b703235d8b05c1b0ce8f1e865dc953a2f8518602442db63423b724dfa520130d

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
Size 648KB
Sample240603-nl3mvsch2t
SHA256 b703235d8b05c1b0ce8f1e865dc953a2f8518602442db63423b724dfa520130d
MD5 a1d1d6c6b20060141807702114180840
SHA1 892fe33b658c5176c11e218f53d7b71a0801c53d
SHA512 987ece5e19bfea0e492887079a37e74e4dc503260616b529d482da5d787feda887f2f35b294b79fefa0dbc621535b13e2861589389d4778b3fd06e498927b2e6
SSDEEP 12288:oqz2DWU/Sbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:Jz2DWlbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4848	alg.exe
2772	DiagnosticsHub.StandardCollector.Service.exe
2096	fxssvc.exe
2824	elevation_service.exe
2996	elevation_service.exe
4244	maintenanceservice.exe
3608	msdtc.exe
4144	OSE.EXE
1736	PerceptionSimulationService.exe
4632	perfhost.exe
4808	locator.exe
5108	SensorDataService.exe
1740	snmptrap.exe
3308	spectrum.exe
1648	ssh-agent.exe
4340	TieringEngineService.exe
4760	AgentService.exe
3132	vds.exe
2668	vssvc.exe
652	wbengine.exe
3148	WmiApSrv.exe
4460	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bf2a2820c3136770.bin	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\msdtc.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{372EF552-D8CF-402C-B62E-CA3A4C643A96}\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d7d956ba9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f417a772a9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a675872a9b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a675872a9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031f1c96ba9b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091cfde71a9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051b4ce6ba9b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053b64772a9b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c558e6ba9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7bccb71a9b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f431372a9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2772	DiagnosticsHub.StandardCollector.Service.exe
2772	DiagnosticsHub.StandardCollector.Service.exe
2772	DiagnosticsHub.StandardCollector.Service.exe
2772	DiagnosticsHub.StandardCollector.Service.exe
2772	DiagnosticsHub.StandardCollector.Service.exe
2772	DiagnosticsHub.StandardCollector.Service.exe
2772	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1200	a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
Token: SeAuditPrivilege	2096	fxssvc.exe
Token: SeRestorePrivilege	4340	TieringEngineService.exe
Token: SeManageVolumePrivilege	4340	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4760	AgentService.exe
Token: SeBackupPrivilege	2668	vssvc.exe
Token: SeRestorePrivilege	2668	vssvc.exe
Token: SeAuditPrivilege	2668	vssvc.exe
Token: SeBackupPrivilege	652	wbengine.exe
Token: SeRestorePrivilege	652	wbengine.exe
Token: SeSecurityPrivilege	652	wbengine.exe
Token: 33	4460	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4460	SearchIndexer.exe
Token: SeDebugPrivilege	4848	alg.exe
Token: SeDebugPrivilege	4848	alg.exe
Token: SeDebugPrivilege	4848	alg.exe
Token: SeDebugPrivilege	2772	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2500	4460	SearchIndexer.exe	116
PID 4460 wrote to memory of 2500	4460	SearchIndexer.exe	116
PID 4460 wrote to memory of 3196	4460	SearchIndexer.exe	117
PID 4460 wrote to memory of 3196	4460	SearchIndexer.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a1d1d6c6b20060141807702114180840_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2008

