18be26003479cad8080ee6ac82b19517fb75c89f028193c15beef9692f79a65d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
Size 625KB
Sample240603-mnsp1abe7w
SHA256 18be26003479cad8080ee6ac82b19517fb75c89f028193c15beef9692f79a65d
MD5 a04ce0b66a0b82c47d893050c7b480d0
SHA1 47c101642defeb383ecc808686bdc724f18953ac
SHA512 386c97e469ac0072dc2d13fe190b56d579529c3c724634389a184f91e99a134af1f44ffbad8376bab39422b6e45bada108af298f33e69913402c4c2845b83765
SSDEEP 12288:R2v8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7X:Ik+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4316	alg.exe
2416	DiagnosticsHub.StandardCollector.Service.exe
4580	fxssvc.exe
4436	elevation_service.exe
872	elevation_service.exe
2484	maintenanceservice.exe
1388	msdtc.exe
4976	OSE.EXE
4508	PerceptionSimulationService.exe
4008	perfhost.exe
1216	locator.exe
4312	SensorDataService.exe
3708	snmptrap.exe
4692	spectrum.exe
3204	ssh-agent.exe
1536	TieringEngineService.exe
112	AgentService.exe
1952	vds.exe
452	vssvc.exe
1212	wbengine.exe
3700	WmiApSrv.exe
3624	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\88eaea86c3a5208d.bin	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081648e02a2b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8e22400a2b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018933500a2b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001abb1d00a2b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004489b402a2b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2416	DiagnosticsHub.StandardCollector.Service.exe
2416	DiagnosticsHub.StandardCollector.Service.exe
2416	DiagnosticsHub.StandardCollector.Service.exe
2416	DiagnosticsHub.StandardCollector.Service.exe
2416	DiagnosticsHub.StandardCollector.Service.exe
2416	DiagnosticsHub.StandardCollector.Service.exe
2416	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2908	a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
Token: SeAuditPrivilege	4580	fxssvc.exe
Token: SeRestorePrivilege	1536	TieringEngineService.exe
Token: SeManageVolumePrivilege	1536	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	112	AgentService.exe
Token: SeBackupPrivilege	452	vssvc.exe
Token: SeRestorePrivilege	452	vssvc.exe
Token: SeAuditPrivilege	452	vssvc.exe
Token: SeBackupPrivilege	1212	wbengine.exe
Token: SeRestorePrivilege	1212	wbengine.exe
Token: SeSecurityPrivilege	1212	wbengine.exe
Token: 33	3624	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3624	SearchIndexer.exe
Token: SeDebugPrivilege	4316	alg.exe
Token: SeDebugPrivilege	4316	alg.exe
Token: SeDebugPrivilege	4316	alg.exe
Token: SeDebugPrivilege	2416	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 5712	3624	SearchIndexer.exe	122
PID 3624 wrote to memory of 5712	3624	SearchIndexer.exe	122
PID 3624 wrote to memory of 5760	3624	SearchIndexer.exe	123
PID 3624 wrote to memory of 5760	3624	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a04ce0b66a0b82c47d893050c7b480d0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2088

