c61da705acb00643e7e6c352f59a0cbdbe591cba7f85c5cc9de25d87db321a72

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
Size 712KB
Sample240604-a4x87sfc3x
SHA256 c61da705acb00643e7e6c352f59a0cbdbe591cba7f85c5cc9de25d87db321a72
MD5 18f2272dc848a6813d6e0dc7d89508b0
SHA1 64d2701c8125ea1a97504d4538453899116f6370
SHA512 b4e4b1531eb52472de605f9166067a8dfdefa191efc1e90459753af1a4a06b6264b3c3abb0aeae50d9071e51f04ccb8c9b35247ebbe0e7ed08ca4973ee7b2705
SSDEEP 12288:XtOw6BaMZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:t6BxW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
996	alg.exe
908	DiagnosticsHub.StandardCollector.Service.exe
3528	fxssvc.exe
4728	elevation_service.exe
512	elevation_service.exe
4392	maintenanceservice.exe
4800	msdtc.exe
5028	OSE.EXE
1084	PerceptionSimulationService.exe
844	perfhost.exe
3504	locator.exe
5032	SensorDataService.exe
2016	snmptrap.exe
2784	spectrum.exe
868	ssh-agent.exe
1124	TieringEngineService.exe
1768	AgentService.exe
4964	vds.exe
4312	vssvc.exe
1516	wbengine.exe
1408	WmiApSrv.exe
3240	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\alg.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\125f9ad7293b476c.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005fed44af18b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef477ab618b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000920dbaf18b6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fdb12af18b6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5d183b618b6da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e283beaf18b6da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c47e2af18b6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a7424b618b6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec65fdae18b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000065e4fb618b6da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc9a2bb618b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d222bcaf18b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
908	DiagnosticsHub.StandardCollector.Service.exe
908	DiagnosticsHub.StandardCollector.Service.exe
908	DiagnosticsHub.StandardCollector.Service.exe
908	DiagnosticsHub.StandardCollector.Service.exe
908	DiagnosticsHub.StandardCollector.Service.exe
908	DiagnosticsHub.StandardCollector.Service.exe
908	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
648	Process not Found
648	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
Token: SeAuditPrivilege	3528	fxssvc.exe
Token: SeRestorePrivilege	1124	TieringEngineService.exe
Token: SeManageVolumePrivilege	1124	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1768	AgentService.exe
Token: SeBackupPrivilege	4312	vssvc.exe
Token: SeRestorePrivilege	4312	vssvc.exe
Token: SeAuditPrivilege	4312	vssvc.exe
Token: SeBackupPrivilege	1516	wbengine.exe
Token: SeRestorePrivilege	1516	wbengine.exe
Token: SeSecurityPrivilege	1516	wbengine.exe
Token: 33	3240	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeDebugPrivilege	3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3608	18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	908	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 1816	3240	SearchIndexer.exe	110
PID 3240 wrote to memory of 1816	3240	SearchIndexer.exe	110
PID 3240 wrote to memory of 4044	3240	SearchIndexer.exe	111
PID 3240 wrote to memory of 4044	3240	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18f2272dc848a6813d6e0dc7d89508b0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3608