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2824

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2996

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3608

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1736

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4632

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4808

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5108

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1740

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3308

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4364

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3132

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:652

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3148

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2500
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 1f9e8362ea2e1acd5fe5d53963eda52d5850c14ebdf7925c86dee01630f026d8
MD5 a7762458023d648845ec8aab38adb135
SHA1 e7452f3e0c6091ede2919aa531ad6799654d6241
SHA512 8a1338d5f9c7db317910db421a9e57476dac3dff370ebfed26deef12001a3469170231437b7610e7d8e990bb1470b322275d52009095464fba4c5218fdf6f530
SSDEEP 49152:RuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5AblI7a8K2mFhbrr:RPfTqi90b4lI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 34d1e9f7ba06b26e46b939afee773740bc1a07828cb52387dba5993291003fce
MD5 24f62bd40ad4245c5b778627feebfd79
SHA1 3eaccf15393af1a44fa85630837e132ced26c137
SHA512 81eb58a1b26bcd6582ad10a6881c65571e3d8fc3b6dbf34a1b33fa83881ea63728691f7b586a95b99f1b8b32b4afc9534a26f307cbc6f28b6c2d42e34e31b3fa
SSDEEP 24576:vidnBsuEtbl0fitGbna8FLk2m1X2D4brr:iSuyblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 39f7040a0d91a22354ada55ce0355d123f1c6ebe76816899b329179041c36152
MD5 802153815c6a88da2551002f233f74e0
SHA1 e6076d9347643f6c404ab47dc77ed5117867cecb
SHA512 ab3b4d177e35bab376985acebde7a93288e0bb2d38aa9db24f51f91fa28fd189430f88d304d45da3e16026b67844da2797f0f4e672aab9a47895a1ab5d861ef6
SSDEEP 24576:v+gkEVfh4CoJbl0fitGbna8FLk2m1X2D4brr:mgkExS7blI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6b6b5aa0a1d1edfe893f4d696462c98c379ee58b576d4cee1d038a45d9a43429
MD5 ed51de5fa353258ea3030225d141d0be
SHA1 72d87054eaba15bfe4750d32b7ab71945a43dfa3
SHA512 b778be835916a883a40602a582edb77faf32c1150cd489317839456d1add51405f54e5a701e0dbb1a11e83ea8b259af69f18fafcf78626afcbafe179c9f1694a
SSDEEP 24576:uBpDRmi78gkPXlyo0GxjrMbl0fitGbna8FLk2m1X2D4brr:aNRmi78gkPX4o0GxjgblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d9d7a2f0e6238f52583c49d47c0ea843fc84bfdaa278d1b543fc67a3c298d010
MD5 b9905422fff5b541899dfa29a0d98c8a
SHA1 da089f487bc252720a5086d1de56085461e440af
SHA512 6dc2cb56a08c3bfceacfd8b41f872a21e1ea6940eaf78fea7b12a46303626b7d0245f7b6d3982b23d7e5789c49e10f6e944e77f3286546d2ee4ca3ac50193d90
SSDEEP 24576:4LOS2oyPIXVJbl0fitGbna8FLk2m1X2D4brr:A/yIblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2e338faa49b57d8b2b67bfbad5776f1bf276a3a37c0827073fb5abf18f425466
MD5 cd9e7f556e1f9385681b113c57dfcc45
SHA1 3c5fdb179e3aafd0b951e5664a016d473a22f0f7
SHA512 c830e79cd6528b432366ec500dc63ba87ab898bc2c408ad089437d912cdad6c2311ad2d9553966761040d1bd5e8e059cc75e5c53d4f468f03feffdd535e50400
SSDEEP 12288:6fKSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:6fbbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 bbe038262f4691797a8b30021217222e886557b83c1b596d550b0afc3194e79c
MD5 bc9b81a1e039b7353e425a824f1407c8
SHA1 454ccc71395a1c4c8625463a56798ced2a106384
SHA512 51392599719200f6948ff6b354631e6975798781b1e3427b6f47cf14d52b24e7a3c3005df840b6c868df858da34c40407225744dcafd257e5ba2a7ab9cfda945
SSDEEP 12288:QeBNUbTVO86UjSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:QJIUWbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ee9bd39636f9a82b052d463a3f403f2ecf0cc0ff5d40dfdc22c12498df9a7d6c
MD5 575ce52d01f5f8b9c46622d1e9e98a9a
SHA1 2c85103e5a0648e53d16cbc3f2cd4ceda4092eb0
SHA512 01c788601a5b4df9aec09adf37ff7bd96f77e7240d0edf12dd96460e9bc60d5ed9313385aa1986ac8935a8ecc541bde58324f76878f79a579df746147abd6ed9
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THO:WQvGAdlCEL8c/yRNw5CZlI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 b59f5f5fa5bd8fe64e15241396a93bf0fe0bdd30706ef053604ee4875d767e3d