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:872

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2484

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1388

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4508

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4008

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1216

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4312

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3708

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4692

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2328

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:112

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5712
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
1⤵
PID:5784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
Size 2.3MB
SHA256 c193fa4266a50506790d310678ee521ac9ed0dfb3ed85dd90d667431b5add13c
MD5 8a12097ed804de40b6f5f1655b85ab3e
SHA1 8dbb2bc1d11f6dd381770be9d0a703750e6999b1
SHA512 ad2e84762fd79578b0635aa34bf93e4df816cbb6345320b1ccbd90a8d215f2a8e4c6852545694727f2da8007583cb2bf75161a2e9a886a78e01cc5c9c1ac923a
SSDEEP 49152:E5Y3YNoN9iWHMokhQ7c49W/g6ZU6CENlc7dpJLrQWd:GY3goN93Cg69CEN6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 30e3d9141758c30ad4aeee9412e8d7ee3b8af37005fb3ea6cb418e4c6c91b2d1
MD5 c0b4138702a33f0b89c133588ca614aa
SHA1 3633421bfb6da6ab7e44e3cce2aafd224f0064dc
SHA512 b86bb9b9e60a968e1da21ab23a0dd14e1aeca7ad02929ef3035e441895497388d5ae223d61b14e65d4228fa9d1a26f69b4825c5d0a121f185f7a75779404d094
SSDEEP 24576:GidnBsuEn+L6VMRCPU6CENltmVVdpx7fLrQWd:9SuF6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 bdea552e6bc8a978ee9c463909e4cdb7badd27ba92d78c30c8629dde635d21b0
MD5 4b0e09f4305ef5186b948c0ce3b7ede0
SHA1 83ea61dba0bbabc3613271e03c99b593346ff9b9
SHA512 28da00a9da66333ab6a8b926b00c1734fa73d0cc9bdbcb5a856e67bc041496a8ac855ca1dfaea774978b4aaa3be2cb1b977e8f2cb17940af51310448c4bdd3b9
SSDEEP 24576:y+gkEVfh4CoD+L6VMRCPU6CENltmVVdpx7fLrQWd:3gkExSO6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 340b3f25b83bbca2ed4fdc87e1ddcb793290e131e96eb4a767cc8736e807c610
MD5 ae6f1c4a97f765f6ce44a7643a4ab4be
SHA1 6ddf9b927df3a4eaafb03f97d52f2ef3c1625a3d
SHA512 14ca495bf905d06504b07a9d51be14cd59f583a6a4e9358d0efa753ba0ea2af41fa710df208df9b1b2edba0f8bf88ae16a51cf2418710c4fa1d81a793ffda7f4
SSDEEP 24576:HBpDRmi78gkPXlyo0GxjrU+L6VMRCPU6CENltmVVdpx7fLrQWd:hNRmi78gkPX4o0Gxj36ZU6CENlc7dpJ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 32b54943da683fabb420ad118b7ae0d002a40412c1bbe2a9568db46898abe4f4
MD5 8ce201b762511a3b99921f2b77d8da8d
SHA1 2b5c9a5310550bdc6f603d5305df0a15f2badd82
SHA512 596bb5e6e0a04a15423949ad85bb4f8c5bdb5eb4b47c06d2dbccd320b2e36c3b5d01f0d929656584bd3ba70da677cecce0452dff5c414d8f8cd2a4c0c2667b9a
SSDEEP 24576:PLOS2oyPIXVD+L6VMRCPU6CENltmVVdpx7fLrQWd:p/yv6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 de8cf5f0f49882ba872358d77c33806f489adbcc2b33429f5c361d5e322c8721
MD5 f5e7c7eb5a7878affdb481be4bc74319
SHA1 fcccf232e955e9ec53b32d4b51825144592be4d3
SHA512 8a346f4dffb4fdf568e8e46a34258366881af498df935739119c5e4bdcc1821aadbec1e18c6189cfce97e0cf83cad7271997f99b0a0eecdc54f7130813c158b3
SSDEEP 12288:UfC8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7z:UfJ+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 8d0088a3de828c92962d2188ee21d73f679a38eea274d9db82ada1d98ad9deb1
MD5 cbf2b79e43a84b75b68ac49bc4ee81e5
SHA1 905714a86b7977a8025d4437857d59c72844afea
SHA512 15b4d6fa8294bafe7865ae9850bbebcd3f9d10440a3a3574523b824307b0ed8f627cfa2dedec2d3733df0d57db59d4c17da6ac4ff850acf3441c12a66d5e16af
SSDEEP 24576:sJIUK+L6VMRCPU6CENltmVVdpx7fLrQWd:sJIUR6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 282443297199b57e800875c6c800225aaac7bfaeff4cbe0c1bf47d340aae437b
MD5 fbb263e7af0ae47bf128a9e86595c5fb
SHA1 cfb84e4294777074d1a6208e81fcfa03b659f52b
SHA512 4ac45a591dab3b315181ed5abfddae3e79976687e49cd08faf0a9f23bd1f3efcdd4948400ba99233f024727347f36759be0f4e6e4c49cf8763b31252b621314c
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:KQvGAdlCEL8c/yRNw5CU69CEN6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 8fb97736aa3628131e0e704d9d6e496ad8aa0140f0ee8ebf7392bc2512d60f87
MD5 bcac489eb512afbf40be4f19c79ece5b