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:996

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3096

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:512

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4392

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4800

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5028

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1084

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:844

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3504

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5032

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2016

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2784

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:868

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1492

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4964

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1408

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1816
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 a487c274fb26f776763492eb4858d70204743db60476aac5e4cf81e5a6c0d4be
MD5 8d83e48637127740eec36db4210d1961
SHA1 328b9fb584865c7eca1b9968337560e2ebcd0411
SHA512 10e1cb0c8a4dd1d03f5a7e28808aaf2dadf4ef2bfcf3b7e470cd57747d396af220360aec7b03f493956227416afbc1179ed0c85b39aa17d368d1ba45151fb2e6
SSDEEP 49152:xuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z51+pWAV7QqejX:xPfTqi90bsWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 cb221f259c873861ac6be0acee646b5ddf46b8c134250641579bc974ccdb1127
MD5 7a6a87d25a18fdd808c31a477ada6362
SHA1 7a260618fceedfc42fe41ccdd133ee33c0d36620
SHA512 4fb27899fdbe8a9b5430eff30350af726c40edd8c804a2733c0e958ce5c6d07a3ce4556c5d1c6113b7579cbb11c14cce78768fbbb3e080a70e32ad754b472936
SSDEEP 12288:jcQiQmNJLBsunEnZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:ridnBsuEnW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a03e2059d207328f7f555e865b70e8261361695cc5bebb89ea823e9b6546e8da
MD5 6c9f29524dcf8d7267c0cab832321353
SHA1 baf990eeac80938be819084044c8a724ce00eef6
SHA512 3592d05a95cda59f4f115025d09711bae55792af46dc7678218d2b6bb1dc94696086a43df02512af99d7bd553c09f5fdb9354ff2c236174d7c99682f7ac7c7f8
SSDEEP 24576:t+gkEVfh4CoTW+vxWJq0Q7QqtWLjXTqM:UgkExS4+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5593a7b6216b090b7935e16c279bdd9f941c77f983e5059d584aea0b07a90f21
MD5 4e388040afbe63d40ebf5595e33798a6
SHA1 22dcafc98d37cc9aaa387f81dcdfa288e4a72b97
SHA512 c0c2e01984575b33150d2a00bce439d5bb449f865327742b1f0821125f1ec2eb093da8a28479bc91be7a220d157a3a5a18a266a437af3520ffad0698805c0d22
SSDEEP 24576:7BpDRmi78gkPXlyo0GxjrUW+vxWJq0Q7QqtWLjXTqM:NNRmi78gkPX4o0GxjV+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 20b32c101e34919eb6b88683ca17212a9d2400af2fc2bfaa4f2d6c0ae3821b42
MD5 ebc7bc7dbbf67e20bf2f3619c5b23c6a
SHA1 ac81e1d4e550a1612a87510cd87e35fb6fdf825b
SHA512 1444e66eba20bf4ee1159875f739bb94a04a8e829dd3402c3d4aa21f0da98d1e08592656b8de97ac4f25a77ea58ae857fb8e5421a7237d5060e6dbc7d74bcdb0
SSDEEP 24576:eLOS2oyPIXVTW+vxWJq0Q7QqtWLjXTqM:+/yN+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 6ebafaefe9f77f1b2dcc3cb21d67083bef55616c9b62fa98461269745a290837
MD5 e1ed0f49e7b0f178c51f290de00fa723
SHA1 15d4583017717a33937b6b9dce3941d344fdcfab
SHA512 1cf0f1c31e0164624b237f54d885e5ec40dcba8c682e3829658f5ff2a1e8efecc9d35b90c784537eb1bd334f7e233d9afa8b4e7ef236b7749de6de7519d970fa