MD5 59d24d3bb071372e423d8618b47021cf
SHA1 3a42958650d286faac6286d63c27193cf2a52a89
SHA512 4356202bd728de2fe1d6fe642efe3a885de5cad405d00c7063901048880802c33e7ed2a0bd5d71ddd1715957da0250b2329076ebb7f291ea92f509a7f38f9aa1
SSDEEP 24576:YdewsAjUbl0fitGbna8FLk2m1X2D4brr:4ljUblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8baa40de1b215b48928ccd69ff4484dd6c22c628b64f514e8b4de593c632c7aa
MD5 4018cd0ffc1956e22abdf6ffdbeb0eb7
SHA1 03646baac804f590c6de7a21527ccede6a9c2e07
SHA512 3bbb959c03dd0940312c28d0899d9453283b61ac4e06b781747ad9bfb612f318d1e64c9411407f7114cef7cb38190417cbc0a455c4478e6b29ef20f093a46aca
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHAlqmX:nUEtQevvqc2W1cpV2EI32AI
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 65edd9a8d7eff3826609d8dd7f2f5d44582f6afe5c6bb7b90c8fac6b4180c07c
MD5 17aa5ebbef01fff025c77fe636390beb
SHA1 c016984e8ac2fb0df3c3dbe6f94755ae38097874
SHA512 f06751c7464749869df960ccc5bdc417eeb7f1a22a80a2b788754cda980a9383bb30af63603fa965d07a375c2fe138ab8792e68e3c8e40e055e630c32e366448
SSDEEP 49152:RCbRquA/m2yL5zTfFiV+XenmE3/z0blI7a8K2mFhbrr:eoquVjnmNlI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c8d7a932e8ff651ddf4085ab9cd8db967d47627770aecc8d2647be286b417ebe
MD5 333024bc81deaa58f3f14ea7528eded3
SHA1 4c1e23b824cc43afa0c9a8ea05800376ecdd325a
SHA512 b13f6a2b1dbf2d00aa73d21b63934d1e410ce27a8b2f2c95cfb226098f17a89f8c7e9e4a83763c9d7508f8939cbc836f05b6f1d1ff80a9020844067046fbf49c
SSDEEP 24576:BAhGLJIFoiwtA5l7S53Zbl0fitGbna8FLk2m1X2D4brr:BAMyFoiq5pblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 fa8fd47896a4d1c89109de09cc77dca9659a3f02b1d0ac18fd8c43a1e81fb43d
MD5 5efc22324f5c883fd71dee66d6ee0793
SHA1 36b6d773349c06eee077f6b6eca80ed2eb81810a
SHA512 3d6994d5e14f1be020e3a183639af72973f86b36ede077ee69bb338ababccdc57f6e3a5af90c633bfdf78ef67c44c41ac4dd67b9ec5c5bab9fc8eb930e3e0afb
SSDEEP 12288:fmw5HEjsChNVBFgl0WDm+C8Sbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2co:ewuoOWIbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 33deea01244ceccf14e71e0911d9967d7b53ffd46b258ff6bbd815639c983450
MD5 2bde5239ab30a3ec506736490b724ec6
SHA1 6362f0a6523aa8d2f6e319fa25c82a33911c4df3
SHA512 fc6fd4b5641c85046c23d7c855932aeab92c18fe43378bbd4a0fef70d26d705d8bb3457e94d865c520ad1397a18c3ea43384a3ffd34828d00c3feb61c6a0d153
SSDEEP 12288:7BZ1IyJSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:VZunbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 5b7d765d7d4078e838781556d320a3c8f028f314a474d2178072c3e37d70b204
MD5 baee225858f266abeb8d79c751a52af4
SHA1 7a0849b17b8c489961590715036fb04344f33120
SHA512 ec1d9fe7fc249c816a1b636fdbf571e7175c5065bbe9b946d563bfc25d23b3e8d3d7f4e24ee9c5b6dfdcf9bde0ce56bfeff1a687db9716c3d92dfa7a48ae48ff
SSDEEP 98304:wwfhY7g/rLd7yYA3awr341gllI7K2mF9:M78yhllqmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 8cd0fca755b538d41b0d03e4e3f6ec49f56c016d15b2d0f3634cf4829b96cd01
MD5 c3b1d1cf197b092c6edaa2c388e6b66d
SHA1 57e4079746786ecc87ebfd992a19664ec0b9037d
SHA512 4e7cd69122b165800404f4f8a4459a2dd87d352a5b3b3aec3210e7292db821070bef9cb46f0713f57b5a0dbc971d0c271d6290723a7ee12bdac797a461fa9e1b
SSDEEP 98304:+wfhY7g/rLd7yYA3awr341gllI7K2mF9:u78yhllqmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 5f81d2e89db53ed4771852db4779523292eb35c4dcf445f734337745d715dc4a
MD5 9275769fabafbe901b0e48188f8d6ac5
SHA1 ab9f9aec079b86d5f7e1731a7ee7189df81ce796
SHA512 11c290547679199eeb5613f4e5ddc4d7ad9ca6a0fecd39050f2ceff785a7a5593bc06f3c39fa270cdfe9af26096fd3a0d46e343e8b8cec24aed356351c60dafd
SSDEEP 24576:3cTyYv0FteQU+5I2kjgD6iQacAIbl0fitGbna8FLk2m1X2D4brr:3uXv0Ftpn5606zOIblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 873366178eb13ac7916ebc94b85c243afcadfe9583a1a9633f27729d83300889
MD5 b0b898f8156c74a171af4aad9115ce9a
SHA1 e5088b6fb58bff953184f6353cc5cb87eabdc403
SHA512 e8d270420983c76876e4337fa2fd5b6948138314565aa7e1cc4b08f8feaf7ca151c9ae988940e26c9cf26076a2f38b65b4cd79fd68e5775a62b1abf30207d45b
SSDEEP 49152:Uy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxUblI7a8K2mFhbrr:jmYeyxHjWjMT4lI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 81d15fd3ec6579c017b547a5789ddcbabb42186482a2ef87538a92dfcc92507d
MD5 98f8f8a1fd7b9e343bb8c3a0aa4d54e7
SHA1 1cb03c4135fb43307e0aa9d912e61216d4d7a74f