SHA1 56cb8f38322133761026e87e1beff614e7e817b1
SHA512 09e8fd3860f2a8e115565074e43dfc3b731daef9c3b02fc05d19e09784ea4822ae1d19008a7d468bb90c79ee6588bfb022df9d35f9b118bc550540b965267680
SSDEEP 24576:pdewsAj8+L6VMRCPU6CENltmVVdpx7fLrQWd:3ljD6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5e094b9ef01ce17be26ecbeb40ec4cf83d4fdfdeaf1d6e3cc3cacf965f97f451
MD5 fb25c991bac7ceb8bce14e84e4f44852
SHA1 a7ac1e4a630b56c8143c0b1a53ee25c7ca1dbdda
SHA512 aebdcf72b8b37fe2ee07ea2ec246ead31ea5535b838ca1e71221e9daee965d94f611c8f9c1d9f53fb16b59e5ad2903dbb33c18e33e1411230c405d35a3659d86
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHbIm:LUEtQevvqc2W1cpV2EI32s
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c29f41d18001251acf45c5d45eed266097d189d0ecab3d5b3f9b2a9c22b4dcd4
MD5 a3fa2a46d7498d7ba6342daf1abb0e30
SHA1 e3ce821c1be559d79641a3ab6f917949cf190902
SHA512 c55ae465087275614cff9d5c179581f274c5bddfdbff2b2b6466fbb376682ceb1c5848bc577e2a38e009fd06e8a2fc0afacfe58972ac1ef02048d25aa7fe59c2
SSDEEP 49152:lCbRquA/m2yL5zTfFiV+XenmE3/zj6ZU6CENlc7dpJLrQWd:yoquVjnmQ69CEN6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4d3b2b6dbb283d08eb67a1beb73f0bbe079535f1cb5f8285434eac6693c2c5de
MD5 70e37c4e43de22c9eb66c6139ed056ca
SHA1 e8fea6d906e89e9f64c42ba1055ff95c53c31e08
SHA512 6f30380db576e9bb8f4d7cc069014006e97dcacefd7972ebe5801fe072fea058cf9272b5085990ad273ab2efb5e879d56e6fcf5335497dbb59441707bee6db68
SSDEEP 24576:mAhGLJIFoiwtA5l7S53T+L6VMRCPU6CENltmVVdpx7fLrQWd:mAMyFoiq5A6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9930f2b10f027963587fa75e47c6120cba24b0c684aede88640adf8557de3a13
MD5 542361344ffe5d7edf27d5f70b3400cf
SHA1 7ae728b0e0bfa6ed151da8c78e61040f35725204
SHA512 b9cfe724ed91504a3e5019e4435bb91f3de640fab04cbd323abf45d454dbeafe13f7955554b199e8045ca6b878bd10302568e1a7ae84bfe00c67ef373bd095a3
SSDEEP 24576:7wuoOWQ+L6VMRCPU6CENltmVVdpx7fLrQWd:7wDOM6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 cf60cffe2ae5a2883e8a47dde9066defe80f6371fb4b2c48df6ff3a848da1a00
MD5 347e5279aaf8be51dc845a2a7622d4d6
SHA1 48c217102542d793e0a3a35e9201c0c5904511c6
SHA512 dd8c64b6f09a47fc4c2566fb1960339d27285197673efa8ddd22eaa65125c0a80aa7ebe300f58f1e70468dc48657356592da0434f9975a161f7260d4c84fb9da
SSDEEP 12288:+BZ1Iy38+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7E:4Zul+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 b8c22fec66ad801cbc3dc381a6ef1ce40649948be772171132013d78b94740c5
MD5 d2830ba192724322d4ad6ece6c11a91e
SHA1 c3540c27c0998e3a60d0acf2cc88b64d9cd0cec1
SHA512 a57f8a84f336704552abcf5a6f4e24f3a5ecec8527645f39bbc18256e0a494922039ad8a6c2d7ca61090874575673ef23ad152fa195ee9ddd87afdf38f58be85
SSDEEP 98304:YwfhY7g/rLd7yYA3awr341gY69CEN6rV:078yhYIm
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 8fc454fcc74f993ac84ee1116b8e647bede0ba53d78fa26416ef4bea74ff7900
MD5 f3770a0ce0168e00587eed6ed05fd694
SHA1 b92be54225b9f84ae8aa681fd64a85fa3b6298bd
SHA512 239a6304fcc42b127331df79c57b7c14023616defe6d23ac5af8058e44636611d4a1d68cbb732b4c83676b860541e9b972bb1716935276e71384f1bc64cf5966
SSDEEP 98304:1wfhY7g/rLd7yYA3awr341gY69CEN6rV:378yhYIm
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 1fe602dede5cdd1712c816315b4e79073baae94e447b6c68f29708625fe8886e
MD5 0a070c3570892c949bbdb91a675d2861
SHA1 9be7e218cd19828cecf931db31c84abe52ce7455
SHA512 7e74cbffa02ac071a15b124fb34db1c1d95be91f46fbd8cf8da9199b18871413c4b3c58625efc674970724b490cc99cb7c4321109ec12aec183067915c8eef57
SSDEEP 49152:AuXv0Ftpn5606zOv6ZU6CENlc7dpJLrQWd:Xc56F069CEN6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 66ca8550f92649ee7d93c5d1edaa99799111361edbcb813ff9452d8b9d57a744
MD5 654aa350c065211846cdbc8dc269c195
SHA1 4e8fe82131630193d19b93076cc5f900d46a0bb4
SHA512 0900936093692765ed8ede71528213925f679c6a18c533cc3fb1c8a48e787b740c74b69124d174d28d195bccbe751154c7b3ba3b3f4ac1e5df561b9a5db7a933
SSDEEP 49152:Ny7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxD6ZU6CENlc7dpJLrQWd:4mYeyxHjWjMTD69CEN6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 a7006c3307c0215c9285990b7e6d003918ae8e081d8ff8118e4a7ce8f5908cee
MD5 2bb5cc4bd95faf726d30651acb74b2cd
SHA1 b83cc9914ad05182e274a6a6f0b770b2ff7d5e0c
SHA512 029e00b3d93b258b4daab413174505f0c2782c121aa275c1467165cf537db9170669ecebf064c1e984542ecc1480ddd6b1332043880747af32fbad37f918839d
