a93b1725802b61f22d96bf4bcb897b5bf557ea43121fc332acf8961627ab6881

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
Size 5.4MB
Sample240603-vkn7eada8z
SHA256 a93b1725802b61f22d96bf4bcb897b5bf557ea43121fc332acf8961627ab6881
MD5 b4888f76568357d80b42682f32d0cfc0
SHA1 3784e4c54f681724b63157beb8f8c46d8a64471c
SHA512 e7a949639da594b67a039443f10f1300cf7bb61c049fd1bc6c60d2d20d46abd2b42008bce51280cbaaa5049a558a1fadbffe9147bcb4a0e5a2b29281f776c8e1
SSDEEP 98304:NuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0f:s7wq1W6HqULS8djZDTaNNeCKVP5ORsg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
3496	alg.exe
2372	DiagnosticsHub.StandardCollector.Service.exe
3788	fxssvc.exe
1784	Setup.exe
3244	elevation_service.exe
2776	elevation_service.exe
1716	maintenanceservice.exe
1656	msdtc.exe
3364	OSE.EXE
3088	PerceptionSimulationService.exe
4848	perfhost.exe
2152	locator.exe
3584	SensorDataService.exe
3396	snmptrap.exe
2956	spectrum.exe
396	ssh-agent.exe
3544	TieringEngineService.exe
4068	AgentService.exe
372	vds.exe
2264	vssvc.exe
776	wbengine.exe
4608	WmiApSrv.exe
4084	SearchIndexer.exe

Loads dropped DLL 5 IoCs

pid	Process
1784	Setup.exe
1784	Setup.exe
1784	Setup.exe
1784	Setup.exe
1784	Setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\vssvc.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fc5de37492be0f3e.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\msdtc.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\java.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009aa895ecd7b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa7b0aedd7b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f537cebd7b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e15c49ecd7b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000727767edd7b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000636e7becd7b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1784	Setup.exe
1784	Setup.exe
1784	Setup.exe
1784	Setup.exe
1784	Setup.exe
1784	Setup.exe
1784	Setup.exe
1784	Setup.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
Token: SeAuditPrivilege	3788	fxssvc.exe
Token: SeRestorePrivilege	3544	TieringEngineService.exe
Token: SeManageVolumePrivilege	3544	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4068	AgentService.exe
Token: SeBackupPrivilege	2264	vssvc.exe
Token: SeRestorePrivilege	2264	vssvc.exe
Token: SeAuditPrivilege	2264	vssvc.exe
Token: SeBackupPrivilege	776	wbengine.exe
Token: SeRestorePrivilege	776	wbengine.exe
Token: SeSecurityPrivilege	776	wbengine.exe
Token: 33	4084	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeDebugPrivilege	4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
Token: SeDebugPrivilege	4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
Token: SeDebugPrivilege	4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
Token: SeDebugPrivilege	4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
Token: SeDebugPrivilege	4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3496	alg.exe
Token: SeDebugPrivilege	3496	alg.exe
Token: SeDebugPrivilege	3496	alg.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 1784	4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe	86
PID 4664 wrote to memory of 1784	4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe	86
PID 4664 wrote to memory of 1784	4664	b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe	86
PID 4084 wrote to memory of 4344	4084	SearchIndexer.exe	111
PID 4084 wrote to memory of 4344	4084	SearchIndexer.exe	111
PID 4084 wrote to memory of 3916	4084	SearchIndexer.exe	112
PID 4084 wrote to memory of 3916	4084	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b4888f76568357d80b42682f32d0cfc0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- \??\c:\fa2c2664a5c9c947eb6954\Setup.exe
  c:\fa2c2664a5c9c947eb6954\Setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1784

