69ce7e91e006a8fdccdfca8ad1c0ebfa411d735798f4654d196ba236157b17ce

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
Size 5.4MB
Sample240603-xmlv6sgd38
SHA256 69ce7e91e006a8fdccdfca8ad1c0ebfa411d735798f4654d196ba236157b17ce
MD5 96974315bf99880dfeb84c4c16501010
SHA1 97a0265eb05ef77189282e3260c59e2e33417720
SHA512 5f35d485b7caacbea8faddf169c5da36c45791db83d79616da74c4fef455bdd3453b387dbd2d5aed673facab0cc20d55ff94894c8ce30e35bd98bc302860fe75
SSDEEP 98304:auLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0L:j7wq1W6HqULS8djZDTaNNeCKVP5ORsgY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
2344	alg.exe
1464	DiagnosticsHub.StandardCollector.Service.exe
4928	fxssvc.exe
4804	Setup.exe
996	elevation_service.exe
2252	elevation_service.exe
2296	maintenanceservice.exe
1244	msdtc.exe
3592	OSE.EXE
5036	PerceptionSimulationService.exe
4280	perfhost.exe
440	locator.exe
1416	SensorDataService.exe
4680	snmptrap.exe
116	spectrum.exe
1368	ssh-agent.exe
3144	TieringEngineService.exe
4996	AgentService.exe
4924	vds.exe
1352	vssvc.exe
2444	wbengine.exe
3376	WmiApSrv.exe
4400	SearchIndexer.exe

Loads dropped DLL 5 IoCs

pid	Process
4804	Setup.exe
4804	Setup.exe
4804	Setup.exe
4804	Setup.exe
4804	Setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\alg.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ba598c5c293b476c.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6acee07e8b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bc58507e8b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037191807e8b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071008107e8b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3480b08e8b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000467b1a07e8b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f2e0c07e8b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4804	Setup.exe
4804	Setup.exe
4804	Setup.exe
4804	Setup.exe
4804	Setup.exe
4804	Setup.exe
4804	Setup.exe
4804	Setup.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
Token: SeAuditPrivilege	4928	fxssvc.exe
Token: SeRestorePrivilege	3144	TieringEngineService.exe
Token: SeManageVolumePrivilege	3144	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4996	AgentService.exe
Token: SeBackupPrivilege	1352	vssvc.exe
Token: SeRestorePrivilege	1352	vssvc.exe
Token: SeAuditPrivilege	1352	vssvc.exe
Token: SeBackupPrivilege	2444	wbengine.exe
Token: SeRestorePrivilege	2444	wbengine.exe
Token: SeSecurityPrivilege	2444	wbengine.exe
Token: 33	4400	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeDebugPrivilege	1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
Token: SeDebugPrivilege	1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
Token: SeDebugPrivilege	1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
Token: SeDebugPrivilege	1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
Token: SeDebugPrivilege	1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
Token: SeDebugPrivilege	2344	alg.exe
Token: SeDebugPrivilege	2344	alg.exe
Token: SeDebugPrivilege	2344	alg.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 4804	1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe	87
PID 1192 wrote to memory of 4804	1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe	87
PID 1192 wrote to memory of 4804	1192	96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe	87
PID 4400 wrote to memory of 1888	4400	SearchIndexer.exe	110
PID 4400 wrote to memory of 1888	4400	SearchIndexer.exe	110
PID 4400 wrote to memory of 448	4400	SearchIndexer.exe	111
PID 4400 wrote to memory of 448	4400	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\96974315bf99880dfeb84c4c16501010_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- \??\c:\f87b5e0d3aee97f9a3\Setup.exe
  c:\f87b5e0d3aee97f9a3\Setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4804