SSDEEP 12288:SflZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:SflW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 82d34972d807caccb32009ca5cd5f3de633a2b75130b3cba35aae4bd99aa4047
MD5 c25cbeac4e7c183dd21f18816f8b63b5
SHA1 16e2cdfad2dec516485c606c4a357e1688622168
SHA512 9ff66c8689752f96701ff6fefd0ff84752881754cc63658ab1369340fc6c78b9019a15cd862ceadebf45dd8a6fdfd1a6386b5a3a98273e92e4aa105cda098f8b
SSDEEP 12288:geBNUbTVO86U2ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:gJIU2W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 04cd19cca036d3c391cf83b26f57f0c52bc026f1f3d7de26243f2714793fd1ef
MD5 cce18b93a15edd3804d4b2a2e9c621f0
SHA1 ce24ba2ce46a2740edab85e0b2a0ada1a2c0f0eb
SHA512 5fd068585eef6730fa543e62a0623d81dbe30416cc394201c957911c845f29383d2d8ecd7bb14ee744f014d641548d39c601bf75be4967cf2252b3d44414e324
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH3:mQvGAdlCEL8c/yRNw5CFWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e9dc62fa7fdf2d33a482c2c48299a2687f4290a75d84a17b98b6191eca9d58a7
MD5 f1e2df8347d95ca7bf9639f3be387b85
SHA1 c17e1e25fc556741571bcb013acd3a167a2ce622
SHA512 a921a401e424af17d1aaf8ba2d4efd9c2c9238f0065d2d82d8fcfce65fb5fb6e4ccfcce9a5fa6f916fc85a14c4b56ff22fcee4e026225c0d5782dcb544b0beb7
SSDEEP 12288:kAwSfxL/2Dc34DLLmt0LDQewsAj8ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjB:5dewsAj8W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a45a20a1eded65decfd71915f7b64bdf234e7fc46613d38df2d4ba331b6dda70
MD5 0ae54b2a82f57e0e3a025f4fed2ea835
SHA1 2c5cae20092075d35fd7ea98f3f543a6409a740a
SHA512 d58a8cbe0d2d34afc157d321daceb723d5e1e81c48dbd78e93f0255eebcfe68cd4d4bf5a7ea407c9274a9d8f2937ad4f03a0bdc4fff0764ec2b13b81f9b5c952
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHUv5v:/UEtQevvqc2W1cpV2EI32U
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 436905cfc750c8d08c00f2acfc219a7bc554f7016cc17b0d787718b0dc9be13c
MD5 c32c17b0f274fd4d1260f0695892550d
SHA1 145e56406a666f0eef3d43e246d6411187ffe6b2
SHA512 26ba882080849c48a2f9004166aa10e2e0417e86b5ae58498517557d11e7836a99ee3e8574acb93494092d59dd04a3afd28c8168dd7aff836f7dbc7cacc4d508
SSDEEP 49152:ZCbRquA/m2yL5zQfFiV+XenmE3/zJ+pWAV7QqejX:2oqtVjnmhWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dc938f6683157eea439518eda8c4137f7946b47d155b9d78feff667f110cfb72
MD5 3b96b3ddb24feadcb42d80313a270e16
SHA1 5862108c3066e21f4b7e893e1ececedae2c005f8
SHA512 b26c6758fa0d3eb1058a1f30abb3805d08e70b08b9537440f00a48e0dd045602269f6354ba60b40d1e3761db252534a7af857d178b0fc4b20d2ed4b1f9b57473
SSDEEP 24576:+AhGLJIFoiwtA5l7S53DW+vxWJq0Q7QqtWLjXTqM:+AMyFoiq5i+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8bbc6a9e33e4dda0a25ab3194a206f03512a9e620aad16980999a466b5af3ed0
MD5 c80aedd3dd3309e33312573085db2d32
SHA1 bc539ac49e28a4fb5a6726b05d9699f7dca61825
SHA512 2016665bc8124745f9c461177da1ce9da94480b0688abe410011ccd1cc2b752277fb063cf08d66c5a7e43115ca08aee0fd10e79f86ee89e39fdadcd624acb9af
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CfZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tk2:vwuoOWQW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 a852e260f95ffa34a72e9f77fcfc7a21522a7c5ad7f043d1a93b55c9b6e936b3
MD5 f2a0f9a66bc42c1603b958281a00ff53
SHA1 6ea7ca9e34bc133c4262a30c2c9af91e7ee75cab