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:324

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3788

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2776

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1716

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1656

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3364

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3088

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4848

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2152

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3584

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3396

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2956

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3704

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:776

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4608

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4344
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 35c6a31a10ebfdbf573de985211008e08201e2089f0eae3a6ca424a78cc5f806
MD5 ead15656c4c89567c9e9cd6a18080c10
SHA1 0d99d6928d9d1497eae070983a3949fdd59df734
SHA512 263cf9f926a9b78a086553167b3b45ac6220c99e8739301205cbd3d044fc4074c8f5844605af75a89ac853aad607cca49e93bd29700e51d9636fd294f7829801
SSDEEP 49152:SuYk3H5koUzfTqkkYLO/W2buywzMbOX+T7z5nQKKYpWwl1+NY:S7fTqi90bTKYpfg
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 1b6b355a88a1d5e2741c33cc2783d86c7ff572441df1776b648bad4d4142bbab
MD5 4312d927cebe0e5c321d043c557133aa
SHA1 48c256f9f9f8717d8d5724510982eec0f769fcbc
SHA512 8533368cc1d1de82cc22273c8468c55b3d4517f74452490795ddced1223d4bd2f14913ceebaa1d52aa2bcaf2ba85e8a6c0eced221560ce8cc7fefcaa6cbcfacf
SSDEEP 12288:icQi6mNJLBsunEoJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:MiPnBsuEovoKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6deb277dee2794dbc6ee721b57822c28da08a6d851945102092a2abba85910b9
MD5 a0b37d5a88e854d72968d35bd24331c9
SHA1 ab5ea5cf0ca768f8c5024a3f0bd8ef1e4b13920e
SHA512 ca19e5132e7d79b3c067a1d80a35d60a62d63f291218dd2d6e206d914896cfc5d70a60652dae10f2b5efcae07a367865b4004b924b1e44222f49b0e86e60ebd7
SSDEEP 24576:x+gkEHfh4CosvoKFLgYHJWwl24C15rDY:4gkE/SmQKKYpWwl1+NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5af6b54c4e50aff8762229ef8833073ca84c0b16bef850da61fd094c2d96ffad
MD5 6d03881724af4a3e1425db903213df2f
SHA1 46f1219657400c7944b71939416fdaf5e382ccb3
SHA512 1146c373176390386f5ee742f43ba6d501286ec23d712825996e85cf51880924d31e37c7bc920144bc90da252cf1dc6f70bb790aab472f7c3ed79ffabc384359
SSDEEP 24576:EBpDRmi78gkPXlyo0GtjrrvoKFLgYHJWwl24C15rDY:ANRmi78gkPX4o0GtjHQKKYpWwl1+NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 998607ceac7106c1cec597c521f1d3bb8de14518fbe4b2d97d155363126d2ce2
MD5 4dcdc01494cd0dcb5bbcbdce671bfa77
SHA1 b1e0549ae7633789a8430b643b5b614e7e4ac942
SHA512 0e3e5f37a50e99068cd4eb84924bbb488355fba456d8b22b470f209000875e3fd35b016d6b1ddf08727214284d8ce8dcee0ddd79a4890c92dd254ef07e95b7b1
SSDEEP 24576:lLOS2oTPIXVsvoKFLgYHJWwl24C15rDY:P/TvQKKYpWwl1+NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c432849a7700210c431b5b4598607603bee0b04f4056c9f0b5662b0f7ffad853
MD5 e14a2b6ce7da4ad70385e3e4df3e82d2
SHA1 99f1b20c3bcd7bfaee16fbf05cc35423ea203abc
SHA512 b87cffc7313ee6327ed62711e5586df900e5ed1173a372ab91f3d468c89f6277070994438475cd625e7a79b1357e945347ddf1c0b167957a5c877cf72c7adb8e
SSDEEP 12288:3mw5HEjsChNVBFgl0WDm+CgJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb+:Wwu4OWvvoKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 08808943b61f4d3a62c2400c50c9da2a6d818d9503725c4bc818e2517e36ea99
MD5 89421dccfcdc9a283725a8ba884b6dd6
SHA1 75d6784c6602f7de976de1c3baacf17a4bf892b2
SHA512 b9aa3b802d841209f655fd66a6b84ef7c2c3e21b3f04e9e706b2f906e3cc2b755d20c4c445b249c2528f75a8e8f7c34179de6d85e39f57ad8b54c40b5de2e82d
SSDEEP 49152:Ry7mTd0GxN8jyyncHjXKUyn4GVcbDSKrNTxzQKKYpWwl1+NY:smYeycHjWjMTTKYpfg
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 49fcaa039fe0cf92473b8fc2006bae326a5b9627e663269ad6c0d3c05305fcb8
MD5 d83b64390b9ed7665d284405d8f498b2
SHA1 d32db3a3b8cbf532a333e9ff1393d82965ebac8f
SHA512 26ce242b35c9c0ba8ef0b83317a45703332fe8915e14803237837332473dbb51ac9998f2786a5656f649611ba1a6acc96998d35410c0e32d31a5c86019dd5b8d
SSDEEP 24576:/cP4mcvIjkGOxhKP2l71SNKbrh/8KBivoKFLgYHJWwl24C15rDY:UP4m4IpOO67N8KwQKKYpWwl1+NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

