303ebbcd58e6c6ec1926f7cb13cd905ef36cd4809e5ffe4d88ea129211f74ca2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
Size 5.5MB
Sample240603-zhbkragg7t
SHA256 303ebbcd58e6c6ec1926f7cb13cd905ef36cd4809e5ffe4d88ea129211f74ca2
MD5 0035dfaf19ffa70a2c41c60ce47279a0
SHA1 97883dce7a429ba8e4e4ac541a5d77806c1e3e5e
SHA512 7697d1e094a686c3984d38e69a19a9d5b7a195a5ccec61606e4b138fe050b30178898f6b66266efb8c4066108b65012c0de0ccce2f899b83de17a0477988aa2e
SSDEEP 49152:ZEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfv:NAI5pAdVJn9tbnR1VgBVmzQWdO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
4924	alg.exe
3488	DiagnosticsHub.StandardCollector.Service.exe
2332	fxssvc.exe
2776	elevation_service.exe
3784	elevation_service.exe
3212	maintenanceservice.exe
2452	msdtc.exe
4932	OSE.EXE
3984	PerceptionSimulationService.exe
4516	perfhost.exe
4180	locator.exe
3484	SensorDataService.exe
1316	snmptrap.exe
3988	spectrum.exe
400	ssh-agent.exe
4364	TieringEngineService.exe
3824	AgentService.exe
436	vds.exe
2380	vssvc.exe
1372	wbengine.exe
4608	WmiApSrv.exe
3084	SearchIndexer.exe
6076	chrmstp.exe
4032	chrmstp.exe
5436	chrmstp.exe
5592	chrmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dca08f38293b476c.bin	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\alg.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\msdtc.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071c8e49ef6b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7d8359ff6b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d4c8b9cf6b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fde6a59ff6b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007835b49ff6b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007510d9ff6b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b62069ef6b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f02ff9ef6b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e13fb59ef6b5da01	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1408	chrome.exe
1408	chrome.exe
3656	chrome.exe
3656	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	876	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	4236	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
Token: SeAuditPrivilege	2332	fxssvc.exe
Token: SeRestorePrivilege	4364	TieringEngineService.exe
Token: SeManageVolumePrivilege	4364	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3824	AgentService.exe
Token: SeBackupPrivilege	2380	vssvc.exe
Token: SeRestorePrivilege	2380	vssvc.exe
Token: SeAuditPrivilege	2380	vssvc.exe
Token: SeBackupPrivilege	1372	wbengine.exe
Token: SeRestorePrivilege	1372	wbengine.exe
Token: SeSecurityPrivilege	1372	wbengine.exe
Token: 33	3084	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3084	SearchIndexer.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe
Token: SeShutdownPrivilege	1408	chrome.exe
Token: SeCreatePagefilePrivilege	1408	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1408	chrome.exe
1408	chrome.exe
1408	chrome.exe
5436	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 4236	876	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe	83
PID 876 wrote to memory of 4236	876	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe	83
PID 876 wrote to memory of 1408	876	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe	85
PID 876 wrote to memory of 1408	876	0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe	85
PID 1408 wrote to memory of 4260	1408	chrome.exe	86
PID 1408 wrote to memory of 4260	1408	chrome.exe	86
PID 3084 wrote to memory of 5060	3084	SearchIndexer.exe	112
PID 3084 wrote to memory of 5060	3084	SearchIndexer.exe	112
PID 3084 wrote to memory of 4896	3084	SearchIndexer.exe	113
PID 3084 wrote to memory of 4896	3084	SearchIndexer.exe	113
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 628	1408	chrome.exe	114
PID 1408 wrote to memory of 380	1408	chrome.exe	115
PID 1408 wrote to memory of 380	1408	chrome.exe	115
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116
PID 1408 wrote to memory of 2584	1408	chrome.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876
- C:\Users\Admin\AppData\Local\Temp\0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\0035dfaf19ffa70a2c41c60ce47279a0_NeikiAnalytics.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0xfc,0x100,0x10c,0x7ff8591bab58,0x7ff8591bab68,0x7ff8591bab78
    3⤵
    PID:4260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1908,i,10848929848432365726,3480358424166796023,131072 /prefetch:2
    3⤵
    PID:628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1908,i,10848929848432365726,3480358424166796023,131072 /prefetch:8
    3⤵
    PID:380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1908,i,10848929848432365726,3480358424166796023,131072 /prefetch:8
    3⤵
    PID:2584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1908,i,10848929848432365726,3480358424166796023,131072 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1908,i,10848929848432365726,3480358424166796023,131072 /prefetch:1
    3⤵
    PID:3308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3792 --field-trial-handle=1908,i,10848929848432365726,3480358424166796023,131072 /prefetch:1
    3⤵
    PID:5276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4408 --field-trial-handle=1908,i,10848929848432365726,3480358424166796023,131072 /prefetch:8
    3⤵
    PID:5348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4548 --field-trial-handle=1908,i,10848929848432365726,3480358424166796023,131072 /prefetch:8
    3⤵
    PID:5368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4544 --field-trial-handle=1908,i,10848929848432365726,3480358424166796023,131072 /prefetch:8
    3⤵
    PID:5952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 --field-trial-handle=1908,i,10848929848432365726,3480358424166796023,131072 /prefetch:8
    3⤵
    PID:6012
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:6076
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:4032
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5436
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:5592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1908,i,10848929848432365726,3480358424166796023,131072 /prefetch:8
    3⤵
    PID:5292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,10848929848432365726,3480358424166796023,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3656