SHA512 1f9bdccbc05a364c09c6f57a0d3ebb792a52244c6a7e3e402b2551ed8e43715cef68a3d2732b28795113395367dc966cb7a4bd81b7d25e5d3c92436e22fd9613
SSDEEP 24576:76drZn1WEci182IEUeNbJeRgUebgW816Pbl0fitGbna8FLk2m1X2D4brr:7WnDci18yNNUgbYAblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 7d47dc20b2a57bd0a488bb864abb3ca163d010d4ee9de3f2bc626bf067a025f7
MD5 cfcc3e1770d337a632b834f83a06c175
SHA1 34a15eb249ea1b927a6a385a894bf2a7bca2537e
SHA512 4287392cd5858fbf1b7a0fba7171bdf024dc6eb5b8bb5e1aeb863259c4f73a071edbe7c83460d0d3b8443f2677e614e63b4f2d90ad393324ee02ca33baa084e4
SSDEEP 24576:dk5lHW5EzMZupO80G2reD+melRgTTv/1nyybl0fitGbna8FLk2m1X2D4brr:JizMZm0GhamSonblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 fbcc49955f26e5bd079054a86a307155ae98a44193ec3d9f8e454a0381a2996f
MD5 93edbf7ecc1ab5b6fc13b0058922d978
SHA1 ecab2185a4ea091055ba7610b6360c75b48c39ba
SHA512 cd17ab40e8f95a0e37d41b602097395133b58b8554ce292576f7403b57d1061da2f80355669a247ab8d173fd774aca028008278623edd6a8dc042b7efcebc990
SSDEEP 12288:GiSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:GTbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 01e04f8615c2fd9b0570305ccee2a1cf7224909634dfd0aefa73185703c0b55e
MD5 f709e3e3bf210f208fe36c86aacb70f1
SHA1 4eb3f23d8082dad4b341c0f90489004bd957b96e
SHA512 e86f95d1d3bd35781d54ce0291106a76f6a1a19cc54c69260aca5477149215f978b6e0c9bcd058e9d5a434d26f27837333b9842f1bf7a1ccbe53e9581b5fa8da
SSDEEP 12288:UtSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:Uwbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 fd780f4808ed435c1ab9e45b5467800abcf22d9dfdb0d297bb28f517844c4493
MD5 27bcffdca2c23e7789b5b7a2495aed58
SHA1 5827e58c04b6ae3ff75efcef8e1ad3a428333a78
SHA512 f6bb01af16cc538e0ca04d92e8a3b58c080b1bff98086e5789d59cef5add0a30e369ac63ff4d27279ec4d8e37dfcd032a09fb3470c5ffce20f481a16657fe98c
SSDEEP 12288:TbSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:Tubl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 0db6d678f3cc31a86977c3ddd2594757ae70d9067f76df50583e67b7b11e1ecd
MD5 6c6429b91cc14fa623093c690da619af
SHA1 84a414e251be4bdd28d87512ff0a86f3c541be14
SHA512 7561dce49502d3231d452ecf0e9fb168b16dd5761d8348bfa15809454c2700f81492fd3c9be3e798c6db0b40aca42e6580a8b1a446cb48b8e2485a9ab2d94100
SSDEEP 12288:qV4Sbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:Abl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d15579aa6d5ab973a9e371cf18e392d84d643123a449ebdf1e61713074b30e72
MD5 be9f7e269e02485454efca3a4cc81c63
SHA1 cd17b05f0dc40fa5ea41241fa4031421077ff3e2
SHA512 4fc5e8b14602df4bf6600c9910f8378728ecffc61bd0bd4efbd17045db293c2f314ed28aee8246e2cedfa59e25ab09c42595051aedca47b005383b87fb37be40
SSDEEP 12288:DgSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:Dhbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 67f90855e3c9d4264aa66265365671b080064e6911d07575be71e8405a1bd311
MD5 27ce568e1307cb1df81bc14b56cb50c0
SHA1 b2a8bba4cab1e6c184bf60762daea0925b2e4e9e
SHA512 5560b535d3d3d5ff783878fbe7ef0d245be07f3c86cf49a1747afd5795b6f9745e0024316961179bcd4b7cae9d69428dbae3f68df21fec730c0291e0d8142f59
SSDEEP 12288:2RSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:2Mbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ded9b947d0bef98fa1ba4423726406b3338d13aab0535fb980485665a550c331
MD5 d5a4612c918cf2c079feabe31c068cd0
SHA1 da992691f6a4db306ef997e7beac5c1c197a1e2e
SHA512 36a078e984b7d7047f4183e3b2f054a662f94708506eb4e01b76bfc6cf8c4aacb5e1c31b781cc76a2506dd30214117bcf226e1dbcd8e4de268d1684affc96e5e
SSDEEP 12288:H1Sbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:HYbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 01f47b804ad2e5602c11fc13332458a5f3e689fe094c0ab6ffb93bfb1b2b142d
MD5 0202af59298c187dcaed685e97c206e5
SHA1 4ecea6cbb09e235b23735de3078099e74e88e037
SHA512 8aaaf5c906317e5cc4c27804d7c9a49f92f1b0280e1a0e5aaac6e4b12d3bd3a7b671f16a3745dace3bd5c681b23ef8ed05f7f202e18343cb2a6fec5ecd838531
SSDEEP 24576:TZMSzFVSOQbl0fitGbna8FLk2m1X2D4brr:TZMSzf8blI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c4d0b12c1360be1771bd3e065cbc7bac55bf4206cee7ef26b84aa13276760e7a
MD5 c9e20929981319483929681ad07cf16c
SHA1 b470e7ef972269535649b4dabadc3b053ced6f7b
SHA512 8404190c880f96efa200c17d0ffa6c81fe265e338e95c5047418cb1262dac553c5f0d441f80869c7478c1fd48bd9eb69707d80dcf2ea39e47671ce592f06387a