HFI3A99.tmp.html

Path C:\Users\Admin\AppData\Local\Temp\HFI3A99.tmp.html
Size 17KB
SHA256 bb481ecb899339fa1e3e844ab6641cd14520d8f86c0d60ec1fcf903246bfbd56
MD5 eb34678b8594abec0e92d6339129c03e
SHA1 ebfc47fe16a997e9b96bcaed3b38675681c909fe
SHA512 c3c8dbb4d56612471a4d301f15d90bd83e82bf0089f44fde3437d5c2f08bcd7c4a12b7f4a0f4d74591d937005ad6cabbf9a1bd3bf2fadfa1ea7ef567b8669e09
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjlhK:fdsOT01KcBUFJFEWUxFzvHpo
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 43bb1403284e0d0d479f75b8ec6092a3540dc920a31b66994953ebcd46d3656b
MD5 93dadfa1ea5b1bbf69226ebba52a84f2
SHA1 5f56f6600017fc418f2aa09cc53539261b2c8528
SHA512 9f915c92b9591c3060ea8cc2073259a233e3723151aba12fb8f07248d0c4f10b9a6222cbb91027fda6661b282959a5ab2eeac4d73daa7af88c5f0cc309f8cbea
SSDEEP 12288:uqJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:uqvoKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e6d43455da2881daa937829a0e9e26cb657e07736955a6fac2318a9d01edcccc
MD5 f93e7641f6242b686b57b68a89636348
SHA1 bae9064aeee3b8158e38dba4c3710a93797cf842
SHA512 0351b8f1b9d1217ba85e1513176227c5598bd0decbe0adcae3960b048e1b84f99fabd30eb69b4243ccb07ea36ed83d150de393cb87d7d0e1300f65650189c7c7
SSDEEP 49152:Ba0h2GEkuAe73q3pp46zwwQEQKKYpWwl1+NY:Ba0hNYG4JwrKYpfg
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 e2699d5c0b22f21da21bd85f5f93c54f94a5d3075042e27ca9b004e7b83069b1
MD5 62df4588ff8be49d30f4eeb6f3c2366b
SHA1 0e6dbc1b3d3a86618a2dd55669cd08f5d50cd7c4
SHA512 e562d45d6af1fde491a173bd7596989f26dc8651afd3d14b18772cba4fc78922437ac2f50d25531c8edc40f62d5f7aa833b971ac6666fa287636bee77f474c79
SSDEEP 12288:ThbHjfXnJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:ThbHjPnvoKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a10f998c02db418f87d290bf33dec4c0212d63c5be4dd804bf6ba63eb08ad244
MD5 d785bce5fd66782713bccde24f1da2eb
SHA1 048fe661b3c83adbff5e2884196d3e88da34be96
SHA512 0025251b19d5f8688c1eba95cebb05cda9fcc1f35287a63a616b7a44affe9d173adb0f103549c45917980d00bfc6994312949bf51c0a93673ad26f515cf7f6e6
SSDEEP 24576:53YgnJcRTk4yti+R5dpR/vvoKFLgYHJWwl24C15rDY:5IgnaTk46ppR/vQKKYpWwl1+NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 593e7ec0d0f17df91eef8e1a262a9fe23098b07b9a86f4cee892cc9d7d472643
MD5 847a95598c0b8cb1160a38dc18e20dcf
SHA1 914baaae917b97b9376d362e87174d590b97db37
SHA512 c912615e4dd6438f877137d1c489257f79b79001bb7d3460d20341e1e7a8068b4084054cced90f6d13e18fbc5c6f2bdec2c77528480a0feb17cb1d37d14dd9de
SSDEEP 12288:rmJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:rmvoKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 239e6b35288b278c123b531eaa9365aa0a7c73d6215c3f94d6bfe28a92254df9
MD5 50254652cf5bd26f20b8d9c20e718b06
SHA1 bcd6596e23df4ee6e92a99aa06f127401d9c2c57
SHA512 5bb28d5ea7ba659f1dab4cb78378de9db7774d3d27308b50cf43bed60b08f022e1509d24efb5b3a5476c47b339c24bf63c46d557e0c3868d14c535521f0a5927
SSDEEP 12288:CObfA4LWOsvAYFTJJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:zbL3UTJvoKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 c24489bfd900516711ff9d99ba4760f40fd87edaeff1f1de4710d07820de9a60
MD5 d5da8ac07f206505fac12e2b78441a90
SHA1 60dbe91848b0bb8357721bf49028f30f66aca22d
SHA512 7c401749ba839c502f2732bf74855e2fd5faa727cf257fc458d78d7903438b8dbb121abfe75c708c2b8a0cf48a0a792be584a637b4af8fbc00e9ec5ddcffeb40
SSDEEP 12288:YpFtIO1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:TO1voKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 31fea297c8a29ab45dae56c4fb8869ae2c0f888ae715791fe9936761d88fe648
MD5 67a9db56708fe5a39c8cf238ae89874b
SHA1 271866765a657e0dcdc9c9b1d92d0787fc916410
SHA512 01daf274a5b662e5dbf3677a22bdde3d742c42f69efa4d2eeb1f4dcae47fd290bf7e14424f2bb87ca42898a29d13b18ba3c5acf518c6087567a5aeacf8dce9e9
SSDEEP 24576:w7NM9YmZqmWMUkPjZM48Mv6bEhs6voKFLgYHJWwl24C15rDY:w7cBWMpPjN8DbEhHQKKYpWwl1+NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 87f7e8ea1ae5280b95e377ae9608bb27c033c95a7ad2d6f0658b06d68a227870
MD5 44556eb02c93a855c16e12072df4be1a
SHA1 0ba2878709b32d1a529fac139dd0b8498ce63153
SHA512 ee4a24d040718cc3ffa62f016eecdc3d7ee49417565c52792c89bb77262cc4986ec981cb74db5b15b1525019377a1110ea9f93134a3bcb6ca1d8c58e97e91793
SSDEEP 49152:UF2YuHNETovcvNYf8kmaQKKYpWwl1+NY:h6tCf8kJKYpfg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 cfa2c7202cd1d2c9f76dc6cf801b33961078a327a2055ccaae71f14f25829c94
MD5 8fb8e54b6bae3f1f06922ef7610d6b21
SHA1 2b2616f495a61824f2cf9c9a09305ff8ce383a72
SHA512 eede42905230d93c0e776dea68b15b618798cb778a92f4c997378843319d48d15291a490f8505002799578c4fe06307eed37a58e9f98f54df02c1da375dd5e88
SSDEEP 24576:SAFs06+OmlfkNXEbToBvoKFLgYHJWwl24C15rDY:LFs060lwXukQKKYpWwl1+NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 6533225e81c4c8dd3dc20d305f0d00d3c6edd72bd62457d9a15da3768be0d047