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4924

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1456

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3784

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3212

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2452

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4516

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4180

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3484

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3988

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1096

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4608

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5060
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 85b9202b74cf0452c7d2a19986e44ffcbe421ce73ac8cb5da5acd2a8bcb94476
MD5 1bef2bd04fafd01fca7afde26bd0bea0
SHA1 b16506db53870446e0b635d0138f4843decbcc9c
SHA512 83c75dd738a2106d696a5037dad2ee0549162c29d99ef0f99b6598a6f3651a5ae9588d670e102bf30143c368d44eb527a4505342e85e8b9358d054d97abcb80b
SSDEEP 49152:xuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5TEjhMjSax84:xPfTqi90bnQWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 af62300972fa4aa1c02860ef527eb466785e7a7968450817dfb46cc26a97bedc
MD5 443fad67689adae2013ed304fe57a9e0
SHA1 27016645c479f05fc3d21eeb4741c23769548b81
SHA512 2048f8be59a7b29040987509a60b48895c9f81f1ac86d17c48da843c0a3c11ecb9c01eb6015b092a9eaf5d2bdf0717bd49fe94eb636eff07abbf0be7ca59d35f
SSDEEP 12288:vcQi7mNJLBsunEFwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+g:PiynBsuEksRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0ffecf4ef30719415f1916c1d9b3247affbfe5db7a414ba0702dc8eb458d9762
MD5 1318f7b2e1b66bc0e8ce2d4a86c9c12d
SHA1 2f1dd6e422fd9140a967838519614eb9830a64c0
SHA512 74f76f4a2447e001bc502d6bf314c9f1b33c9a2cf63b7e00a0cca283d25e02061967ab6e90fed861c93272d06b39efc3dbf280441e5c2ba09a6de99a55185e8e
SSDEEP 12288:Wmw5HEjsChNMBFgl0WDm+CNwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+7:PwuBOWLsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 fde446cd95c364a820f3531ec5864d0ff1d89df1228fae096c873cbe880497b7
MD5 7bfbc4458e0b04ba75d4055c4ded4677
SHA1 e90c45c17bf1d2eb0f396ba3dba879a07fb03b23
SHA512 a3380b2a60ad3f599171e4792312b0a8a10e95fcd409d4fee5dd588d558a1706463069fc819fd3f97c28576bc33f2b1ce7dc969ef05dc3ea8e3933db834b66cd
SSDEEP 49152:I0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWL3:uwfhY7g/rLd7yYA3awr341goQWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 721dcb5db2594c8bc36df3cac9028a0860922d6086776f9a24ab7001cea7193f
MD5 6e8e53580110d2732be5615e6eec3a00
SHA1 bad9932d7e64a4373872c576f72f1fd034ba96f9
SHA512 b6ed380ffc8c44f759b8977d2f90c3e687ad08ed575be5ed77f6434591429cee915f9484d1625e20d3dbb66d6af84ac185526c530098ab0b57c588058976af45
SSDEEP 49152:ry7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxnEjhMjSax84:WmYeyxHjWjMTnQWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2449de-cd5e-4081-95bf-762ef5ed0b3d.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5a2449de-cd5e-4081-95bf-762ef5ed0b3d.tmp
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 62d7beeb501a1dcd8ce49a2f96b3346f4a7823c6f5c47dac0e6dc6e486801790
MD5 23e6ef5a90e33c22bae14f76f2684f3a
SHA1 77c72b67f257c2dde499789fd62a0dc0503f3f21
SHA512 23be0240146ba8d857fc8d37d77eb722066065877d1f698f0d3e185fcdae3daf9e1b2580a1db839c1356a45b599996d5acc83fda2af36840d3a8748684df5122