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1824

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:996

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2252

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2296

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1244

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3592

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:440

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1416

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4680

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1088

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1888
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 620461062a38fab7f16f57c36b4543e43e27f34bede3e92dee5817424c804424
MD5 823c2ede27c1b31e528c49b25f0c49d6
SHA1 7540134013b4587b31aac4c01b2de5a77575ea57
SHA512 eb9bc535b0d96195fbf28fcd5805ad59dea85f937e4a2698b2d0859468c7700441ab61943615152f265dd300dfbb302238768fda86ed6a457d934073a4faceb1
SSDEEP 49152:xuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z54Ik8x77AA:xPfTqi90btkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 19c2cd5045727acfb9e8aee69cd2764138aac60e3e8cde00d9729cd9dd512b7f
MD5 bbfec067fea8f88e9b730d2e103194a2
SHA1 af3c0714fe9be30bc6805f80b0cb86c231544e5a
SHA512 4bb334ab95207b4cd09b63f647b55c75162d1a28894e513306bb626592e772a9e15284cfb3e65db4ce2b6b00924b57dfb4e178dc2bec3d52d07affade916479d
SSDEEP 12288:ocQiQmNJLBsunE4EdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3Rgz:SidnBsuE4ERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c6460791f87c031bb81d0874e35be0ee8fc30cbc3e61f5c13b45e14bd4fe9ea6
MD5 82fc8deedafa43e975545db6b40c9b93
SHA1 176c07a863a64e7207443bbeb72000eef7f1e47e
SHA512 43e4e52576d89846f4dcce6c18ba71a64384b21ed12fa95435e25a136735064a6674791b3f8136555aa007f7f85f428f0fa530234924d21e68236287faed60c9
SSDEEP 12288:q7a3iwbihym2g7XO3LWUHfh4Co8EdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM5:j+gkEVfh4Co8ERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 07e9953aa2c3ca551af9459a342b02a7c23e711a7eab26f6f77d901a25aaa048
MD5 3d53dce89b09338b119a1a2e9898e8ce
SHA1 a2097bf9ccec367e77613af7c94540c5352c6fdb
SHA512 762c1bf97615633c8b215d32c4cfb3df70c04724f0b2e02eac170cedb4cef9748f3d8dd47f04ebf91fa8592934521623d6e39963f98a5a0f2df26c3e6aa77b42
SSDEEP 24576:JBpDRmi78gkPXlyo0GxjrnERIk1k7c+vDqGJAAg:rNRmi78gkPX4o0GxjYIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8f0ac5c8d9d4e982864cf23b20c3cf7df3e8f88b00eed46c1f81a809255b64ef
MD5 0ba39e113d7849b9dd86a7a06a96fec0
SHA1 a57a2d8a59720f39cc3c71d6ed7866e6a5a53317
SHA512 eb6c55e9a91721093a25e5684568f29c5e98700d88399181fc4b376892bb992e1176ff02c9f93b184790a5bef45e6c54909caea1bc1deb1a1cc0fa4505dfe539
SSDEEP 12288:OfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXV8EdlIIDPa7j9aaV+aXXZdceRWN:iLOS2oyPIXV8ERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4dd9e1cb88b31b5e19fa2185993d7b5a379e837e852587f75ad8f7f7fa9e8cd9
MD5 e2505b47d41dd0aecfc827002a1f17bb
SHA1 8c22b1ce02e9c1cd065d15cf8fd4342d340363c7
SHA512 a9d55186f5b438353650538b4c23f84fa0f628a3878eea9217382819a7887cf1286d2856501a02011f2c33d0e1b66943c35e73c8f67967d10a6586032151c591
SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+CAEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1E:KwuoOWbERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 7ef57b8fe59c71527dbce87ee5394c1a1338bfdc666c28df0b466e50d87f217e
MD5 47a6febfd5b3787b812d1692c62da07c
SHA1 f04f2f1d6396741bfe1c52795dff98fe82632b06
SHA512 7598ed20c6aad1dcd0f2ff99ee9811868c5989e2587c005c632a45aa153030ce9a25cd5ddce36a54cdd7c7bff7bfa85f7574be4f0c9d582c3b01347cae02f595
SSDEEP 49152:My7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxcIk8x77AA:rmYeyxHjWjMTtkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9e0b66ab2d45904868d735d87a90e9ab50d05522eb716849a9c084a067b2dcc4
MD5 9479a9f5460008febcdfe7148b396026
SHA1 15c5a98812b9329d97cc2b713e5bcab6fb5ea613
SHA512 13cb4f6ad6fb13822b23442f47a9fc1abe6fa0920d4499dbce22286512513cb7d68841d0ecd891f52ff3ec009c0c3f55ccdd3d92fe55eab53f582bbf5c37c239
SSDEEP 24576:ycP4mcvIjkGOxhKP2l71SNKbrh/8KBiERIk1k7c+vDqGJAAg:9P4m4IpOO67N8KhIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