MD5 834f99b295bf6396f37806de9a55145d
SHA1 7eab7544ad91e2538515781a7fabce30d788441e
SHA512 542f76afca7687c054b0886900e294f40dbb1e6e7d6a7692d9e95e1aba727f3dcda981a30ce8e6bf8dd988cae4e41730d76d1b1744b04eefe485f0f60b5900fb
SSDEEP 12288:6CJnJ5D3VkrlzxaJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:7JnJ5D3WtkvoKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d92724c68431f790a2cb954c22256f49c0cd2913f0f9bd4776699972657aa509
MD5 70f806bc9dd54ecc211d24cbbd277811
SHA1 99cec6e44d16e5ae78c15e944ffeac9f805b2bde
SHA512 ce99cffb48177a100e6d13d60e527fe8bcd9a1d71e256e23413292f969e0ab4d0587e26c1c8edff256a01c950400649457645dc26f6f915112ed86008aabb44a
SSDEEP 49152:Ro06DIKdwc+eQnSt65aVeQKKYpWwl1+NY:G8KYpfg
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 3ef8d256ec9c0fb36cd0602a5a9f09ae33cffe7c2d4f1ac7a03df71a1d61f713
MD5 0e2bd0f501b069d356865956a9b6e254
SHA1 8bee788f57c53dd6785824fdf02234344827d965
SHA512 108f592d9a3d96aa1699e3704bb80c497daab53237dd5284193681310ed5c9aa748afecc5faacc1e10f15f2bc680e5e96938474cf31f834c333a507bfe29d439
SSDEEP 12288:oEP3RrgJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:DrgvoKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 c88ed1036f9167c7f005346dfc9ad440ea875426609534f4a6d6f937afba1c6d
MD5 d058e41da5801574c53e56f19ed148fc
SHA1 af40be6e5779b14437a719211a01b35eea45464b
SHA512 adff23def9853f5c345a9138131d19da6a1933918531deea1a088a657cb8f095e5094b15e4042b1eeb088e40122a1c66d387c25f7dc1cd55ddd26a2ca363796e
SSDEEP 12288:gjkyXJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:gIyXvoKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 9888e53c2e2944ec733cb76c49a7801ebf68bda87a5f753d409e59dff4142e2e
MD5 0c05dcef92baab32d56b9cea6217fe1a
SHA1 f3f0299e6fe9da5ed456bae3d648b0e3ba35abd8
SHA512 5c21de1c2619cb7f322d06f091c673acfe3c69f274e1eb02afb88698af70db54b60a33556cfd526f97ed3e15c905216d3fb63b1beb220622d7ca618ad2267b94
SSDEEP 12288:DFlJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:RlvoKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3929339630b1eca9f5d8b1d436f02bb94710c4292ca040ad8d32dcda2bd45199
MD5 4f7bb91cb14d45aeb6e619606e7542af
SHA1 1aee3ec1a12c470ca7a3041370142dc5701baaec
SHA512 0af414f1883a77fdca4107f5e3bc9c30bd323852da23031e3af241336f06d162909b31ff21e4ad09decc69deeeb495064a3ae27365295fccf4b2605d590026a3
SSDEEP 24576:VQ9MxZKdcz97w3yvoKFLgYHJWwl24C15rDY:VVKXyQKKYpWwl1+NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 d4641af407ce7910952e1751ed41ec4e635ff341d2b6df81f1d685c488626ad2
MD5 eb7d6eb323cbfeb557db635741f1125f
SHA1 9dbfc74caf115fd69896c8e270b2c4196c88d488
SHA512 6e20c3e096d03c2a098dc96abecc940d77fd1fc26ecd93eb6f3033f52d4ada3ae882ab8266a0cb2249e52aad4e1b22ea2d19d8a00c69eef17e42d771f0de482e
SSDEEP 12288:3yoKo2HRple9pzJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:3yocxApzvoKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 850625fac19dcfefcfc5c5029b74cc8fa2391c2204dc9b3fb1480346356c8439
MD5 5c92346e25ebb19dc2eec7c052d4edfc
SHA1 b84bb8e351d98f18dfc1984ed2704b4345ab7049
SHA512 0df543d5601b6a968c6c9edac40cba9761ffe0191edcf5ab90a90757a231ee6f38697a432750a14fb69b957f48b91e658a0b7c7ed60495c9ef0038925c0ad770
SSDEEP 49152:GWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKzQKKYpWwl1+NY:Q0zuNIfKYpfg
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1637f08a810cb07854ed832cddc17578555abe6fb6b5d1e1f28e76382b2937de
MD5 52c3f5259730b40063360ebcad3e163a
SHA1 778cc9822a87ed91e025109ff1b53cddcdcbfb2e
SHA512 6468f46dc24006096c940edc460491e87fd2605418ec9a4cc8e3ea076c4dfe690d50f0b75d21ef788a1e8ff4967d9e37b976eadc1df4aa24ea7bb4ba67fea2e3
SSDEEP 24576:x1QT7EcpfxR+N5AWAz3ooiYujMqbgvoKFLgYHJWwl24C15rDY:UTDxR+N5YzT4jMVQKKYpWwl1+NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 453c1a8518ffa49be6278868294e71f6b485ac97971495340bdf95e45859636e
MD5 8131d3e9bf04623cddcbd8dc891cad38
SHA1 94ea1143fed14f7692e769bf46662c21885d31d8
SHA512 d439603984e50bc50c0c1d34307c5403b2baf40f2ad47cb2a6568299ebb2cdb6dfbb01586e10e9699d724824434fc2ccad969fe062efa65b2b4706c7984e456d
SSDEEP 24576:JTMdOz0FFS+bmSLcvoKFLgYHJWwl24C15rDY:D0K+bmSLcQKKYpWwl1+NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 4cf0a5ecab53f298cb8f85f362468de38fed9642f356c78ccb508e43d0fa72eb
MD5 c5e25d4258c1cbbd258b1ed62119fceb
SHA1 fa7060357ed21085f50e966d68dcd8d93d8d853f
SHA512 192eb00394076b4038688871e852281b50d47f6454791831e8b53c94aa3ea0129e82ed5273981a39e56c81d47984dfb6ef3ba10b9a2194b015cf6903fc2b4b0e
SSDEEP 12288:X47JJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:yJvoKFLgYHJWwl24C15rDY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupResources.dll