SHA512 4957639ab6f5e9d3606944cdf81d6c1ee31eb51dbc9c9282ae07c3bf7139d88635ed8a68abfc85634dbe6e5b4597dc1446660331fcaebb566d3ec0d3aa2269bd
SSDEEP 12288:DBZ1IyMZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:tZuBW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 831a064eb25f2913d9a2f71022883bf84b9066d22b01166eaa4067141cccf78b
MD5 b15153fc2ba96206f62441a185be2fac
SHA1 bb63fc9b38ee797510bb37cd45cebc0ae8b26b22
SHA512 bfeca93410b1310a8016be23ddc43e8b99e24c7bd2b5af8e1494574e6945f57c71aded28b0ad80c6d7363c75a5a11c065213c860240167a9961ef5847003d5b9
SSDEEP 49152:20kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLH:gwfhY7g/rLd7yYA3awr341g5WAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 9602091a3d9c0a75407b13cc09a6b16c8894d005775c0c753011f89d67c86111
MD5 c8062a186b7f001d5852c6d9f7b1fabc
SHA1 69144affeafbde3714f117d40a870e4ee2638b77
SHA512 17e190d41ce0fef131d698dbf62e152d7ba022f74167c4163e740593444a12d0018c0d958a6c2dcb31043395ac177407386a987d0c7d61243eb9ecdf1bdd9977
SSDEEP 49152:v0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLH:zwfhY7g/rLd7yYA3awr341g5WAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 7cababafe3efd101eb71f690a9c66c1c40ae9c63d9fd06e360221164b4073edd
MD5 38c68306242c9e6ae155b574ad9c9d15
SHA1 3300faf30c5e1a26de78d733eef517444e414d5b
SHA512 bcea9c088d3d819ff18050380978ca9b1cdd9782c34a41c075fbb8a230737de5e7a88f192eed6f53f399aadc3e39171e4ee0b7555a09957afe4f96c1db1475a5
SSDEEP 24576:EcTyYv0FteQU+5I2kjgD6iQacAQW+vxWJq0Q7QqtWLjXTqM:EuXv0Ftpn5606zON+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 04603439df4bfe756947a31f863a44f69a719a56ecb20be7980f08e2010d341f
MD5 4617a29aed25ef3b99c86f3259ee9f56
SHA1 2589614b983c1c7234f70b253dd90da0062fbd8f
SHA512 40c5abcd7f3d986f6b28eadde5dac6df08bbec76f38edc9d61e8f2d9f49360665ec01404bc81550e36e30f25a50fc3c15bbc576b4153bf8c48d364d30c25ea1e
SSDEEP 49152:fy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxp+pWAV7QqejX:KmYeyxHjWjMTsWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 8478942312f6122bf24f01a01e9116558c24397dd85cfb7d7f28e904ec75f712
MD5 f66f71e2eb7af62964f1ce3aae0e9554
SHA1 b603aad30f0f61fb3688ccc6cc71165fef8bff76
SHA512 f193252ec8615b0b0125fdfe4376a3c980797a26459d3acce2580fb57ad01e790ef3cf747fac321b2f8bc62dbebf124b011c4e81b05e85ee808f29079f464f1b
SSDEEP 24576:v6drZn1WEci182IEUeNbJeRgUebgW816JW+vxWJq0Q7QqtWLjXTqM:vWnDci18yNNUgbY1+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 94c9841d041d3c1332ebce9726af597c0341e798e1eccacac684677bd74b816f
MD5 c682b79886abf0fd9f0d853c975c5223
SHA1 645542e63d694f7b790b136b54f3bbfcdc2ab0f2
SHA512 8c352631e7520e4505eb9aac2f6eebb40b1f8c762d9311532dcaa513eea66d0e9f7b4265f7849ece8b5a786563b7284680a4311d751fa6b044ecb3b18a6e6218
SSDEEP 24576:6k5lHW5EzMZupO80G2reD+melRgTTv/1nyiW+vxWJq0Q7QqtWLjXTqM:0izMZm0GhamSoU+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 02bf9c78ace5ee96996d06a85ae2a559bf2203e1bba1004a2c040a6b2c09ac08
MD5 19f3f8b9b34ffa88866f5a0c260cf917
SHA1 a2b71f46a68c2a3955fbefd8a7eb2edce0f35c5c
SHA512 d69ac4610be5af663d750f970454a75ad3d1a8adaf6557cdb2a3bdef6586ed4ce4d498770277f8437a8d37a515f9a9011b1c0b14824bbe2dbc2a9cf966a3e3ec
SSDEEP 12288:wdZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:wdW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ac4060f36e28fe7c7f994b69a3575547fa6a7cb81685cb98d654296de7e5110f
MD5 de6d1b6acc99d89535e31b76970bd503
SHA1 63a30f6ed95b0b47234ca659fcd34a158db3bed2