HFI5AC3.tmp.html

Path C:\Users\Admin\AppData\Local\Temp\HFI5AC3.tmp.html
Size 19KB
SHA256 a6497907f7e13d7235f7e3f540a478028fb5d9b925d9f63aa3a91bac71a24f40
MD5 88f5ea1d64c2631ebe89e486da99313a
SHA1 3a6214fad8b4fcb74b700ca2bc865b85c08ca266
SHA512 d10b85acf0739b4b7dcc3a4c781410f67b7859aa7f655c29e791960cf1754204950ad6ad8be2a7676912303f14d1eaa41f0aa2fd8fd30f6954710f1b9f4fa3ca
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjPhL/Cl:fdsOT01KcBUFJFEWUxFzvHDd/Cl
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 ed6145c18b3f74fc99642dcf7dc62bacb63dad333d4dc2ba422b61478e5af410
MD5 ab2641661cdb1274f1d86d0149cc54b7
SHA1 3ffa9d5881ef24dc09e8f0295a3e8f38c787db5a
SHA512 a22e5a57cbaf98b0b0c08e427c1071d5b30bbf38acadad2e3c93e9fac8dbc83e7060e2dbe11b9240d0fb861c8c474328b4e6ed22608dc124def5040c4f98f6e5
SSDEEP 12288:TaEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:TaERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d50417cc6d6420e194e23becb4f21747581407262df77f24578ba132fc1731b7
MD5 d05dac95ea7c916faa704088c955e5e0
SHA1 dde964e3fbdcb162a5be411e8e5f5bc9f9234e46
SHA512 402ed79f36c18128ab205d4342dc2afc7737e2b7389db653d7ba86c2ec69893982cb56a86fd365e5366f1a3dd5d9a85a981b9731643567c60425d87edfeb7824
SSDEEP 49152:la0h2GEkuAe73q3pp46zwwQNIk8x77AA:la0hNYG4Jwlkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 34f1a71d895fe6b2d8201dc11242f7cdedb3b1d2619cd14603590d4309a6a106
MD5 b4141e3ab45dfe7372b1a4219984c596
SHA1 e053098003037348ae625247ef1a230c2e030a02
SHA512 1e05533447f3d3c0ce6cf4c2ede60f562b282119e7fa8bf1610e9e9d9c3aa7ab85a17148b26bba27558542d6b2ba231fde1d4cc8342cca67f0e7ca5b92044260
SSDEEP 12288:mhbHjfXDEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:mhbHjPDERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 87015f40d8f2857c4012901374d89d652938ae59f253eb50542a057a74058fb1
MD5 723163d1ab64fcef736a044462638817
SHA1 25cc37a190463c174626523f582f8acb1a348846
SHA512 c56f6b703caac4befff295f6791d5b63b2b5e4a0c945212bfe74f6ef6475f9435862d064357724823d4765ce64661f6cd694ed02a9c5833628a0bf4d168a45c3
SSDEEP 24576:y3YgnJcRTk4yti+R5dpR/bERIk1k7c+vDqGJAAg:yIgnaTk46ppR/gIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 0d30bb7d2fea2ae0dd1ef22cd76d679254f1dbb4218c942439cc456a3f11f563
MD5 dc6d7bb58e9e428cb6c54fda53530537
SHA1 7c6cb47aedb4e6355024e1ff2caff50de44fe666
SHA512 c0fb3e11a8e8edb158028470c8630a00831454f8c589626e8e728921da301db31d7bd5c0bdf97f3e2bb873e070873ece3ceba5aae42d18cdf0d725160198696b
SSDEEP 12288:12EdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:12ERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 5a7b26c49e4f2f1e2425448289e0b79bcf4b94ebb2985ddaff56c196bcd74e6a
MD5 28ef34fa71e42475841d70bba86f98f9
SHA1 3b5fe4edf5b9e8bfde7b6c3116d6da4762362210
SHA512 a20fd772a75e93269e00eb0fc1453be3879f4d73f7985eba76fb83e680a5b232567a0cc08cf6af94ec5c7db2fb9b3dd14966248309c5dd52430f3d69fd1c503c
SSDEEP 12288:aOb9A4LWOsvAYFTlEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RC:LpL3UTlERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 defb69afa1f8a4880eb0c90f8126ff2409fa94f5393ef31cffcba6b16396e9d9
MD5 2513c6c5ab3e5a821efea33b53941fc3
SHA1 98fec38afd9253371b401df7e7ed43dfc5fb4154
SHA512 d8fdf0a9e8038650f9ac7788d7a6e487349e2c7cb4a9e105b9bd98bb974348990ea6afee51537cc11d9f4e27e0194fd8d958b4646a171632f7fc33127263ea7d
SSDEEP 12288:XpFtpOREdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:7ORERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 746a934dc63d61b3e6bc604d09392aacd7b09bd3b5de717aa35f6a9e5c14c4e9
MD5 0bf8336a06c816f021a0b5557faaeb10
SHA1 c6aeb308a618a2628637e14706bd62ab0a452f64
SHA512 12b36fae104488235aab8acb253a739393807497537db140a051f8962bb518d81be6d4b1d8b903280799a63807681bb6a5ee059f822d28041575ee8af64f1c28
SSDEEP 24576:c7NM9YmZqmWMUkPjZM48Mv6bEhsqERIk1k7c+vDqGJAAg:c7cBWMpPjN8DbEhYIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 c274fe90354cb9c0f54ce6a916f654a176da824fac884572252ef5fd95ef9558
MD5 4c1fae105a40c441a2b33b053f7522c0
SHA1 aa9d91c49a4eb2e1526b4958220d68a032cf7d2f
SHA512 d6a56369cf08592e78bed5e8b2ee86d82b124fe910711000a017742a25312b35b611fd1c98d3564fb2ec78c6f09fb50d3e1fad632c77fb5b9fbcff70419acecb
SSDEEP 24576:SW6BApg2YuyuNDYTabvcRvNYf8km1YERIk1k7c+vDqGJAAg:SF2YuHNETovcvNYf8km/Ik8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 5b4fbd588004674813e4e5733baf5b410328df86520b2455d0110fb586b65531
MD5 463c247d666f529b924fefd015e2cf52
SHA1 3c0cc5ac3b104871f0115216f4ec86eae852bc2c
SHA512 9c558c08fa7a4e7aaa1597c719c51afbfe07eba77d919ed85d9b69ef2310d59b877c008e61202bda6c3fe64ba2d9651b64d5745ed0886fb988271851fd3f7bbf