Path C:\fa2c2664a5c9c947eb6954\1033\SetupResources.dll
Size 16KB
SHA256 36d0159ed1a7d88000737e920375868765c0a1dd6f5a5acbb79cf7d97d9e7a34
MD5 9547d24ac04b4d0d1dbf84f74f54faf7
SHA1 71af6001c931c3de7c98ddc337d89ab133fe48bb
SHA512 8b6048f4185a711567679e2de4789407077ce5bfe72102d3cb1f23051b8d3e6bfd5886c801d85b4e62f467dd12da1c79026a4bc20b17f54c693b2f24e499d40f
SSDEEP 192:byk5nUfwTW7JwWp0eW6jp8M+9HS8bC/TJs7kFkzQKPnEtObMacxc8hjeyveCXZBe:pgoTWp0eWB9ygC/TfFkzLXci2jpv8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\fa2c2664a5c9c947eb6954\Setup.exe
Size 76KB
SHA256 d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be
MD5 006f8a615020a4a17f5e63801485df46
SHA1 78c82a80ebf9c8bf0c996dd8bc26087679f77fea
SHA512 c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76
SSDEEP 1536:sYNItbBL5NWiiESc0exWZnqxMQP8ZOs0JD9rHUq:sYNAB9NWTZctc/gBJ9oq
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupEngine.dll

Path C:\fa2c2664a5c9c947eb6954\SetupEngine.dll
Size 788KB
SHA256 7a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd
MD5 84c1daf5f30ff99895ecab3a55354bcf
SHA1 7e25ba36bcc7deed89f3c9568016ddb3156c9c5a
SHA512 e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3
SSDEEP 24576:GS62nlYAqK/AitUgiuVQk/oifPNJIkjbSTzR8NmsBJj:GS62nlYAltBjPNJIkHST18QsBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupUi.dll