SSDEEP 12288:xeSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:xXbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6e5ca48e878a6156f4981d9072ad2c1b6753cfbfdd74b324f4a4196dde52977a
MD5 29343c978c47a041cd3e442290430228
SHA1 90d00358d5273df84a46574244927b2a0a0560cf
SHA512 38875043e35e18ae86b0961856f7e9080703dc8afcf8a207559904dfebf1c7bfa0308e8e81c9c63e400d0e8c4612e0d80b6ac2d57bca43147d9de111702a266f
SSDEEP 12288:zaSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:zLbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 74e774266fd9be4820c41b09629846304f02bf11354229d19a51de89501d1751
MD5 ba5fcc555eea96ad43c1334b2a5b787c
SHA1 2b4ba00a4f2b393b017b865903c0754c10d399e6
SHA512 6612ef9b05d5d590ddaae0ad44a4a11a64a6c86bd0a877a20bc05d4c5e60078ea126e25fad8b1952d8dbdb6630b880158b199f0f5c046f1f9b6d1e8157e352fe
SSDEEP 12288:8yPz5L8JSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:lzyEbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 771fd5cf661770891e7cdaa2eb709c358c74e9a20b5d4d35a6b6b347030236d7
MD5 d2ae1f907c24af47371cea7c06ac3a85
SHA1 03eaa422be86d368f9dd5ffe654f32e51c7989df
SHA512 c487ac9b33e1b8690a67590a1d90e2c04811b4f959a9cc3ebffde05f02e38fb8bcf5bc0c416eb1951c9905e7fca2fe4f9c315e1ee5445cf8708b9f6ed8082a6a
SSDEEP 12288:5eSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:5Xbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 ebd60a37438c0c0752ee7d832226aac832e3e6b6a63f8c82f1f56f03772eef54
MD5 064540b0b4c7e41e515b77be9e4fff2e
SHA1 66c37b3ced37fcc532708f9d66fed0208181a401
SHA512 0798755e04fe916beb8b2997b38d7158c0b5613d3a51868dca95031a0c3f78216d2449ccdc825ced6c353a36d01deff77763706c51a0925055952b70a83a5dba
SSDEEP 12288:BeSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:BXbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 3c69083b78534a6459f555c6d3a9d8fff7ba7ca26557edf347df3bd921092b45
MD5 096d4117101f07681a258b5449330973
SHA1 94c3d5b61204a5c579acb0966a62a471832372cc
SHA512 d81d497baad1c9494ca23268f7600f650556101234cade0bf3a177a0f8d780a424a567f4d778737b145e8d5c40bf549c46797de35b2af016c5ef9cb3911235fa
SSDEEP 12288:ZyPz5L8JSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:YzyEbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 947d2c56c2f5a377ca03d5d2b27e9d6ea601e7fbc00532e4399d645a83904e67
MD5 54f8720df61b46b947fe950701b71f41
SHA1 f381eff5a45c9ba20be9ad26044e76aeb05b5758
SHA512 d43ad333d7e9f68f41054530cd42f8519826b0358266d3823ccf1c26e42f272c585f05a124dfc637ff3d5c21df835a853d0247571d5e063c55f731f9d202506b
SSDEEP 24576:3THaLl3z0zD+bl0fitGbna8FLk2m1X2D4brr:3T6LljlblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 d758f482493f9a728c62a5fcf1b9f5c7382200f8fd2f646d644ad8cf75e8e48a
MD5 9523f9b7db7a2988d2028f7fa2c6b94e
SHA1 3db1b89a298683fe45db3151bbe455c287e9400b
SHA512 43caecdae85f5660641ca94bfe7dd89ac9e3dce14e1108f377b2b15a8a7c3f3c5ba0d4599184b44b12fd2d2a7798009428b9e56f3bc726182b315fc75c15e2a1
SSDEEP 24576:o37d9CHKy7GZ6bl0fitGbna8FLk2m1X2D4brr:y7d9CHKya8blI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 f019e79491eb123a197153c67be2d2f0209aff5d51e97d5051a978d57ac7ee23
MD5 a9a3a7ead1a5131840f8765129af52ba
SHA1 b2b2cf49f354891c093ff12be3631129b149a353
SHA512 9285c61ad6381a88a1ada302fdf333959fefa3fd74271d553efc177a80fc3bd41e0a377bc3da5b011df25483b9d7c909350bcbb4cccfbec734aa5daf3986dc23
SSDEEP 12288:S7Sbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:SObl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 d72943731489cf66b14892e702d56d84e8a20dbee8bdca4c775da90a258fbd1a
MD5 419f9c942f73a67a9624d0210721f7c0
SHA1 05232f00118371356a0a594129ec5d6012f736d0
SHA512 fd5b76d667b40890478b68f68dcbf3f94e8a56155561d88fd3e159e6f8a6cbcba922851f4f8945f703463dee55718d3aa98b18bb054d57cdf34a1f10d87919e2
SSDEEP 24576:KcP4mcvIjkGOxhKP2l71SNKbrh/8KBfbl0fitGbna8FLk2m1X2D4brr:VP4m4IpOO67N8KVblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 2138604f652aef9facefeb6c18a2d4cb3da54b572feda35ccad148308fbd4a3a
MD5 7b9419e68073257fc40cf04e937af448
SHA1 1ccf46bcdc1fdd13e6db4ba31e42368e72afcb05
SHA512 3c0c6bc746ba973c5f2710763ef94e97bde65138cd752c4b99e824599550f83d3caa3ff4047ab64518deeae2703d5fc2a7391a11e33703c884aa654ce3a3ebad
SSDEEP 12288:sUFmDDL/Sbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:uKbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 517175ca7f7a5cbbad1ca6018d6b6cbd5f0f1ea2b8bbfb78667c85667134c5f2