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1c00b03323b0f522011a067bc8f378193bb092e46384502aa9a713d5aedc99a1
MD5 81b0cdb960ed53e444e77b17845a54ab
SHA1 c8281203c10a6c0cd91b2210f07922cfcc37be9e
SHA512 0fc661b4b1e83b35cd1dfbcbe55dc61384e27c1fffe462a11bfd5a671cf85f333f772bb042bbe8043c823528c778706f6fea7f33823454a098e964bc4d7272c2
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 5b9955b5089c35a2c44fe46a753b07207b2e8c5d2c796b31f4a7fd4fdce05494
MD5 902c97a7fa969b00595a7da8c944418b
SHA1 b163df50d3db0ef33fdb912030dd8e40110f5666
SHA512 e5905c881a53e575f08be85a48ecc392fa6f4b636f279bf57409c0b92b13424293d2aa6967f56a0189601ea8b72fc558a9b62f26760b65b6fff8657cb5a424eb
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 dd233b713a879776f3f23a3f19ecf33b14b957c4d3871c7293996341dd68526e
MD5 fc715bc4213adbc29c9bf6007667e0f3
SHA1 1fe0cbdbf149bcb6de0c2a4fc1040906a3ca20a4
SHA512 327d8168e8b461a86ceefb25cee17a8894031fc497f31baa99e6e7de264f3333626d1d140ca7f446b1f0727a23c976e477512e09b2511c1a1b1efee7d73f9717
SSDEEP 96:RKgnAxsXRNJGNfWkJVVF8iZRy7Dx+6MSmueABO0ZY2MEVMup:R5Axsh/CRJrF8syh+FQvYPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe57833a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57833a.TMP
Size 2KB
SHA256 975c8308bab1dce91143c9ad18effdd216bc367fccb3195ec2d4fd50177d2158
MD5 8441fa327ce1f6c12f371a1535e655be
SHA1 7ccca62179f1eb9a2d47c3886ad8ad4bf5b15071
SHA512 986088d4595dc5a9e166ecc0b439a878a24d512f236b2756e377050c0cc7423143d3aaa3033ba5163b28fe8551313ff985d6df2ab109117186e878ca4a98d0a4
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 a4cdf5e9a538ac6add8d0c3843424c485b44e0b40771fcc0d58f1e3299aa4ea5
MD5 43859056f8ce34ab355c9163473f4eb8
SHA1 5edc139f82d975688398c75f2c877c4c7c1aefe2
SHA512 dda94ebd8267f03a902dd4df9525694397de66ce0d2ca196fac5d80d3086e0cb4c3d2f6c5697e282b26420d57d251a092c472fe2fd7f95ef927493790151dc48
SSDEEP 384:qK56LPLedbXjV1kXqKf/pUZNCgVLH2Hf9SLrUSJHGSYO3R6:qy6LPLQDjV1kXqKf/pUZNCgVLH2HfULC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 259KB
SHA256 01218b16928c2b496818cd4c8feab92f8adb609e44feca4f9b2910493a7d3919
MD5 c7c0ef75e48757d43c3365d90e712c6e
SHA1 3d32034a664d607e500283cb41ffddd8c8fb1aeb
SHA512 1519ee184cd379d0063383b5c2313de9750a463d2dbcdcc35d6b8696332c46da16b6cf4902cfd16fb1a2d71aafc7cc6aa1414f69cee890f23b72c257dcc48244
SSDEEP 3072:dvoFSxo70xyNCzdMrXi2rmu8+s5rk7elHalXJtel1QotTyzB+lLrOuxfBSw6jKyt:VgtCzMmLrurI1Qo5yzkpeXjnJFzXsW5
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 b6858a64e679a303f1c9a2e9275c2a9f606953bc33d659cabd16c3d650b5b261
MD5 f24a1fc76a414241c8729e5921759688
SHA1 623bfc9636d668132485f5323d38d9861f0772fb
SHA512 957335fbb936a6547da318de5061ab01e3756f1b608bfdbe2ebb3dc972858a2d5843f7ce7c66fc007a025bbfcb0f5c13e2edc0f2634c40b2ccfaa3230a2e1e42
SSDEEP 96:a6R6jpO7KCqvPK7gFwK3LK33OhwsHXC50wK24K2ZTPX708QN0i:D04/7PW9nCTyIdNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 9KB
SHA256 f0716b66fc78d9a37f70aeeee6f13520b2e6c1c8f27fd3b93d9e33ea631ff177
MD5 a92a9e162b2cb5f0f0b2c4baed16daf4
SHA1 f8b7a6021d6f352b6a3b3d720b98d7470c8d1fb3
SHA512 06143f3f697f4f640342bf790a634fc3bef287089f7145d0f1cb1f0dd334ed28534c1eed5cc1452e80c8d4f449e8dd947c1ae38a34e53e7e8614e705e2e83642
SSDEEP 96:a6R6jpO7KCqvPK7gFwK3LK33OhwsHXC50wK24K2ZTPX708QN0ovoEgro3wK3IQK5:D04/7PW9nCTyIdNgEgcgXQo
MD5 SHA1 SHA512 SSDEEP