Path C:\fa2c2664a5c9c947eb6954\SetupUi.dll
Size 288KB
SHA256 11565d97287c01d22ad2e46c78d8a822fa3e6524561d4c02dfc87e8d346c44e7
MD5 eb881e3dddc84b20bd92abcec444455f
SHA1 e2c32b1c86d4f70e39de65e9ebc4f361b24ff4a1
SHA512 5750cec73b36a3f19bfb055f880f3b6498a7ae589017333f6272d26f1c72c6f475a3308826268a098372bbb096b43fbd1e06e93eecc0a81046668228bc179a75
SSDEEP 3072:/LTVUK59JN+C0iy4Ww8oBcPFIOrvHvr8QDZHAAKWiIHT6llN1QkvQZaiionv5y/y:HOoMFrz8ygAKWiiIyKf73w
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqmapi.dll

Path C:\fa2c2664a5c9c947eb6954\sqmapi.dll
Size 141KB
SHA256 bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
MD5 3f0363b40376047eff6a9b97d633b750
SHA1 4eaf6650eca5ce931ee771181b04263c536a948b
SHA512 537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8
SSDEEP 3072:uochw/MFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9YSHlN:zDFB47UhXBh2yJ5HcOSSSHZqG
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\fa2c2664a5c9c947eb6954\1028\LocalizedData.xml
Size 29KB
SHA256 a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a
MD5 7fc06a77d9aafca9fb19fafa0f919100
SHA1 e565740e7d582cd73f8d3b12de2f4579ff18bb41
SHA512 466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf
SSDEEP 384:4Y6C7xfsxMEYgPNRAsy50keJzH7o3oDPnv:MxLJz7
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\fa2c2664a5c9c947eb6954\1031\LocalizedData.xml
Size 40KB
SHA256 2aa6e8d402e44d9ee895b18195f46bf90259de1b6f44efd46a7075b110f2dcd6
MD5 b83c3803712e61811c438f6e98790369
SHA1 61a0bc59388786ced045acd82621bee8578cae5a
SHA512 e020f93e3a082476087e690ad051f1feb210e0915924bb4548cc9f53a7ee2760211890eb6036ce9e5e4a311abc0300e89e25efbbb894c2a621ffbc9d64cc8a38
SSDEEP 384:4nF+jpoHnZi8oO0GOJ2+8q6OUjEYJL/ZiITrKv:V03XjZJL/YIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\fa2c2664a5c9c947eb6954\1033\LocalizedData.xml
Size 38KB
SHA256 5d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9
MD5 d642e322d1e8b739510ca540f8e779f9
SHA1 36279c76d9f34c09ebddc84fd33fcc7d4b9a896c
SHA512 e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d
SSDEEP 192:4kVKhG9aX0SDpI53/asO0KMv+VXxwVcPIv5COQu4SLbpmQVX5FB0zJOkue6Jjfz3:4MKhJkeZsdlNl9SJOkR6NXaxu
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\fa2c2664a5c9c947eb6954\1036\LocalizedData.xml
Size 40KB
SHA256 43f913ff28d677316f560a0f45221f35f27cfaf5fc5bd645974a82dca589edbf
MD5 e382abc19294f779d2833287242e7bc6
SHA1 1ceae32d6b24a3832f9244f5791382865b668a72
SHA512 06054c8048cade36a3af54f9a07fd8fa5eb4f3228790996d2abea7ee1ee7eb563d46bd54ff97441f9610e778194082c44e66c5f566c9c50a042aba9eb9cae25e
SSDEEP 192:4GrYAOJoFbZZ0eQiFaD4EbJeiI5hJUPu2oBknXoFDYnZCoroUnAJJFHq20/kFR/0:4GZUoRZc5ryx2fHIJR0kbG52gjfVv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\fa2c2664a5c9c947eb6954\1040\LocalizedData.xml
Size 39KB
SHA256 c4c7c0ddaa6d6a3a1dc260e9c5a24bdfaa98c427c69e8a65427dd7cac0a4b248
MD5 0af948fe4142e34092f9dd47a4b8c275
SHA1 b3d6dd5c126280398d9055f90e2c2c26dbae4eaa
SHA512 d97b5fe2553ca78a3019d53e33d2db80c9fa1cf1d8d2501d9ddf0576c7e6ea38dab754fe4712123abf34b97e10b18fb4bbd1c76d3dacb87b4682e501f93423d9
SSDEEP 384:4hZo3+Ma9e1JzNZNs4fneAEJ0o5H/PuRv:NaudsJ1u
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\fa2c2664a5c9c947eb6954\1041\LocalizedData.xml
Size 33KB
SHA256 01e7d24dd8e00b5c333e96d1bb83813e02e96f89aad0c2f28f84551d28abbbe2
MD5 7fcfbc308b0c42dcbd8365ba62bada05
SHA1 18a0f0e89b36818c94de0ad795cc593d0e3e29a9
SHA512 cd6f912a037e86d9e1982c73f0f8b3c4d5a9a6b5b108a7b89a46e6691e430a7cb55718de9a0c05650bb194c8d4a2e309ad6221d638cfca8e16aa5920881ba649
SSDEEP 192:4OTOo45ZyAYcou3LDnmUjMFsrHZmxqJOXhNCGYHre3iR7v:4OTOoMhYcRaOXJ6koIv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\fa2c2664a5c9c947eb6954\1042\LocalizedData.xml
Size 32KB
SHA256 cccda55294aeb4af166a8c0449bca2189ddf5aa9a43d5e939dd3803e61738331
MD5 71dfd70ae141f1d5c1366cb661b354b2
SHA1 c4b22590e6f6dd5d39e5158b831ae217ce17a776
SHA512 5000d62f3de41c3fb0ed8a8e9c37dbf4eb427c4f1e3ad3823d4716c6fe62250bac11b7987a302b8a45d91aabcf332457f7aff7d99f15edeffe540639e9440e8a
SSDEEP 192:4cdsW0fwUrh+UgYUDQhGAtPN/2JWCTJSIQvPaLWL2C4oH/Drv:4cdszvrBgYUDQhF5N7IJSIQvkQfLH/Pv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\fa2c2664a5c9c947eb6954\1049\LocalizedData.xml
Size 39KB
SHA256 beef0631c17a4fb1ff0b625c50c6cb6c8ce90a1ae62c5e60e14bf3d915ad509c
MD5 0eeb554d0b9f9fcdb22401e2532e9cd0
SHA1 08799520b72a1ef92ac5b94a33509d1eddf6caf8
SHA512 2180e46a5a2ea1f59c879b729806ca02a232c66660f29c338c1fa7fbee2afa4b13d8777d1f7b63cf831eb42f3e55282d70aa8e53f40616b8a6e4d695c36e313d
SSDEEP 384:4q0oG/2VrQa0inweNLvSli+CJA3aJW5cGUT3CT+v:DVFJl
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\fa2c2664a5c9c947eb6954\2052\LocalizedData.xml
Size 30KB
SHA256 d1735c8cfd8e10ba019d70818c19fa865e7c72f30ab6421a3748408f85fb96c3
MD5 52b1dc12ce4153aa759fb3bbe04d01fc
SHA1 bf21f8591c473d1fce68a9faf1e5942f486f6eba
SHA512 418903ae9a7baebf73d055e4774ff1917fbaab9ee7ed8c120c34bb10e7303f6dd7b7dae701596d4626387a30ae1b4d329a9af49b8718b360e2ff619c56c19623
SSDEEP 192:4Qn7cJwYTzOnyquEWTOAXUewfMcqQJywXk83GJPupIoxnb/2v:4Qn7cJxTC/uEWTfXUewiQJyoknJY9b+v
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\fa2c2664a5c9c947eb6954\3082\LocalizedData.xml
Size 39KB
SHA256 f124d318138ff084b6484deb354cca0f72296e1341bf01169792b3e060c89e89
MD5 5397a12d466d55d566b4209e0e4f92d3
SHA1 fcffd8961fb487995543fc173521fdf5df6e243b
SHA512 7708f5a2ad3e4c90c4c216600435af87a1557f60caf880a3dd9b5f482e17399af9f0b9de03ff1dbdd210583e0fec5b466e35794ac24d6d37f9bbc094e52fc77b
SSDEEP 384:4fgA4Ukd+uYW1HCD1GO/tja2QDu7Jr++dP8z3AzOrv:tUZW1iDDdWCJi8Pg32Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