MD5 1f47d6a9eb9853441c4f8987cd44ff66
SHA1 0b9528aa113dc6f1b9bc8207d0db1704c6faa95c
SHA512 d81043517972bdf5ae1d9722711d1d85129bec3cdcbcbc4e8fae96ba0e24a7fc42164bc9561bc9e3035b9d0af3ed1cb115a577eefd9ad8c53bc3b66e31c1fc2c
SSDEEP 12288:KuSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:KHbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7ccdd9fc0a072c294e443daaff995ada352903dc4d4b094c99ec3bb7089b1d61
MD5 653ebfbc06149f0c00983ad03a2b54a6
SHA1 84eef28fe55903e31bfa848a49896315b8e9add3
SHA512 6d50229c398bba896fb545f2164dcc6554dd0ba44e2bc95e7460257e6a3801a27e71113b663f633e6e6372a68745ade0e83852b72de5e4c049f53917e6cdd276
SSDEEP 49152:ka0h2GEkuAe73q3pp46zwwQhblI7a8K2mFhbrr:ka0hNYG4JwAlI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 bb63c81c547f2647b07cfbe5d851763517cb19d52b8e70a8841fa49cff26a318
MD5 d8c650f604774c01e81bc00e576aec64
SHA1 b5aaf9e2235f6a203503d88171f4ebc3ddf21f11
SHA512 2579deaecacd7a85806dc1e85ea03a34704ac4af96cc4bd70d312dfdd09fa8894d3990e0a3243f7350d1789860f65ae2fe19396740f6a9e6681138595599eb76
SSDEEP 12288:9hbHjfXdSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:9hbHjPAbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6305a3e6b5841939cdf20514d7513ddeabf8cbb8929dcb87ed8aee5488dc4e5f
MD5 82cc3845ecb29aa67229169d956718c3
SHA1 2beb0c38f485c3326d6cde1fdaf331bd0b51ec52
SHA512 648f3c07397e81a0790902664ceab670d6417d26a1c9598b22107aed1acd98d8ffce04648d0264edc6234ae017c0b680bf248bc9c76598b80d1bccc8bde02041
SSDEEP 24576:v3YgnJcRTk4yti+R5dpR/Ibl0fitGbna8FLk2m1X2D4brr:vIgnaTk46ppR/IblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 eac10e026059b0849e6a5cbd739c7ceb4c4f9af4432eb4ad7d9ffcc9f023907c
MD5 0b837228679094e76be7841251caea76
SHA1 e85344e1159ea2f53923b08fa1abc4524e2b2b83
SHA512 a5cd1a80f01b2929565fe9a6912fb0023e2178a56fea83f368555eb022ddb4fe5ff9ac11a1b6d95e475732d6f03971b4eeafdf99c35cab1da846924d579b6137
SSDEEP 12288:tqSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:t7bl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 693ed12d54efea8501d9612563d8eb0c0b829f1f20ccb6c0d11cee6eb48630ef
MD5 c850a513ca37623912947b7ef84f6bd9
SHA1 eb2a03b0912d0059fd18bba4de688e0999adabc4
SHA512 a1acac7b90e4fce3e2a0d51d81b6b6d26e9157a81fc1ff64de97f664ef260628769399b60c8e7b0ef83591c2ecc01e2cc9860671bf170c96844b10ff6c7ba00d
SSDEEP 12288:WOb9A4LWOsvAYFTXSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:/pL3UTibl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 096d5ea6876629c2d5f303fe4b2b9647d6d699abf597e6f547c56ee811516542
MD5 6e648df040c61e67efb73ddf97ec14a8
SHA1 0b97ee5d31ae0e48d8937cfcb3c3f8c61ea796cb
SHA512 48bda0300d8db9d408ea4bf976f4791efc8ad68c5362b839deda5e9bfa04c9d337e587134b3d42fd5b16109e1aea5f7096658d1fe2a332c441c9c4824a3221a4
SSDEEP 12288:KpFtpODSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:IO2bl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dba387908599eb36112b5eafb442959c70b9b39129d5ef67cfdb143e2e873637
MD5 3d4a9a8fab5b59de6f2c85672da6a7c7
SHA1 cf0d9d99a8aa626a9afbb1c64c962d24c21c7972
SHA512 efbf3e8e6d72b392d7c66d05ba314bbf16c4f276bd76c5297a26836eabf70c5dd6e60f0b92d3619967ee9d2426e676ac6e21780b4037722b795bd88633e284b9
SSDEEP 24576:J7NM9YmZqmWMUkPjZM48Mv6bEhsXbl0fitGbna8FLk2m1X2D4brr:J7cBWMpPjN8DbEhgblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1c0e91c09a1477cff4a8006b07a9f833ccd833bd51436fa6ae7e5da7508a0b8b
MD5 9f476d48b5c2e06edc7a977c94990cc1
SHA1 7e71abcf2e22ed6e6dac27ca24671ad43f922d12
SHA512 02dc60a90e5db7767dc63d9f338e144a7d7f29ed857b9b997108bddf6b9956bee1982859fbb6a3439321a492199a13f976cddd03f41a7c7fcb8fbef8c7280b1c
SSDEEP 49152:aF2YuHNETovcvNYf8km3blI7a8K2mFhbrr:T6tCf8kKlI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 91c23d6dcd411f5e43dd40bdcb428d25e7ca3067ea88f21ab87ef843bb13147c
MD5 d874fbbda9be28c2a2222c862eaeb619
SHA1 416c6acc561639c3af2c6b6364df20b701072d21
SHA512 f1e651d4457326e9247bafc06e70ce1d4177a3e968c3f669f26f9e6eb3b711ffef000e5fde014d699758eb422e8e93b0af1596f5241fd9a882fc486d28709063
SSDEEP 24576:HAFs06+Omlf3NXEbTo6bl0fitGbna8FLk2m1X2D4brr:gFs060lVXuBblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 8fa851caa09ab64e4e818a5985a0175c06b1bd668f8ac17812a54937025f3d9f
MD5 fb073197ec659dc659cda90449b59f70