Submit Download

dca08f38293b476c.bin

Path C:\Users\Admin\AppData\Roaming\dca08f38293b476c.bin
Size 12KB
SHA256 466ae68f0af9b7a2e7e056019c560ff1d2a24f1203b814e5ea6a28076ef9adf8
MD5 d2b30582555123baa9fd66a27f943a3d
SHA1 ce2bf2e288093cddd92dafc798bfaab5421d8880
SHA512 28ee44edd33ef712f129583f739dff28a96599a2a9a723dfa800d2162312f05984344689e3792b6b62525ba0de0dbaacb989fb229c141e02ca7770ed86e4582f
SSDEEP 192:ruheXNeWNQneXLqebNxHuuY5XrkrPhPUqhDiLwg6V+ayigKG29OwUR9U:r9eWNQn4N9uum4zVlWLBKqXL23EU
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cc210d17fb13159cdaf8de7cd4b4b94a92201baf11646e48fb8662b1ef10c6a6
MD5 76cf81f7a26c6e1086443bbf55272b17
SHA1 90180ca7199e2d779ee5656f807b7079cc59646e
SHA512 50522ace1fa72c7d6540d768ba46a0e3024a3c559a1e00b74c2cbbd2b3da98555c6d264aaa1eb5bf948cadd886d7411961adce11866312102b6d65827fde4529
SSDEEP 12288:6/wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+x:6KsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 25bbfc92a330649dc8d5b4e9d08f1ab1b5be46f142ea63d6fc921fb4a2358332
MD5 164785730809ed64572c025f41b5a03a
SHA1 5cc4b9f721bf882e8bec8688b5efca5454f6dc01
SHA512 784755d3cb114cbee7459831473ed494736d18edc6f8d82775accdbe702e569398c78e73f5b0d6a925221e3a814d76691e1060f14db34e6796140ebe934c31a8
SSDEEP 49152:ja0h2GEkuAe73q3pp46zwwQYEjhMjSax84:ja0hNYG4Jw/QWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 3f46dd79efcf4520fc849efb073f5c412794e3ae83ea05f0e0c4730a05d24297
MD5 9652a01e78b1af56ea6928770a378a67
SHA1 627383c42422d243a7a2d33ea98ebe4b2e046eed
SHA512 d275beb610fc63cbd1ba8806456160e4d2743099c5c289c517662ed7db4fb2947f4b309de535611edbb5330be3837281d0c1fb611e6d888280be8f070aa09e02
SSDEEP 12288:WhbHjfX6wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+B:WhbHjPTsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 74d68587f5a14926556f2ca8017fac1465f7fafab9f570d03edee6fd4d2fd337
MD5 d94655ba6b020323c73ca55d583d3096
SHA1 7739fdf6a055b33d59805e200c97f70531cf0b8c
SHA512 df8bead3c57a14e9f2294005bc94dd39a140fdd5bfd3db3f50ffb805a4a09c09690e447819c326f7c170198b7b8bc5f8a02759c18932041933499b93f07e72c2
SSDEEP 24576:53YgnJcRTk4yti+R5dpR/LsRjhm0Ijr/eax8JXO02q3A:5IgnaTk46ppR/LEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.1MB
SHA256 a316b919f587da4cf0a1b849a4c51d34a988f78d83e71cec8519dda55649dcd4
MD5 e04c4e27820da9cd91f089c13d56539e
SHA1 876be1cb414323a333844eb31153175ae7b5e623
SHA512 83c386736243fbc36aa9791a699d3bc6d88f4f6f5e0ad9e0cc3e23d94f96e88f8b9f1373bcf319cd9896a681a11c219861eac931c1e03af3c9c39027d17c4d78
SSDEEP 12288:UzwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+V:U+sRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 8982bd2be473317083c9f67b912a068219cf73808709b92fe448590e556d3164
MD5 f56a2f247f3cce367e6c8e483d8ece65
SHA1 fc7cd7327ed567be30a074f0623992e8a24b690e
SHA512 bdcdec50572a0c33b2e18e51d1c2b4b32527015489a6bf0abc34d909bb74c12f42c2d0645c6b641cb0cf530ecf01cd7fc114a86b4ca48f60cef9f16050727315
SSDEEP 12288:kOb2A4LWOsvAYFTEwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+Y:JGL3UTpsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 7e735900cda373c03b56073ec2b8d1f8519b97deb2e83614acc3d75858f22d35