DHTMLHeader.html

Path \??\c:\fa2c2664a5c9c947eb6954\DHTMLHeader.html
Size 15KB
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ParameterInfo.xml

Path \??\c:\fa2c2664a5c9c947eb6954\ParameterInfo.xml
Size 8KB
SHA256 bf787b8c697ce418f9d4c07260f56d1145ca70db1cc4b1321d37840837621e8f
MD5 66590f13f4c9ba563a9180bdf25a5b80
SHA1 d6d9146faeec7824b8a09dd6978e5921cc151906
SHA512 aba67c66c2f3d9b3c9d71d64511895f15f696be8be0eedd2d6908e1203c4b0cf318b366f9f3cd9c3b3b8c0770462f83e6eea73e304c43f88d0cbedf69e7c92b3
SSDEEP 192:gCwdBdVv3CL021BqG2ahBCw2G2X2BCEj2G2KQ6G2nCw+KFl:kRPGiGPKGPGYCrKFl
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupUi.xsd

Path \??\c:\fa2c2664a5c9c947eb6954\SetupUi.xsd
Size 29KB
SHA256 222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093
MD5 2fadd9e618eff8175f2a6e8b95c0cacc
SHA1 9ab1710a217d15b192188b19467932d947b0a4f8
SHA512 a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca
SSDEEP 768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMC:1wchT+cxcDm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Strings.xml