SSDEEP 24576:NAFs06+Omlf3NXEbToNERIk1k7c+vDqGJAAg:CFs060lVXutIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 4aa71d578a5f95a501b5e604346c2d401858306b73f7e0906e13c29be04a4e44
MD5 09323a5db710be7d532b52764a781b3c
SHA1 282d97b7a31d7a1177abca82d378860c7343d0ec
SHA512 cb0db0ecf184c24878d578cae8594ba8a3de2ba21a4724cbc9bcbbee7eec29088fa8edbf9cae0e506e4c87053222d6c6b5924bebf4534b6730d1d95ab2038124
SSDEEP 12288:/CJnJ5D3VkrlzxKEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3Rgz:6JnJ5D3WtEERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 49e988086aae9aaaab5e41d580e889b5c21ac15a78a54bd31886a2729d3b8cc5
MD5 0f6526b8bbc0409287fda4567a3eb83c
SHA1 a0464ccfbebd7558c687a28b21cc7e6ec564ec48
SHA512 8263c29d4411496c0cad575defe27df63cf58ffdadf1cb162091ffaeb68ce8463f46319f5c786df0e19e257b54f187052c5b73f6835f36b9743a7f0c85880656
SSDEEP 24576:cEPohm6/7IIXdwcXrif7qQncjlP65i3VubERIk1k7c+vDqGJAAg:Do06DIKdwc+eQnSt65aVrIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 8c559f63fe2b16ccc683f51a9b63c1f7779c2344e91e1d6c293c717370b3ec36
MD5 abb90f7f553f9bea1886920ec46fd155
SHA1 8f19da7ccfedb4841a44d9757cecd2ca2bd8b9b3
SHA512 5b87b93c3586262970fa624895a1b02d2bca3e85bc3428a79e6505c2c40009670838e00c7078e9dadc57df93b47dae096695257182ca75f2ffbb6ef15a87c461
SSDEEP 12288:lEP3RrAEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:mrAERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 3185db48691b6644d5ef2fcaee9af097834ad7ef4275ff0a0dde0043f2230f30
MD5 7b0048b70394778f0d39b63d77cace19
SHA1 c84a77e296a416e095e0bcfd9d2f8a2061ebae89
SHA512 ce1d35301a47bfa3b5efcc0828b717cade6c814090feac4d62f1bc34935a958470c2ccc4550263bfe94f7d42f9e36b0785268e688acea96a2972c396fea1ba29
SSDEEP 12288:XjkyzEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:XIyzERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 5c0951d230541dd73f134d2a6bb4355fa3f29ca5551d22ef3f23f6b34999278b
MD5 9b48bff4150541b6732489a8ebee460d
SHA1 dd0f8d387cbce9673b8d370a62ccbbf909980bfb
SHA512 36e34d3aa13165072c91aa63afce4e1191e12ec4644dfaa524ca1721a969f3e63cc056ab003ad45bc6b9823031fee545e31c8922689e9ccc2ad1435cd9e84b23
SSDEEP 12288:vFBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:dBERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e49460a0e946bc2af2e6bbfa381e8e5810e21d3cbdc5b60fe8647ddb05e230aa
MD5 63c3bfd06cd7d70ab1f075cdb4cf69d8
SHA1 6115eb6b195e1d7baad9bae62105943d01ca8488
SHA512 d5f8a1f2196c211302cc7eea9d79c4e5ea205b9f8a10d43f8ba2be93966f689a8cfadf0b80c0d80830a47bb7668cd7704d7231ef823f797029508c69a41f636b
SSDEEP 24576:JQ9MxZKdcz97w3yERIk1k7c+vDqGJAAg:JVKX3Ik8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 0eb43c550c17136772174455e007a2a707dc6e97b30bf79b54c084b192126ae0
MD5 2d678417f896f4c81ae39e198a6c3a3d
SHA1 8f4afb822bedec8bbea81842d4559363b7111ba6
SHA512 53516cbd3ff1f1d6faf6050f0923c6a79e6cfc449dd2ed42bb6b76439fbec6f41fdc6b894335002657ae88c773f200505c0b957fa9470f032cfe76103584a577
SSDEEP 12288:QyoKo2HRple9pfEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgC8:QyocxApfERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 358c661ee80adc15c27851990397c4e198a249748946f817931935432b0b1fb6
MD5 b24d1c3055eeefb40647062063e2d15b
SHA1 bbd7a939aae357e61d238c74469042b6cd35074f
SHA512 2180fc8c20798ae1aeb3d262cc6fa52ea7fea9cb1ec1b4c8a44bd25502c026292f335ef62c6a697f3e83a5eea05da1d36c4db888b87d71d039f906ca0888eeb2
SSDEEP 49152:AWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKcIk8x77AA:y0zuNIBkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7970d7b3a30106aee2b6f1ff96f2929384504cfb48c9a2d608ea0e034b5199a3
MD5 1d4315a891a117dc13940e873bdbe423
SHA1 c452b7995eaccedfe77b6a4eaf669f62a74e4b63
SHA512 054d4d7623793621135d0356181910e4149b7a21af31aed21a618e83decfe3d0b16a62ac8626c557d0bfe9eb9af8f3494e6ce572d90318eb10373ae8a4ad60b3
SSDEEP 24576:v1QT7EcpfxR+N5AWAz3ooiYtjMqbAERIk1k7c+vDqGJAAg:STDxR+N5YzTfjMKIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 a06b61220ab9010a02ec9cd8078ad04296ffa6b8d8cc20cb53fbcee01718d5e1
MD5 b37952ac5a651bfde9285072c6370d43
SHA1 762a67fbc0c6d9c4deb5534d24af200458a44b3c
SHA512 6dfeae3b9932df3e7d0a124a74abc3242a722daca8295f10af42ebb616423d1b24e9e931d2b3cdc2da9727d7d0f2eecb9e15ede8229a47a18c0f8c2167e0f45d
SSDEEP 24576:DTMdOz0FFS+imSLsERIk1k7c+vDqGJAAg:h0K+imSLlIk8x77AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 2a585bda0e5f5a90235fa3b9a042a6f8573d0e1f5f6b79ebe40f6c2aef956c9f
MD5 ff47567cb355c5e7dfcfb0810a4a7fb8
SHA1 b057683741229ec0ca671841f5f4537f694e0b97
SHA512 5a57efc6fe540582d7d509a75ce60681742f32c725eed249117a6d0417ab69fdf25ad528416ab19b5868e5f85f27f995b4485841f44a7190fa69055c9d02902c
SSDEEP 12288:G47lEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:9lERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupResources.dll