SHA1 aaa352fac09d4d7d0827dc1bf60fcfb151b12129
SHA512 22e3ed8b5a7de1b1f8ad4b10d1ea6b538b28c4481e38c1a4f72bd464e4a7adcb337aa10c4800316dab59f1ae9084f7d84421034774f9ecfb05de2c2efcd30ec6
SSDEEP 24576:jJnJ5D3WtBbl0fitGbna8FLk2m1X2D4brr:jJnJ5DGtBblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 262267f6c1e4beb4df927214da55eed5c9d7448f4a64c4443596f2c71a6915ce
MD5 09e900568e86022c5018d67a0798ca23
SHA1 89ee737fffd385b60825827a5a7782e023ab4fc2
SHA512 83dadbc96d8b27444c2e3aecc2ba15ad60f98d3cc31a8b7145552c50900ca74e1068a010e60ec93c4e1ed9af561b0343218213d4d815e77b485bc8e2ecf6ec02
SSDEEP 49152:so06DIKdwc+eQnSt65aVTblI7a8K2mFhbrr:hRlI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 eeac65f1854dc6a07c18f475a620c50495c8cde8a74c7d3b6f9be7cd76f90260
MD5 5e031d9814be788827d4970327124664
SHA1 7b8a62ac455e1e9f62c771d8717066687c6f599e
SHA512 023a31691d211124616b0c3d3b613f9839c12d35c94310738b346cd3834109dbaa3dd42aaff74f9ea7a851f36f5e055a3f362ce3ba59958d4ca4d18076938b73
SSDEEP 12288:PEP3Rr8Sbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:UrFbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 277eafc5fcd303cb0b50f0607144b5c2399c5625185cd5143c3a0a053106e20b
MD5 c54d298ae1b8e577e2d758d4cfcc4c57
SHA1 dbb2dea177b8441db9d029621f864a6478139b51
SHA512 4b28731a92f27d8a78a6fe2f480e31434b5417ca35bad38737172532d47445bec213699ff7ef2378f0c26de23cd2cc7d4fc847f15981c353c93002b266aca10c
SSDEEP 12288:AjkytSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:AIywbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 a504a7abf40f11bea002faee03fd5c4485132780410d50e05208b55270ca2f4c
MD5 75b95aa3099a6571971c2cfb8ea62dd1
SHA1 91e326fc096c228875237b65fbe97c39b44cead3
SHA512 f1faba8a1df9efbfc23b98c49e2b824d27bbf4bbc053fcf04bd0c2e9cacebb89fe53d8587b0201365c3324c98c148c28f5b6945d6f983c5a4a7c1c90af2ce9a5
SSDEEP 12288:7FTSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:5mbl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 78254cc0074c7b1d9d3bc3d2d4515de556e155a81b5bee3bff924fc8c596e02e
MD5 82cc8a81a0722af711b53777a12b79f8
SHA1 dec80cff28d784d7a833bc471992885df3a2fe4d
SHA512 0316e8f08c944ba5e7367a03d72c18170ac4f0fc7d9ff50aa7a64e7cf8de79451fd0fda65fbb9613eb1ad93387c6bcd786991b200e23eb3d011a45048bf8a4b4
SSDEEP 24576:FQ9MxZKdcz97w3vbl0fitGbna8FLk2m1X2D4brr:FVKXvblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 fdd1eb8f798427e400d35d7b0622d84b20b048b6b01a870a99141d330734ed4f
MD5 e241ef45e121d73227b6e15e160053d9
SHA1 ac4e4ba1f827b7f0fefed5fd2335193734319384
SHA512 5c4a37598b66106a53010582c17adc6693b955e222303c5d8334360942f0a8189167b25d1d3edf8008ab30dba4abebacf07f3cf424445fe631a9eed8f60f12ff
SSDEEP 24576:8yocxApUbl0fitGbna8FLk2m1X2D4brr:hocxApUblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a7e8113fc1cf974aa844223940e484c107d888bfd4d61e246f2186d6f387ff85
MD5 e9b44ca527ba801cd9d0c4c28f0bbc1b
SHA1 d0288a69458c09c104b9b1491f7c556a0e70e07e
SHA512 f99f65ff82b0a4bd53f5d115b8848f6a301f5cec96d5906c2df2906af42de300811dda59a12ee5de067189125238faaf40bdffe8e0b909e5c2e3698d77c409d0
SSDEEP 49152:qWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKUblI7a8K2mFhbrr:s0zuNIMlI7K2mF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d106b87c55f85ea5146b1f1cf655cb177689e4d1263f8f76af01cb8b531bf2b1
MD5 4279eb7b431c57acda2181b6f88242e4
SHA1 addcf9bebaf65c75e13cc2f0a8efc4544f4d9fc5
SHA512 6ef0ad9030f4ead07861e2668a37af21fd4ff46fa0ff9dda6da07c34c783b8a0a4b41baac6cb4324d6d1f1b5dac4839c460200eb6b58baee6dbf5b409f527f01
SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYtjMqbFbl0fitGbna8FLk2m1X2D4brr:3TDxR+N5YzTfjMWblI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 a743d67a0e0fcb1a88684d52e64d0eb3cbc0a7b2921c27bdecdee2cc3262fe15
MD5 59fdcf19e4804577013f044b0820bf2f
SHA1 6f76b062293e04ea30167815f9906312d0fe2151
SHA512 9abacb783a95b4490965c59c983aa7e6d3679d01ad85667896c74516a41891a8f08f0ae26229fb61dda3dd2c9274b5b14d9c77c4cc384c94ca47df559d66a6fe
SSDEEP 24576:CTMdOz0FFS+imSL5bl0fitGbna8FLk2m1X2D4brr:O0K+imSL5blI7a8K2mFhbrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 2027ec0753cae350845aa0353f201061b480d84cdb441b68d5c38c178fc7885f
MD5 c1d8d1c3b37fd1292d65d76f702aa21f
SHA1 2addbbc6bd829a5bf56f00f05ac42f7424bfc0cf
SHA512 ad36502db83dbca052f7b71b1e697413f92eafabf40fed7cb7d8adc18c48dfb7d984b06d17f01aadb60533ad765e3afbfe610e96de6fd1f68ae9d14571f5cc9f