SHA512 b2ff05d03de584902fe61376e048020a0291beb6ed8c2f2a17ffbc4a7820cd41d537c7c108b2a5bd95e9726004286c22b34ff6ebe297b0766e9cb4bc9404b712
SSDEEP 12288:C4ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:C4W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7528df4141859bba627ebe920e29a58c5f39e0594f14a8bb29c8de2beb701418
MD5 491f61f0f549dc6158cd4e0657de9b03
SHA1 179c3175127553138a24af5ee24182b2c62d5a43
SHA512 cc63a98171405898e867f07cc59838d0be087e99960263f609dae045a5f45c00cf33d77f0f1b76ec5a88f954b944fcfe50ebebfb34b59cf83ea6afc01693923a
SSDEEP 12288:iOZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:iOW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3f9eaf1e6602d001be8e6093f68023d4552393d2b612775c5843d846382a735c
MD5 19cbc493c71855e1746e5e1c1767988a
SHA1 7f1d29f4beeced000722b9e9eb50458c89f4b3e7
SHA512 47898dee5b10c363682a0ff39d811f0b1cb59d20730a113c046812b8db3feed4699591dfc05868be82b0f1462656a762f1e4710bf2b789b6a2f7eccf0427522f
SSDEEP 12288:LVjZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:xW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 1b2e05522d282f7bc491d44e7a756204d69ed30aa92a29e2cb5606da6f2d2b92
MD5 1c6d5a0b854baf0f9de790312a7ab335
SHA1 d3ad5c079b07f01b5d9bd3051beab6b35d15a7d4
SHA512 1fe3218d25dfe4301c89b8a41150a0b18bb911387f9e6341a3bfcef0684b25fd02ae9c48623919c05431d47e6eb9e98863fcc70b728d92475353d416c278ca0e
SSDEEP 12288:ZLZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:ZLW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 0e3160f1d6a0c9ceb5e5437e5e8d1f47ead72b87c9440791b392f2f01bfe305b
MD5 0c550c44e30394d4d11eccdaf1642cd7
SHA1 5134f856d24ff198db4df3294a269b0da620b486
SHA512 92541bb0f80a4f65d7b9719441e5ea82f6729e1985098ba9009d6778abe2126d61184d007e5e070cecd4104a5621a5282dc3cda4a2806f6f2bb588629e1049b2
SSDEEP 12288:NUZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:NUW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 2fcf00e430a0cdae446f5390004abdb94c6cf2b7b37722e161c92d28d953f38c
MD5 35a21155f1a50692d07c541322abd00b
SHA1 14032e28a03a301595b1a42b7cd57025c88faff3
SHA512 98a5dbdc6a3916baf4804cc541a5f78fa50597af052ed6cac551d4fdd6e465edadd189c8558db0895af839db816df63ab50dca300baf2df33cd9cef4690693b3
SSDEEP 12288:uAZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:uAW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1d87d9d5f268f78c895eb000f240ea8c145d6b5f582e756438fd4a50cc2b7ff7
MD5 f9b824cfb48e54dee23c0069000fcaf0
SHA1 4413dd64c01e89912320b31520615cbdf2e466dd
SHA512 216f83ff4e9db92566ca15c8c348f78828c8a85f9554541e291de927abe0af4d3b2a520de47fffd75827868f719930236bb74c572535f9bc8b4d1f2154225d53
SSDEEP 12288:yiZwb6zzFEoS2cPvyYZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:VZMSzFVSOYW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b4205982f97dd7b8a44af0b35ea6e709e908ab31bd65becc096340cf7e6c339b
MD5 e9517749c0b4fb0bd4fdb2505e4a96e2
SHA1 afe61190bac2ce1d0a23986368041ca875a1a311
SHA512 ddf78b0ffa4c67ff58752e83f58dd8221f377a9cc9cbfbae1deb52c73bb7bcbee2846cf27bf6deae5a8fd7d3c536d79f7e2df334c645c2bc280f4dab5945e8f9
SSDEEP 12288:gRZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:gRW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8c1ffad8635d7d60291b539f6c22ab5b34571c69d3fcf158c849bf9055b88837
MD5 5eefc3caa4c3f7d650e7d03c69bbda1f
SHA1 153de5a7f59bcd867306d489e82983eabd630f22