Path C:\f87b5e0d3aee97f9a3\1033\SetupResources.dll
Size 16KB
SHA256 36d0159ed1a7d88000737e920375868765c0a1dd6f5a5acbb79cf7d97d9e7a34
MD5 9547d24ac04b4d0d1dbf84f74f54faf7
SHA1 71af6001c931c3de7c98ddc337d89ab133fe48bb
SHA512 8b6048f4185a711567679e2de4789407077ce5bfe72102d3cb1f23051b8d3e6bfd5886c801d85b4e62f467dd12da1c79026a4bc20b17f54c693b2f24e499d40f
SSDEEP 192:byk5nUfwTW7JwWp0eW6jp8M+9HS8bC/TJs7kFkzQKPnEtObMacxc8hjeyveCXZBe:pgoTWp0eWB9ygC/TfFkzLXci2jpv8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\f87b5e0d3aee97f9a3\Setup.exe
Size 76KB
SHA256 d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be
MD5 006f8a615020a4a17f5e63801485df46
SHA1 78c82a80ebf9c8bf0c996dd8bc26087679f77fea
SHA512 c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76
SSDEEP 1536:sYNItbBL5NWiiESc0exWZnqxMQP8ZOs0JD9rHUq:sYNAB9NWTZctc/gBJ9oq
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupEngine.dll