SSDEEP 49152:NWnDci18yNNUgbYX6ZU6CENlc7dpJLrQWd:YIqNNoX69CEN6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 88af7e4735d6d84313fc18570ca3dd26d3081d5bc7cd81cb38f1a4db37429834
MD5 0327bef9396b746eb67add1d138b966e
SHA1 c51229bf811982db3b3bcf04ebac516792a55db0
SHA512 afca28450069415f8fe71254c4531c481a1fbbf8a176e12f897aa7e37a4d0ba9dacc23af699b5310ed35a7ed811956dc0a0a160a7737fe31e10b48a33f8ca967
SSDEEP 49152:rizMZm0GhamSoC6ZU6CENlc7dpJLrQWd:rm0UWoC69CEN6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b29ced1daa29005ccd52e5a4da25ecfe4c99b7cabb4ec7dfdbfff41d4220ead5
MD5 1ecee8cee8a6c3d5bb4505810b97cf56
SHA1 d9203b00795cef8219456a204536e3d926ea2a2a
SHA512 8293f43e4ccabcc978c3ce76e617051b70fc5e4a659d01d25385576151e94d802efe9f7a0fbf35dde0dd0c894227a5ce47e34a3565d3e230026a8ac53dd507b5
SSDEEP 12288:F68+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7Z:Fh+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ba2216a4bb53a155393d86c32ade8bc5af3a173f2a6ceeebc9e174c602bf6f4f
MD5 800aa5f9f3c1621fbca497536914b8cc
SHA1 d74abb3e607aff31c24def28aa9a2a741b56c4c5
SHA512 885585801b559ee0400349dcc3d7ce0ba8ecb2b666aed8c95a23a5b90be28613f6a22d3a9ebc06159ca5da9827b5ff132712c6e8142b0a280889d7ea7e708266
SSDEEP 12288:UL8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7Z:UY+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 35a6b8c95d01fd1e0f3c7530047a1041ce1c32c544b683fe73b2de38f0d4f057
MD5 f82a9d7723500322e41984baad8784a4
SHA1 9f74a3928aa8989e31f5d32d23a91db57b615c9c
SHA512 ad38fd87726338c498068279d9669ea9acadc146d17dab189ec74ec4f98aad45abb2ca77f4d2f86c13d7a3e6cea47617ee045a543104c1fff721d87fe4c836e9
SSDEEP 12288:Vx8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7Z:Vi+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d1385239a248743573155a834214396fb4731570521ed6e8f672f54f47f5cb6e
MD5 98a65db4d7c385917fbd166b8a6181a8
SHA1 6f6078bed0f1d9d1a6b620f8e94528953eb02484
SHA512 642945d30de1844af33dbaf1c07665849c4d012673a4011c625f6b7b5f4e4be070d6af75c8b997ab7c3e113f4870d807245f80c62602c0b0d7bae97d53a37c62
SSDEEP 12288:yVQ8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7y:Q+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 da0170e0e090d2d1168ad40e2626b25b565f3029a1573b16a9bd508f031d9b0c
MD5 48d333371a754b23dce28e5800024924
SHA1 8c83658eabc722bb7e6ed7895a5fa53eb03e79ea
SHA512 bea7409ca59a3b6f5f381d30674e9aa8d4a3a763fcd990be060beb4510f1332de0edcaf3f97c9664676d300376cce88df9c3bd25fa31498cba338fa006920359
SSDEEP 12288:v48+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7b:vb+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 5478484f56ca83b177525fe1e7349efcf608bf00877a42f25924d733f74f9b3a
MD5 def38a629ca56704a9da3149cb558a84
SHA1 56f9a8847c5815419d4c89db54ec173a27b245f8
SHA512 76001a2ded174552e553f1b822e0241f1ebccd3871e7be8b9aa7e4350d7cb93cba8f5e7a87a78f722cfe101dc777d5c4471ab850d1d6a65acc57c98beae0934a
SSDEEP 12288:7/8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7j:7U+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 75f981201f0462023ac9236b75dfd9f6832b609faa005ed1be32e7dce1ebd0ef
MD5 6562eb22edd829ed5385ba02097b27dc
SHA1 0ffd57eec38ee7da1bff95364a3831894743b664
SHA512 fda09b3c789cf4131cb15a7f78b7594027cf56e16f52f7e7ff319d23e8bb7f7f8a33d7d5a784ea52f93d38aa69b3cd8c4af62a3105b692300d439f2fadd83556
SSDEEP 12288:JT8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7b:Jg+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5d687fb38d50f26f66a0d4c76de0961109c331fa765aeba02fecf08ec3b6c82a
MD5 56cf2261c33450f87f2d8b5d2d8d03a5
SHA1 47645c4f9d718d21e26dd7b80d3c2460d6c17cee
SHA512 ac950c0f1b3ca52ca68adf0a8f19c8338999299c2e6ceaf34705a272890be9357491306bd45bde10ac5258519f6e8b9ec6b3f5156e3bbb8e15b4ce33d0928a71
SSDEEP 24576:uZMSzFVSO4+L6VMRCPU6CENltmVVdpx7fLrQWd:uZMSzf76ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 92f72a4f606fce2086ebd96d6d0fffbd692e97851762631d3b2e6bbdb33ee1db
MD5 5b121af380ed812ffc360b69da3c78e2
SHA1 c206099d13af2bcb29a3015add7a6649e379c831
SHA512 84241e0bf0d94a8976464e899225b54162e2f71710e77509b2efa78de062e744e01504acbe7d1d93420c5abd67b77012225e855aee44cd9d05d9fab2204df070