SSDEEP 12288:747XSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:Oibl0fitGbna8FLk2m1X2D4brr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/652-655-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/652-242-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1200-100-0x0000000010000000-0x00000000100A7000-memory.dmp

Download

memory/1200-0-0x0000000010000000-0x00000000100A7000-memory.dmp

Download

memory/1200-9-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/1200-454-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/1200-453-0x0000000010000000-0x00000000100A7000-memory.dmp

Download

memory/1200-2-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/1648-535-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1648-181-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1736-229-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1736-117-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1740-164-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1740-505-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2096-59-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/2096-61-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2096-47-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/2096-39-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/2096-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2668-230-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2668-652-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2772-26-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2772-35-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2772-33-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2772-132-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2824-56-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2824-57-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2824-50-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2824-175-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2996-70-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2996-64-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2996-72-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2996-180-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3132-218-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3132-537-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3148-656-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3148-254-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3308-176-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3308-518-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3608-90-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3608-101-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4144-217-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4144-109-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4244-83-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4244-75-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4244-88-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4244-86-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4244-81-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4340-536-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4340-192-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4460-267-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4460-657-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4632-241-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4632-130-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4760-203-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4760-215-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4808-133-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4808-253-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4848-14-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4848-20-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4848-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4848-116-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5108-266-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5108-512-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5108-144-0x0000000140000000-0x00000001401D7000-memory.dmp

Download