Path C:\f87b5e0d3aee97f9a3\SetupEngine.dll
Size 788KB
SHA256 7a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd
MD5 84c1daf5f30ff99895ecab3a55354bcf
SHA1 7e25ba36bcc7deed89f3c9568016ddb3156c9c5a
SHA512 e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3
SSDEEP 24576:GS62nlYAqK/AitUgiuVQk/oifPNJIkjbSTzR8NmsBJj:GS62nlYAltBjPNJIkHST18QsBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\f87b5e0d3aee97f9a3\1028\LocalizedData.xml
Size 29KB
SHA256 a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a
MD5 7fc06a77d9aafca9fb19fafa0f919100
SHA1 e565740e7d582cd73f8d3b12de2f4579ff18bb41
SHA512 466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf
SSDEEP 384:4Y6C7xfsxMEYgPNRAsy50keJzH7o3oDPnv:MxLJz7
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\f87b5e0d3aee97f9a3\1031\LocalizedData.xml
Size 40KB
SHA256 2aa6e8d402e44d9ee895b18195f46bf90259de1b6f44efd46a7075b110f2dcd6
MD5 b83c3803712e61811c438f6e98790369
SHA1 61a0bc59388786ced045acd82621bee8578cae5a
SHA512 e020f93e3a082476087e690ad051f1feb210e0915924bb4548cc9f53a7ee2760211890eb6036ce9e5e4a311abc0300e89e25efbbb894c2a621ffbc9d64cc8a38
SSDEEP 384:4nF+jpoHnZi8oO0GOJ2+8q6OUjEYJL/ZiITrKv:V03XjZJL/YIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\f87b5e0d3aee97f9a3\1033\LocalizedData.xml
Size 38KB
SHA256 5d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9
MD5 d642e322d1e8b739510ca540f8e779f9
SHA1 36279c76d9f34c09ebddc84fd33fcc7d4b9a896c
SHA512 e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d
SSDEEP 192:4kVKhG9aX0SDpI53/asO0KMv+VXxwVcPIv5COQu4SLbpmQVX5FB0zJOkue6Jjfz3:4MKhJkeZsdlNl9SJOkR6NXaxu
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\f87b5e0d3aee97f9a3\1036\LocalizedData.xml
Size 40KB
SHA256 43f913ff28d677316f560a0f45221f35f27cfaf5fc5bd645974a82dca589edbf
MD5 e382abc19294f779d2833287242e7bc6
SHA1 1ceae32d6b24a3832f9244f5791382865b668a72
SHA512 06054c8048cade36a3af54f9a07fd8fa5eb4f3228790996d2abea7ee1ee7eb563d46bd54ff97441f9610e778194082c44e66c5f566c9c50a042aba9eb9cae25e
SSDEEP 192:4GrYAOJoFbZZ0eQiFaD4EbJeiI5hJUPu2oBknXoFDYnZCoroUnAJJFHq20/kFR/0:4GZUoRZc5ryx2fHIJR0kbG52gjfVv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\f87b5e0d3aee97f9a3\1040\LocalizedData.xml
Size 39KB
SHA256 c4c7c0ddaa6d6a3a1dc260e9c5a24bdfaa98c427c69e8a65427dd7cac0a4b248
MD5 0af948fe4142e34092f9dd47a4b8c275
SHA1 b3d6dd5c126280398d9055f90e2c2c26dbae4eaa
SHA512 d97b5fe2553ca78a3019d53e33d2db80c9fa1cf1d8d2501d9ddf0576c7e6ea38dab754fe4712123abf34b97e10b18fb4bbd1c76d3dacb87b4682e501f93423d9
SSDEEP 384:4hZo3+Ma9e1JzNZNs4fneAEJ0o5H/PuRv:NaudsJ1u
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\f87b5e0d3aee97f9a3\1041\LocalizedData.xml
Size 33KB
SHA256 01e7d24dd8e00b5c333e96d1bb83813e02e96f89aad0c2f28f84551d28abbbe2
MD5 7fcfbc308b0c42dcbd8365ba62bada05
SHA1 18a0f0e89b36818c94de0ad795cc593d0e3e29a9
SHA512 cd6f912a037e86d9e1982c73f0f8b3c4d5a9a6b5b108a7b89a46e6691e430a7cb55718de9a0c05650bb194c8d4a2e309ad6221d638cfca8e16aa5920881ba649
SSDEEP 192:4OTOo45ZyAYcou3LDnmUjMFsrHZmxqJOXhNCGYHre3iR7v:4OTOoMhYcRaOXJ6koIv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\f87b5e0d3aee97f9a3\1042\LocalizedData.xml
Size 32KB
SHA256 cccda55294aeb4af166a8c0449bca2189ddf5aa9a43d5e939dd3803e61738331
MD5 71dfd70ae141f1d5c1366cb661b354b2
SHA1 c4b22590e6f6dd5d39e5158b831ae217ce17a776
SHA512 5000d62f3de41c3fb0ed8a8e9c37dbf4eb427c4f1e3ad3823d4716c6fe62250bac11b7987a302b8a45d91aabcf332457f7aff7d99f15edeffe540639e9440e8a
SSDEEP 192:4cdsW0fwUrh+UgYUDQhGAtPN/2JWCTJSIQvPaLWL2C4oH/Drv:4cdszvrBgYUDQhF5N7IJSIQvkQfLH/Pv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\f87b5e0d3aee97f9a3\1049\LocalizedData.xml
Size 39KB
SHA256 beef0631c17a4fb1ff0b625c50c6cb6c8ce90a1ae62c5e60e14bf3d915ad509c
MD5 0eeb554d0b9f9fcdb22401e2532e9cd0
SHA1 08799520b72a1ef92ac5b94a33509d1eddf6caf8
SHA512 2180e46a5a2ea1f59c879b729806ca02a232c66660f29c338c1fa7fbee2afa4b13d8777d1f7b63cf831eb42f3e55282d70aa8e53f40616b8a6e4d695c36e313d
SSDEEP 384:4q0oG/2VrQa0inweNLvSli+CJA3aJW5cGUT3CT+v:DVFJl
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\f87b5e0d3aee97f9a3\2052\LocalizedData.xml
Size 30KB
SHA256 d1735c8cfd8e10ba019d70818c19fa865e7c72f30ab6421a3748408f85fb96c3
MD5 52b1dc12ce4153aa759fb3bbe04d01fc
SHA1 bf21f8591c473d1fce68a9faf1e5942f486f6eba
SHA512 418903ae9a7baebf73d055e4774ff1917fbaab9ee7ed8c120c34bb10e7303f6dd7b7dae701596d4626387a30ae1b4d329a9af49b8718b360e2ff619c56c19623
SSDEEP 192:4Qn7cJwYTzOnyquEWTOAXUewfMcqQJywXk83GJPupIoxnb/2v:4Qn7cJxTC/uEWTfXUewiQJyoknJY9b+v
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\f87b5e0d3aee97f9a3\3082\LocalizedData.xml
Size 39KB
SHA256 f124d318138ff084b6484deb354cca0f72296e1341bf01169792b3e060c89e89
MD5 5397a12d466d55d566b4209e0e4f92d3
SHA1 fcffd8961fb487995543fc173521fdf5df6e243b
SHA512 7708f5a2ad3e4c90c4c216600435af87a1557f60caf880a3dd9b5f482e17399af9f0b9de03ff1dbdd210583e0fec5b466e35794ac24d6d37f9bbc094e52fc77b
SSDEEP 384:4fgA4Ukd+uYW1HCD1GO/tja2QDu7Jr++dP8z3AzOrv:tUZW1iDDdWCJi8Pg32Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