SSDEEP 12288:Sm8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7g:SV+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 4fafa25a5f472b059b4a5f710c5874bf75fb7603212e6395134d88ab6748a5dd
MD5 7c20327ac776ce7ffb843ecb920025bb
SHA1 7e9e1ff61fac73f461166d2b0a70888de69c87fd
SHA512 5a4c4747829d31f398fb718ef03e0a766a0d2dfccfc6e62b75cb63e8c6fb5000790c471bfbba12fe44db2fbb4f8859ad58b848c5de8dcb708240cf0a94240e39
SSDEEP 12288:/S8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7g:/5+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 3e00ebb8bb1c2052a51d6d97b04e963cf0155c86cb71605b6587c589951c8681
MD5 821763b80ee9712777a4ad6032ce33c8
SHA1 e4ea173512db56acb8bc07fd3711d9a4af90b0ae
SHA512 9d2ceb15dd23ce53f568299d637adb24499fed7bc211db16ea2431375c6445e3b4bbcd0c0726ab5f93c4a07e143c0fe8171eae37f25653edff1c52da902e180d
SSDEEP 12288:UyPz5L838+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7x:Nzys+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 a912a1d8a81a7c91933ec9156300dcb45eb5a9a4ab70b2a00bd9c373e7ff32d8
MD5 fa4ec9c9d1bbe667b86b915811c9c55b
SHA1 0c927997dfbc0966d7d611e9bbc533f3f3dafa36
SHA512 7d07e9cb2a1a63a409728c75e82c71e6355ed01aa90d3309fef48529a834f35ddbae322c0b72ea66ab33139240cc65d936c55ed8255558189b3d15b76b451c2f
SSDEEP 12288:Om8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7l:OV+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 0858ca924263cfd315807f50bd5c1634bf94023b873241df0130299525da7e8e
MD5 4c21e14ae6a73a8c17f7eaf51a6b86e1
SHA1 25d269b9d71b18b28c3778bf100acf411b6d0cdc
SHA512 4176143718c0b6f6c5cc5dce1b1b6ded52cce6258cea2a4a4e26bb2a7110fe3f3a6e97ec47731a6d7299d1529fd90a49de2e3d80ee36462924bfe42aa02e69f1
SSDEEP 12288:jm8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7p:jV+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 8cb7b82884d4e81cb677ac1bf0da74ada87272357953c96e5034145ae8f6e8a3
MD5 2d58e16300530dd4463199e953db4541
SHA1 9661b42f7df2721e101513d250b8e088e3af3092
SHA512 f555853f57030d8455ea935b9fe8b38680481f5aef68532dcea4a1f2e54556d8091afeb4d2202ac00a45b7880c63828b63a8a7def84ac4fe952ad3f775e57a9c
SSDEEP 12288:JyPz5L838+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7L:ozys+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 9b4add7082ba1a9d124115f279cb9c23aa544e03e4c807faf1bbe3b885be97d7
MD5 21dd8561f9010444249c268c28af8429
SHA1 4626f1a96f0a4d5f800e1e15e142210465bf1b1e
SHA512 0bc478f6f663a7894d0f863d5c0ee043e4d09f2c56912ee2a99483fbf1fc666d3d61c4a766695fb36aeb29aa906f36b33f79da1579fc4fe24392d0135e305a7d
SSDEEP 24576:RTHaLl3z0zDy+L6VMRCPU6CENltmVVdpx7fLrQWd:RT6Lljk6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 47e07a09aaa1f259cf4ff07567e9af33498afb061d310717cba33c71407aa593
MD5 7aea4cf39e3192f1ed36e4ce452722b4
SHA1 e74b9b58091a0090cfb360eaab78354a0b772a3d
SHA512 803867fa656bbab72c19d855fb6eb56ffb9a73d58e870965323f674eb9b594da90b132c0adfaa33eef7a6e854a223c96fe9847a19d48e38ace56cf81b2f4a635
SSDEEP 24576:k37d9CHKy7GZe+L6VMRCPU6CENltmVVdpx7fLrQWd:u7d9CHKya76ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 b31788d11c9130594aa3b785837f27e90429a4204860341839b53870ced8f22f
MD5 2627ad9c08efe92846a174e4cc3e260b
SHA1 1a90e9defbcd3d5a370ac630a1991f7d2c2628a5
SHA512 51bbf34d2818472c3413744bdc29316182435301e140a744e03f3fa36a2a1769d29e2185b79626a4d2d4ca837e617aefcfa78af9fb8ced158a5cbb5a12eb5228
SSDEEP 12288:8R8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7C:8C+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 139f53a6af90b648a0734e9c51f2b95bda9082e8cbaf0bc9c6fd6f36d8d7709e
MD5 a407a622138356ba4f5fe6583d8c5994
SHA1 a0cb13d0f0eab7058a5a071da73e73743b879eeb
SHA512 4a31a4b010ae1b89a55857b458ff196fd0f3def168bfaed40ebd96eda2b59feb18ae008af3aed7b9cc900981d04f25b07d742459f10a396c6c9a433b158da553
SSDEEP 24576:0cP4mcvIjkGOxhKP2l71SNKbrh/8KB9+L6VMRCPU6CENltmVVdpx7fLrQWd:PP4m4IpOO67N8KU6ZU6CENlc7dpJLrQw
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 b08d4bc41a9099c5faaeac844c35dd5a575f23a98e4d4eec6a93f0827bf05285
MD5 5d8196676df09bd9dfd4869906753462
SHA1 0b0627126e3cfa058098ee883abef9304d54038d
SHA512 049413f0765c59130e866d903b27ebd789431482fcba8599bd03836405f74050cbdf05021bde084a04cb019a9a758b21740c5f9f5edf4c18cd3cdf7b4fd4b10a
SSDEEP 12288:rUFmDDLV8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7y:ju+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 13fb98e55ebde2b917342df9144b912ae234619928cdf38ec4775e21aa131503