MD5 685250a172b6611be939b70ada4a3a5c
SHA1 3f3a728a97db931e889164f0add5c98f9974ea60
SHA512 c6f793babe9d8e45be0440d60fd50e8f43fe83fc59539904e459d3931e3766d14da16dd7d24c42690db3e3f78436149c1e4a6bc978ac53919d5681e1a94ae2de
SSDEEP 12288:kpFt4O4wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+n:jOtsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 34319c573edbae141e7e11ed53e94af34391316e2db713b207f292197959f6d0
MD5 88f52d2b7f3e1156c574d2b7425eaad7
SHA1 df7d92427330d42c97b7b785c0c532f30b39351a
SHA512 af5fde8731481f1812b17982c11e20c9942ec0ca2c128c63e2710249edd32c2dba259f51066f6c4285547ae8287e5a2ee6779f41ce3f1fa4912c170ef77df690
SSDEEP 24576:N7NM9YmZqmWMUkPjZM48Mv6bEhs6sRjhm0Ijr/eax8JXO02q3A:N7cBWMpPjN8DbEhzEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f511ad007f1c50508bdeaa306ba9dbc84634e746e6ecf1c99b5ff64dec09f6dd
MD5 2a04d6f92cb1312a59d03804db0efafa
SHA1 4033a796bdba422b5e50de627b4fe93d363b13f4
SHA512 a0645918e81b3ec014dd1e0a110aa87a4780ea925a7dffc567783337c3d8e7767987e73e8572dff0ed72580d779e799aa467bddcaa1ed1505dbc3f7d58b2f9db
SSDEEP 24576:WW6BApg2YuyuNDYTabvcRvNYf8km1EsRjhm0Ijr/eax8JXO02q3A:WF2YuHNETovcvNYf8kmaEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f50f9cb1b5e5f76f3a5f55077afd21222605c59dcdfc4b5ce7dc99364f3bf75c
MD5 ac7bbd8ac1ad45211f7a06a8f9bd5e9e
SHA1 056d9ec13ea1d782dcd7a51d3ede6b35c49db96e
SHA512 df772bb04a6ac98c768bbef8d4230c15296c2e807c400664b398312547c1e243fd5d5af7990977c14dc85e3f455874d28d5060e17cd2d92e80f5cf8b349ca086
SSDEEP 24576:HAFs06+Omlf3NXEbToxsRjhm0Ijr/eax8JXO02q3A:gFs060lVXu4EjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.4MB
SHA256 2fe15fc588e1a3619b76471794abc6aa31b7b146cf911fd15c53e77df5ea97c4
MD5 969bdd63415e57de573276546fa9911a
SHA1 552974d3992ab99d92edd2c9b4a122745b9e08b4
SHA512 901b211a16fd3ae948aabb3e200a42a0da4dff4f4917acc0fdffd0267f2201c27b36e8ee989feff331a7eeb5a88704573c8d743784f6673c2a4f3345497a0949
SSDEEP 24576:sJnJ5D3W34sRjhm0Ijr/eax8JXO02q3A:sJnJ5DG34EjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 91ebc73ad2c20da93f1f454a1775035eb6659f547ee46595c9a58ef80b404fcc
MD5 9d0d1874765f8e726ff9fe38da654acf
SHA1 232508f2f25fa757c59e48c4c75b03a8139983a7
SHA512 eddc91b55baf334f8ac75e2bbc1889f6cfd616996f61a8ca20e7e5f96df819d0255269d57b6315731ea50a652a8f338d3903efca496725c2be22728e17bef09f
SSDEEP 24576:9EPohm6/7IIXdwcXrif7qQncjlP65i3VuLsRjhm0Ijr/eax8JXO02q3A:Ko06DIKdwc+eQnSt65aVGEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 559d378792b1f80f3eecb208fec91cd73d8ecdeb3fc158ce422406a35ace863b
MD5 f9b1d0dd8da27483c8fe5b6c15412e47
SHA1 295a34bc5f8bdb64a6d624a67fbda952ed903893
SHA512 4fe0cf93acbcfb79e0ca638c2c2f39e929440d41495f16a5c26358cbfa269d24a87a729f16a35827c49b8df20d24ff254e88bb193c98b648fc464051869f3b47
SSDEEP 12288:UEP3Ra0wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj++:Pa5sRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 ac18e7326134f26d66d94d8055cf9edca0758398023c580d7c8959c52ac4e672
MD5 599281e1c5310aa356e30d76aed4da5c
SHA1 dd7aadf36074964cf95584416a1ac5a32b2bb61e
SHA512 a9ebb8b3e319ca571b5fd9253a344e6d0b3b3a74ab518806ed7962c6b77d56a98a2669d3ca7b950360f08b13709207f3acd6fbdcece3e5339f61651d289506e0