DHTMLHeader.html

Path \??\c:\f87b5e0d3aee97f9a3\DHTMLHeader.html
Size 15KB
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ParameterInfo.xml

Path \??\c:\f87b5e0d3aee97f9a3\ParameterInfo.xml
Size 8KB
SHA256 bf787b8c697ce418f9d4c07260f56d1145ca70db1cc4b1321d37840837621e8f
MD5 66590f13f4c9ba563a9180bdf25a5b80
SHA1 d6d9146faeec7824b8a09dd6978e5921cc151906
SHA512 aba67c66c2f3d9b3c9d71d64511895f15f696be8be0eedd2d6908e1203c4b0cf318b366f9f3cd9c3b3b8c0770462f83e6eea73e304c43f88d0cbedf69e7c92b3
SSDEEP 192:gCwdBdVv3CL021BqG2ahBCw2G2X2BCEj2G2KQ6G2nCw+KFl:kRPGiGPKGPGYCrKFl
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupUi.dll

Path \??\c:\f87b5e0d3aee97f9a3\SetupUi.dll
Size 288KB
SHA256 11565d97287c01d22ad2e46c78d8a822fa3e6524561d4c02dfc87e8d346c44e7
MD5 eb881e3dddc84b20bd92abcec444455f
SHA1 e2c32b1c86d4f70e39de65e9ebc4f361b24ff4a1
SHA512 5750cec73b36a3f19bfb055f880f3b6498a7ae589017333f6272d26f1c72c6f475a3308826268a098372bbb096b43fbd1e06e93eecc0a81046668228bc179a75
SSDEEP 3072:/LTVUK59JN+C0iy4Ww8oBcPFIOrvHvr8QDZHAAKWiIHT6llN1QkvQZaiionv5y/y:HOoMFrz8ygAKWiiIyKf73w
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupUi.xsd

Path \??\c:\f87b5e0d3aee97f9a3\SetupUi.xsd
Size 29KB
SHA256 222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093
MD5 2fadd9e618eff8175f2a6e8b95c0cacc
SHA1 9ab1710a217d15b192188b19467932d947b0a4f8
SHA512 a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca
SSDEEP 768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMC:1wchT+cxcDm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Strings.xml