MD5 6f918c3571bdc70d86cf83872eee557a
SHA1 41f069bde58fa54e545be07747b4fa45c146792f
SHA512 e7319d52054f323f9174a1658c2fe3f34ae8eaadfc9f022e810e1357d7112243d9e2a49b8015d1586e91d04bdac42b0f23f564284802366c144e5eefda4a986c
SSDEEP 12288:h28+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7N:hF+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7b6cee6e19ca125b9c1c924b40936a04c66b2afe539db09a1f814562a93eec09
MD5 167ab0a7807a73e953d82adae76fe3cd
SHA1 ee7c922200a4383331dc65b4f29edaa35ee5b8a9
SHA512 19e0595acef8f3808b8b528b785eab458df954ce383cff94a554c1ef93474911d316ae6be9faf84f94e5bb1b0ce0f32f8efb486138e6e3a9985b0a685278c761
SSDEEP 49152:ga0h2GEkuAe73q3pp46zwwQo6ZU6CENlc7dpJLrQWd:ga0hNYG4Jwb69CEN6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 ca99a94fd8eceef0d01f10ced82b55deb2130e2bb7d92c5e2b0c5a596ab23ad1
MD5 78e0da2a9ede3f869459411bcd21f6e3
SHA1 1c878f6dc9452987d7c00e06aa12e2f5d39db864
SHA512 d965afa74b4bf48aa75425d29deb730394f888c51524f8ab99c3252030cd769faa90f6d37e43a4146c277c7e5afc60b69b3a6c007f93aceebdaadf7d58873810
SSDEEP 12288:jhbHjfX78+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb75:jhbHjPo+L6VMRCPU6CENltmVVdpx7fLL
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 582da014459956647bbf27dc9240bba3f5d36293af61935294a83007362920d2
MD5 b1e106d84e409f1c72709dd9d9b9768d
SHA1 4e37b0c0b8e5b758af22ee954bd04b4199576834
SHA512 271f7325b2fcada3a5460ba9e390dcf7ff7a06d2d20d30fe339c4d198d366473cad431567d5e207c9df6f62f8aa83deedd33b134b4a7a8209c30efdb796a4052
SSDEEP 24576:p3YgnJcRTk4yti+R5dpR/Q+L6VMRCPU6CENltmVVdpx7fLrQWd:pIgnaTk46ppR/v6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 56e97658d2a09c851a1b353be0576c54d9b0b093c52fe918f9e00ab489d3f304
MD5 af49961bdf513183cc212e691f05a326
SHA1 91191a454667b4989dd8b15e0db5f91e03e603de
SHA512 fb6d1689a6b8013ba571d07a9eec56b37a6d58aa97d0c9a370c1f332abab844c7c3bd63c439bf19e4281a78900b67902fd8f612cd44ae1aebf8f29fed7f08a5d
SSDEEP 12288:Fi8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7T:Fp+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 3c4406031421863fe9684605dafa2c625d5739c65e3f962528b47554b12e64e7
MD5 59337e6bcc82f33a1cc0a07ca8a3e2ce
SHA1 ec4012136faed42973e5e5dd5e95fea0663b6c1f
SHA512 f830b1babb7e2adfa2c34b4aae4a4c08ab2d0ba2f79614392c3dcd4074abcc6261c477b57729f661c19de176621e548047ba276fa7124491807dc7eeb584248a
SSDEEP 24576:WpL3UTG+L6VMRCPU6CENltmVVdpx7fLrQWd:WpL3UR6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 1ae820744c309ad7f0045c388560d88edb658758b5d5f63d128ed8737514401a
MD5 bfe8c36d7dbc8920e5eea7f67bb1d3a9
SHA1 cadf696f918ca3476f798d46ce18c2c40d2ea7ea
SHA512 402d92f8ab8a1a22511be735647350a3782b3e7475d281f129800ac1400ec9dbc27d828a809871eb8fe39ed00da8b68b8d3a353f002a9575b1c3ffe094ac2e0b
SSDEEP 12288:upFtpO58+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7h:EOq+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 05ca18081ee01cb6336240286954488632d104fbc0dc05b2968d1096f823f48f
MD5 d0c9b6c64b1f997519ab88e5b18a54f9
SHA1 c00284281e3426dbcacdad827568a2d433e16ab3
SHA512 f940cfa630b2f9d5cd7353bdf35cc5551309dc8a1cab48e9d7db2a1cfa8bffe22a1863afed8dac33a982e8c7c69b57e2b10070b053d5b96a6f34a5e1aba21e17
SSDEEP 24576:p7NM9YmZqmWMUkPjZM48Mv6bEhsV+L6VMRCPU6CENltmVVdpx7fLrQWd:p7cBWMpPjN8DbEh36ZU6CENlc7dpJLrf
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b60455e6cb99050d3ba1222e5b097052ae373a5245cda3021ad4bf6f33d2e1bf
MD5 97b951e0c15a1f78b16e6485d14dfa42
SHA1 8ade191b1fe7b5fbeb526a73886c1d777056d442
SHA512 77b6950dfb54269452b565c8b5a060953823d37ee1ce336cdf7165f935dd1220312fdf99db5980be24c33e5e3cf58aae77de37fcafb678d0e1ff2dacabd34a22
SSDEEP 49152:vF2YuHNETovcvNYf8kmS6ZU6CENlc7dpJLrQWd:26tCf8kx69CEN6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 976cbe4b1d38ab04a1c2857d4693fe0e6601c3c768b6a8d3c9417f77e361abf1
MD5 18d64d94cdf5cc8ebdf6fc45b8bd914c
SHA1 1a682a4a8e8370e3ec1177a7d43e3a22fcf5ca3e
SHA512 b739b89254d96d50fabe409964e26182f4c9fbba7a05cfd6e8cd71f69f4ee031b8ca6bb0ac6f1f6d6bb7a7692baf4a0b83c9cd3c22ec252f74a6a23ff59d6be3
SSDEEP 24576:+AFs06+Omlf3NXEbToe+L6VMRCPU6CENltmVVdpx7fLrQWd:3Fs060lVXuI6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 eda97dedb655c307646ddc6569b640256299f9cbadeb5a44feb3156a107fd4fa