Path \??\c:\fa2c2664a5c9c947eb6954\Strings.xml
Size 13KB
SHA256 e49545feeae22198728ad04236e31e02035af7cc4d68e10cbecffd08669cbeca
MD5 332adf643747297b9bfa9527eaefe084
SHA1 670f933d778eca39938a515a39106551185205e9
SHA512 bea95ce35c4c37b4b2e36cc1e81fc297cc4a8e17b93f10423a02b015ddb593064541b5eb7003560fbeee512ed52869a113a6fb439c1133af01f884a0db0344b0
SSDEEP 384:VAZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VAB
MD5 SHA1 SHA512 SSDEEP

Submit Download

UiInfo.xml

Path \??\c:\fa2c2664a5c9c947eb6954\UiInfo.xml
Size 35KB
SHA256 0d36a884a8381778bea71f5f9f0fc60cacadebd3f814679cb13414b8e7dbc283
MD5 812f8d2e53f076366fa3a214bb4cf558
SHA1 35ae734cfb99bb139906b5f4e8efbf950762f6f0
SHA512 1dcc3ef8c390ca49fbcd50c02accd8cc5700db3594428e2129f79feb81e4cbbeef1b4a10628b2cd66edf31a69ed39ca2f4e252ad8aa13d2f793fca5b9a1eaf23
SSDEEP 768:S4UR0d5v0SguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjT5fuPkfuS:S4UR0d5v0QYQLIN/6Fmhvk71sO0Nep3q
MD5 SHA1 SHA512 SSDEEP

Submit Download

print.ico

Path \??\c:\fa2c2664a5c9c947eb6954\graphics\print.ico
Size 1KB
SHA256 ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed
MD5 7e55ddc6d611176e697d01c90a1212cf
SHA1 e2620da05b8e4e2360da579a7be32c1b225deb1b
SHA512 283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e
MD5 SHA1 SHA512

Submit Download

save.ico

Path \??\c:\fa2c2664a5c9c947eb6954\graphics\save.ico
Size 1KB
SHA256 ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5
MD5 7d62e82d960a938c98da02b1d5201bd5
SHA1 194e96b0440bf8631887e5e9d3cc485f8e90fbf5
SHA512 ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67
MD5 SHA1 SHA512

Submit Download

setup.ico

Path \??\c:\fa2c2664a5c9c947eb6954\graphics\setup.ico
Size 35KB
SHA256 288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f
MD5 3d25d679e0ff0b8c94273dcd8b07049d
SHA1 a517fc5e96bc68a02a44093673ee7e076ad57308
SHA512 3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255
SSDEEP 384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQcho:IMWQ2Bf8qqxMQP8pc4XessTJo
MD5 SHA1 SHA512 SSDEEP

Submit Download

stop.ico

Path \??\c:\fa2c2664a5c9c947eb6954\graphics\stop.ico
Size 9KB
SHA256 b499e1b21091b539d4906e45b6fdf490d5445256b72871aece2f5b2562c11793
MD5 5dfa8d3abcf4962d9ec41cfc7c0f75e3
SHA1 4196b0878c6c66b6fa260ab765a0e79f7aec0d24
SHA512 69a13d4348384f134ba93c9a846c6760b342e3a7a2e9df9c7062088105ac0b77b8a524f179efb1724c0ce168e01ba8bb46f2d6fae39cabe32cab9a34fc293e4a
SSDEEP 96:uC1kqWje1S/f1AXa0w+2ZM4xD02EuZkULqcA0zjrpthQ2Ngms9+LmODclhpjdfLt:JkqAFqroMS9lD9Ngr9+m7bxpXHT5ToYR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/372-323-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/372-674-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/396-287-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/396-669-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/776-345-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/776-678-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1656-195-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1656-184-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1716-151-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/1716-176-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/1716-194-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1716-163-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/2152-231-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2152-350-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2264-327-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2264-675-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2372-36-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2372-25-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2372-31-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2372-32-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2372-230-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2776-139-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2776-149-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2776-278-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2776-145-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2956-274-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2956-618-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3088-326-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3088-221-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3244-119-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3244-128-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3244-125-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3244-265-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3364-206-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3396-254-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3396-551-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3496-220-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3496-13-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3496-19-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3496-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3544-290-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3544-673-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3584-250-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3584-363-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3584-672-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3788-116-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3788-102-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3788-104-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3788-109-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3788-127-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4068-301-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4068-313-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4084-680-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4084-364-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4608-351-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4608-679-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4664-7-0x0000000001000000-0x000000000157C000-memory.dmp

Download

memory/4664-172-0x0000000001000000-0x000000000157C000-memory.dmp

Download

memory/4664-0-0x0000000000A50000-0x0000000000AB7000-memory.dmp

Download

memory/4664-8-0x0000000000A50000-0x0000000000AB7000-memory.dmp

Download

memory/4848-227-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4848-338-0x0000000000400000-0x0000000000497000-memory.dmp

Download