Path \??\c:\f87b5e0d3aee97f9a3\Strings.xml
Size 13KB
SHA256 e49545feeae22198728ad04236e31e02035af7cc4d68e10cbecffd08669cbeca
MD5 332adf643747297b9bfa9527eaefe084
SHA1 670f933d778eca39938a515a39106551185205e9
SHA512 bea95ce35c4c37b4b2e36cc1e81fc297cc4a8e17b93f10423a02b015ddb593064541b5eb7003560fbeee512ed52869a113a6fb439c1133af01f884a0db0344b0
SSDEEP 384:VAZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VAB
MD5 SHA1 SHA512 SSDEEP

Submit Download

UiInfo.xml

Path \??\c:\f87b5e0d3aee97f9a3\UiInfo.xml
Size 35KB
SHA256 0d36a884a8381778bea71f5f9f0fc60cacadebd3f814679cb13414b8e7dbc283
MD5 812f8d2e53f076366fa3a214bb4cf558
SHA1 35ae734cfb99bb139906b5f4e8efbf950762f6f0
SHA512 1dcc3ef8c390ca49fbcd50c02accd8cc5700db3594428e2129f79feb81e4cbbeef1b4a10628b2cd66edf31a69ed39ca2f4e252ad8aa13d2f793fca5b9a1eaf23
SSDEEP 768:S4UR0d5v0SguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjT5fuPkfuS:S4UR0d5v0QYQLIN/6Fmhvk71sO0Nep3q
MD5 SHA1 SHA512 SSDEEP

Submit Download

print.ico

Path \??\c:\f87b5e0d3aee97f9a3\graphics\print.ico
Size 1KB
SHA256 ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed
MD5 7e55ddc6d611176e697d01c90a1212cf
SHA1 e2620da05b8e4e2360da579a7be32c1b225deb1b
SHA512 283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e
MD5 SHA1 SHA512

Submit Download

save.ico

Path \??\c:\f87b5e0d3aee97f9a3\graphics\save.ico
Size 1KB
SHA256 ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5
MD5 7d62e82d960a938c98da02b1d5201bd5
SHA1 194e96b0440bf8631887e5e9d3cc485f8e90fbf5
SHA512 ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67
MD5 SHA1 SHA512

Submit Download

setup.ico

Path \??\c:\f87b5e0d3aee97f9a3\graphics\setup.ico
Size 35KB
SHA256 288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f
MD5 3d25d679e0ff0b8c94273dcd8b07049d
SHA1 a517fc5e96bc68a02a44093673ee7e076ad57308
SHA512 3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255
SSDEEP 384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQcho:IMWQ2Bf8qqxMQP8pc4XessTJo
MD5 SHA1 SHA512 SSDEEP

Submit Download

stop.ico

Path \??\c:\f87b5e0d3aee97f9a3\graphics\stop.ico
Size 9KB
SHA256 b499e1b21091b539d4906e45b6fdf490d5445256b72871aece2f5b2562c11793
MD5 5dfa8d3abcf4962d9ec41cfc7c0f75e3
SHA1 4196b0878c6c66b6fa260ab765a0e79f7aec0d24
SHA512 69a13d4348384f134ba93c9a846c6760b342e3a7a2e9df9c7062088105ac0b77b8a524f179efb1724c0ce168e01ba8bb46f2d6fae39cabe32cab9a34fc293e4a
SSDEEP 96:uC1kqWje1S/f1AXa0w+2ZM4xD02EuZkULqcA0zjrpthQ2Ngms9+LmODclhpjdfLt:JkqAFqroMS9lD9Ngr9+m7bxpXHT5ToYR
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqmapi.dll

Path \??\c:\f87b5e0d3aee97f9a3\sqmapi.dll
Size 141KB
SHA256 bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
MD5 3f0363b40376047eff6a9b97d633b750
SHA1 4eaf6650eca5ce931ee771181b04263c536a948b
SHA512 537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8
SSDEEP 3072:uochw/MFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9YSHlN:zDFB47UhXBh2yJ5HcOSSSHZqG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-352-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/440-345-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/996-125-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/996-118-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/996-119-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/996-614-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1192-166-0x0000000001000000-0x000000000157C000-memory.dmp

Download

memory/1192-0-0x0000000001000000-0x000000000157C000-memory.dmp

Download

memory/1192-8-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/1192-1-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/1244-173-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1244-341-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1352-618-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1352-357-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1368-353-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1416-346-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1416-597-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1464-556-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1464-26-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1464-34-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1464-35-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2252-140-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2252-146-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2252-617-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2252-149-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2296-167-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2296-171-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2296-169-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/2296-157-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/2296-151-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/2344-12-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2344-21-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2344-20-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2344-340-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2444-358-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3144-354-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3376-359-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3376-619-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3592-342-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4280-344-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4400-620-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4400-360-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4680-347-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4924-355-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4928-113-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/4928-98-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4928-101-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/4928-109-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/4928-116-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4996-282-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5036-343-0x0000000140000000-0x00000001400AB000-memory.dmp

Download