MD5 c718521a2cf299677f60f956ebb0fcb2
SHA1 dd10ace88ad444bc332635830a0666999d71d257
SHA512 23eed7cbc6025657a93a1cd29c106adf0d19041fe490ad001b2a9d21c6adbd806311f9fe8d02a88eabf8b0b8720c78bfad408d517e14ae3d2677a78b18e115de
SSDEEP 24576:XJnJ5D3Wt7+L6VMRCPU6CENltmVVdpx7fLrQWd:XJnJ5DGtI6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 27bb863a74889ce9f0f4a7aa3da8bd9409cd3da227cc5da0d6ef139f3c73b38a
MD5 e16d61b2a910b63969eac288fd8c1062
SHA1 e8ec6ab9905ad6dec323838ac972cc9d5c2ca78b
SHA512 8c0c796c9b8af4030801926fe0710eaf40ae5b38f0e33762c0fb48a9979eb721a6afa27fe268919a1c289cd86d8e886175255a3d5d0841474aad6152a84105dd
SSDEEP 49152:0o06DIKdwc+eQnSt65aV26ZU6CENlc7dpJLrQWd:pc69CEN6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 89546f384f99004b25e8af17a523662f1d26d34dd02eb3ca4c0045d5b19b59a9
MD5 9846b16064b68aae21b76c1fe0f6108e
SHA1 507684c1ee94d8c8e22b35ec98d27917e752628f
SHA512 0f982e98d03c5c1f82c376455561f64ce892cdbad922745aa62946f2fe25d33e24e847b9cc628ddefcd6278bbed85f1b75c76f63c22c740ebc1d7563fd0e6708
SSDEEP 12288:6EP3RrE8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb74:Zr/+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 dcb8559478a76059ac61cc7523378625f93762f25bf2cdc67c9d6dbccfb71862
MD5 0037c250a15a5e1976f1bcf2c73d4a17
SHA1 4447a5a6d5adce095fb32c6f941da3fd8b22f6d3
SHA512 2a12d538a66d2310e500997f2cff89029fdee843710db82a93f54ef33a1413fbcb7540b4ecabfea52d26a6b5609dac7622dbeef283b7f6944bee5dd015f882eb
SSDEEP 12288:4jkyL8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7p:4IyY+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 0500dc1fe7ec2ca1acf635aa806c2c7b945a726c9f2002ad2a4f99d1446f595a
MD5 284f60fb8445632855fad66b706907d5
SHA1 93bd7e46e914f912de6113ebfd473bfb20bb7f14
SHA512 2b203ba2070c76af8945efede303fc532acc0cca1eec343c34ef931c2fe7de6e047065559b12ca761fb79b01cde66dcf86d58eee647422988b6979df1d2d7ef9
SSDEEP 12288:MFJ8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7b:aa+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d28f1bedb7494cefbc001f6678c0a43f8738a2f61532efc7b259ef73c650aad8
MD5 6102890bfe84a25010648f04304b830a
SHA1 52c12e45f09f278d670f083841f29320eca2bb91
SHA512 a0fc1522ccae24e5aa09ed7e2f10ff554b1ec116c90b11027ac094c36b268e06429f10de23c912b2b68feb3d5ca6763fbac51947f5affb73040a00cc0c736061
SSDEEP 24576:UQ9MxZKdcz97w3N+L6VMRCPU6CENltmVVdpx7fLrQWd:UVKXa6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 6d7a05b613fd3a59e703809adfb0e5bdd335b287a4b0c884ec8d2f86165291b7
MD5 3ed6de18d5d23c3fea9d69bc768fede0
SHA1 222f4012141e718acce5c4d415562efdfe1b70d9
SHA512 87336058fe8df74cbef282587c91f5c4812b93d0c4f0a6403c16ead023e8cec59fd57b8d9647db3d6c00f750774ebec1f53d22c4c5dff998ac86c7350f896ec8
SSDEEP 24576:IyocxAp8+L6VMRCPU6CENltmVVdpx7fLrQWd:locxApD6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 79fed4c3dacbe99c22ab3a16e9c7c7ba7864c8b4249e363420cb47fc46ca6c6f
MD5 36e701136068892adbef6701e4019148
SHA1 98da0f49c121178ac9558498332d7dfa6118adfb
SHA512 43591c5d8d756b8dd1ba56444a1bae182c4ef3989d67ee2607d5676ef46a29b93c06e79913864f690048776eacd2c8bbb161532aac15206d0e958554edf62103
SSDEEP 49152:UWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKD6ZU6CENlc7dpJLrQWd:+0zuNIf69CEN6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 113af07b437336aa21628befb83341c5f81a6d4462f23b6113037b7eba7c4e29
MD5 93bb0bbac10799eb892141be7371f4b0
SHA1 94b41dae73db713064adce0051a7a1109a30a786
SHA512 66991d45c089884acbd1c8b7a9592e75502ca8fe0d950c202e79acfb3166bfe713efdb6b6979255cf3bd7e9244b740d39b473a56805b2bb4a2b109540446739c
SSDEEP 24576:B1QT7EcpfxR+N5AWAz3ooiYtjMqb/+L6VMRCPU6CENltmVVdpx7fLrQWd:ETDxR+N5YzTfjMR6ZU6CENlc7dpJLrQw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 097e4441e2246eaae2206115f3ebc70dfe47464819307b9348db3c6b0fbec2f7
MD5 045ad85e11852e06e07aaea67f6b2c15
SHA1 09b07716013c01b0209007cf3fb77e7b8259d8e1
SHA512 cafbf0de1994accee7999702eb273c05d40262950dcde981cfa7c51862c00e318718f008733dddfb5d3abe7a8f8ac5bd32e67790228b5145667c4904af96adb9
SSDEEP 24576:ETMdOz0FFS+imSLz+L6VMRCPU6CENltmVVdpx7fLrQWd:s0K+imSLQ6ZU6CENlc7dpJLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 d7decf815c14b1620ed3d43477844bf3a3a1fee44a3a9f220f062e8d959d6143
MD5 4551cf2c01447baa1f640c0d72b90b41
