ebcf1cdf18ab32b28c2a06a3a39e2efebfd075a51104d95bf7f69fdc695576fc82ff5770869e689e76d931c59bff3003090e85154
SSDEEP 24576:q1QT7EcpfxR+N5AWAz3ooiYtjMqblet/HU9zPjeidP1Yi/dGyA:XTDxR+N5YzTfjMlUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 7c7b180f9eb169808548cfcc6c2d9cd1520fcaa0b8685aa6deff67f7622593b0
MD5 512e2b40e03699c89882cdc32e50b151
SHA1 85b26b0585d0389d97b84160323bb860ede3de08
SHA512 14e845c4de653a6c3c9ca151f85c22d1d8aec4c84945325f0f7ded69e3b16e883f6766ec9b73b3b5a618c6deef96295e71997181ef490b90ce0b4afe04163fcb
SSDEEP 24576:0TMdOz0FFS+imSLhet/HU9zPjeidP1Yi/dGyA:80K+imSLcUpLei7dGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 5d96f7f04d036404bfddadcd51446d93429bc14fb3dbe484d153385093b12a38
MD5 45060ef11d15f212dea332847fb15a95
SHA1 8e3c7e3e3438fea36cdeccf0f7cb597b964504d5
SHA512 bbc523ec97d696ad4f752d431274ae44a5f8a77d51b6dfa3b790e0e94be618cdf8b3dab6192d67f656c5f00f6de15171a83b5b31d8cc86e41f5ce562c04cec56
SSDEEP 12288:447AeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:PAet/HU9zPjeidP1Yi/dGyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-177-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/812-173-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/812-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/876-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/876-35-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/876-432-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/876-34-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1124-172-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1124-21-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1124-20-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1124-12-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1264-274-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1316-175-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1320-518-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1320-178-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1376-311-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1376-574-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1416-39-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1416-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1416-45-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1416-58-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1416-60-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1612-176-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1848-0-0x0000000000400000-0x0000000000ADA000-memory.dmp

Download

memory/1848-82-0x0000000000400000-0x0000000000ADA000-memory.dmp

Download

memory/1848-8-0x00000000014E0000-0x0000000001547000-memory.dmp

Download

memory/1848-1-0x00000000014E0000-0x0000000001547000-memory.dmp

Download

memory/1948-310-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2184-277-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2536-180-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2536-573-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2540-567-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2540-50-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2540-56-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2540-49-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3260-568-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3260-69-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3260-71-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3260-63-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3480-174-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4016-215-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4300-179-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4480-275-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4536-312-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4536-575-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4628-86-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/4628-88-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4628-83-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4628-80-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/4628-74-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/5096-276-0x0000000140000000-0x0000000140147000-memory.dmp

Download