SSDEEP 12288:2jkyqwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+x:2IyjsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.1MB
SHA256 69c903d1dad40ac0208aab5bdd59c9c9ab212e9f75efb8d92ad5ff1ce021d04b
MD5 96892f91721d908ee41d8bf1e3a5e1d5
SHA1 5a0b1400de586238dd32cbc18d3d223c081683dd
SHA512 cf3008ae54c8ffa70928e2a155bc34612c621f005a02a5bd4769211db33dc9a4da7247f48dbb6f7884665e7357a6718f016567657136d265d09ca8e8ee2db68d
SSDEEP 12288:e6owYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+8:z9sRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 239c3d7d5561a5abde701746eea0472c5056c11659f2fa1dd75afb0f2b511c2b
MD5 9b3029a15145ed89d960de2c73889c20
SHA1 1771a2d925a5df0dd8d98b6884b60a3169d3e7a2
SHA512 ba48abe82559251d42975b0f229872ce9a5fcf302daa5495a720a3064be9f0333724dbfe2ef3aae4cdb723816a0055982b0a49841469ee0f4e0e4e0acc7cdb72
SSDEEP 24576:KQ9MxZKdcz97w3isRjhm0Ijr/eax8JXO02q3A:KVKXiEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 d21de487819246f09f91a1d76ffd22cc6264cbd45a5e92dee15b8e4eba8719ff
MD5 c977104b17165719e65d1beb50aae4c3
SHA1 d580f5dcd5e474a41478306998852e0ebb565567
SHA512 7d791dbd5f3cdca6b99b86247822507f37fbfbc7d42d99b944bdbd307c2aec1a913ea38e79a2108f93e0be21d6d4da55b4dbe4c94ddf91a0cf701cba97dc9f27
SSDEEP 12288:uyoKo2ORple9pOwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+o:uyocEApnsRjhm0Ijr/eax8JXO02q3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 27ad6c9b08f0956fb384328d685b3043cca3d6a30cd4df08177ef2f8b3f6b8a4
MD5 48215dc2b85fd97705a461cab7effc4a
SHA1 cf38c44940426393fb955287d6d1b803a491e561
SHA512 3af464a83b882038b6f9066fd6d09035cc21bea76509712b0e1cf5c3b0320705353eafffc262173756a4e04c025781ff0a751796320c9904a7f3ba5784791fdb
SSDEEP 49152:zWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKnEjhMjSax84:z0zuNIbQWdO
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 fdf37f8111f0fabb5be766202a1a0b5a294818c4c448af0fec9003242123e3e6
MD5 440112092893b01f78caecd30d754c2c
SHA1 f91512acaa9b371b541b1d6cd789dff5f6501dd3
SHA512 194c7b90414a57eb8f5ba0fc504e585ab26b2830ed0aae29cf126d5a6c4888d508c22984aeedec651c8644fb1f874fa558b2090488516b33165fe7985d2815ea
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 44c161dab354ed5f4830b508dffb09d9f730d90d82619b5434da79b5533bac6a
MD5 24e90431275b09858bb1709c266c4032
SHA1 fd1ba2dfbabc30eb51744b021b0e932aec9c9b2b
SHA512 79954269bdbc16cc05c4161f23cf87145a3ccf7f8f48bfb9b848f0ea086b9b5448074088bb0afde523980bbdaec50bb6c700c90331545a8816091feac52f8088
SSDEEP 24576:51QT7EcpfxR+N5AWAz3ooiYtjMqb5sRjhm0Ijr/eax8JXO02q3A:sTDxR+N5YzTfjMkEjhMjSax84
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-321-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/436-324-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/876-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/876-9-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/876-36-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/876-32-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/876-6-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1316-319-0x0000000140000000-0x000000014012A000-memory.dmp

Download

memory/1372-327-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2332-74-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/2332-55-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/2332-76-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2332-61-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/2380-326-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2452-313-0x0000000140000000-0x000000014014D000-memory.dmp

Download

memory/2776-460-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2776-71-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2776-65-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2776-312-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3084-331-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3084-783-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3212-88-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3212-100-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/3484-318-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3484-604-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3488-51-0x0000000140000000-0x000000014013D000-memory.dmp

Download

memory/3488-43-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3488-52-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3784-311-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3784-78-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3784-781-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3784-84-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3824-218-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3984-315-0x0000000140000000-0x000000014013F000-memory.dmp

Download

memory/3988-320-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4032-550-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4032-784-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4180-317-0x0000000140000000-0x0000000140129000-memory.dmp

Download

memory/4236-768-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4236-21-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4236-12-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4236-28-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4364-322-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4516-316-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/4608-782-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/4608-328-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/4924-18-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/4924-769-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4924-26-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/4924-29-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4932-314-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/5436-573-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5436-586-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5592-576-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5592-785-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/6076-539-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/6076-597-0x0000000140000000-0x000000014057B000-memory.dmp

Download