SHA1 ac869d4c8928ed451e5f8c9863f0f73439039e99
SHA512 6b5c363114f040a866f6e367d391526cc4d9f73eaf908c9b6b1cd45bb5ff34edd0d308cdb4a53cfa56df9c0e095c3ed9ddf8aa877e144da4445ac69792357b70
SSDEEP 12288:647N8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7d:JG+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/112-201-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/112-213-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/452-228-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/452-618-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/872-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/872-178-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/872-71-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/872-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1212-240-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1212-619-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1216-251-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1216-139-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1388-99-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1388-89-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1536-614-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1536-190-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1952-216-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1952-615-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2416-33-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2416-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2416-34-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2484-75-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2484-87-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2484-81-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2484-74-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2484-84-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2908-6-0x00000000006D0000-0x0000000000737000-memory.dmp

Download

memory/2908-114-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/2908-1-0x00000000006D0000-0x0000000000737000-memory.dmp

Download

memory/2908-0-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/2908-436-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/3204-179-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3204-613-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3624-273-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3624-621-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3700-252-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3700-620-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3708-154-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3708-431-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4008-128-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4008-239-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4312-272-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4312-514-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4312-142-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4316-12-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4316-20-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4316-131-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4316-19-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4436-58-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4436-60-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4436-52-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4436-165-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4508-124-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4508-227-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4580-48-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4580-43-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4580-49-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4580-45-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4580-37-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4692-516-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4692-166-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4976-101-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4976-215-0x0000000140000000-0x00000001400CF000-memory.dmp

Download