SHA512 abae3464841396e97379de49b512c61431b01efaf8e494a2b1160df90e2127532668944ab1a189d7a4072c61f7a0fb37489d8f1adb8a652029d6266020fdb419
SSDEEP 12288:H1ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:H1W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 f1d5f72c41fdb4baaef6fe694c911bd148a2b9c38a15e7f1a66656ecbdbc62bb
MD5 074844fc5178b92ca2a9796ed5b79526
SHA1 64bd7c7ea40a2056771abc22563f1a297988f29a
SHA512 b28df288a47e1b17a843a38173d3fb3d596808a05dbd571f7ac0c8ebbb488cc02d6ea5cbd522d64aa3f097f00b464028ff53ad32a327d61e13dde30b7cb6001f
SSDEEP 12288:ayPz5L8MZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:HzyMW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c74ba1481a121c283a2e046203ed04cdcaca4ae2e6855d97b510e3810a5a9f45
MD5 e11500e745f60127a717dc20a14d3c0d
SHA1 2d58659ed7899089a2b8866fea8968446fa05aa6
SHA512 f6a834ff82dc1683fc96b2ec5ca48a780eec8c372446e2a1984fa62e3e4a2af12c652f6afd9cdeaef52c9c5fa221651d4a9f0950d31494dad128063fa7669ca3
SSDEEP 12288:rRZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:rRW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 2af1342610db5b2363b08460dc1b3e0a68918d7472b06c92b74c8681e87353aa
MD5 306c5cefeb8cf8463d71276713caaa5c
SHA1 75e5b6ab21da4cb0ab4769ebca3a8e5c35e34703
SHA512 479f0d4ba686c0a5fa69fb384d240e43e3a56d0393933c41d1af5372b8e341337ffee47c9cf71027be27fc464142424e89b4bd3b991227fb1483d64c7009ee7c
SSDEEP 12288:hRZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:hRW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 090167c1839856f0e1bb9603712ed691a4efb7075d4028d9a412be6ccf8122d7
MD5 3562550c2aaf890e43de12ce01006120
SHA1 b70c352428253863b6ddd550a202f09850acbd78
SHA512 f62368e17d0a73ac80a5cf7ad7b8ffb07bdec305ef1f4cf846594e16fbb94599c7ab43d5ceea80c4ac88a2aba4560b381a0d4a7705e4221b471f71dc899b7aef
SSDEEP 12288:zyPz5L8MZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:+zyMW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 e0ced8311b4de7437766279dc1f5b7eaf0ed60901f4e87a07305fe5e325f05f4
MD5 9707615558f3fb96fe328649004f870e
SHA1 f5d5466629d999086912f4980c99099d42cd59cc
SHA512 930b27c39d7050060d6d6ea887fea75db5ba5b85b670204634e6b355eded648a46ecf2feab945c6f741d1a26a9b571e7da4fb1f2f05501792fdf9f1d412ad333
SSDEEP 24576:uTHaLl3z0zD+W+vxWJq0Q7QqtWLjXTqM:uT6Llje+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 0bb869af4dde60cc8f50bb4fbd408daa2490e0f2610cb2f4c2cc4f278548d35b
MD5 f33d98ca386307e1137f6a110fea4592
SHA1 b1dda98e7deb320ca9dca8dd0bc78db99452ec9b
SHA512 850c599403520adea7f0cad9cac56f4c2ab8c5bce6ae52e128989d28b47ca894563ce50883cbdc57ef09b65d637c422f08772213564f9a96b437b79e982ccdd4
SSDEEP 24576:l37d9CHKy7GZKW+vxWJq0Q7QqtWLjXTqM:F7d9CHKyah+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 3b1ad3a81985a5c1aa6520d60ddf5f79939420c7421c9e99edf5cbbb6468882c
MD5 ce68be6979a53ed0ea7eecbd5b44f06a
SHA1 1e88e95e6278c8e2cd36e7722d20714a8a7b9997
SHA512 0c2a8a26ecb94397796099b8f3e8d55279b4b40aaae035dfb614dbdff8e65f7327d67d27a4a2e22b118b90aa5f6c3761c19d2f1af436f3ec74a333ba274c38ac
SSDEEP 24576:7cP4mcvIjkGOxhKP2l71nNKbrh/8KB5W+vxWJq0Q7QqtWLjXTqM:wP4m4IpOO67W8KO+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 273d7e9a16821c961c36da18931ede3223395d0e53b3e77284af38bd4fb580fe
MD5 e1c0753e491a6f3800d0cb37e0a44fe2
SHA1 35be04cd3da795cb9f2c90854363ebcb7da7cc3f
SHA512 90036e339cde373d1b929233959eb664bb01b6d174cbf60a5980ccdb161e8183501950572404ce89cc1d3e096f4a7b43220cc2d4a4c9df1cf66541cef26732e7
SSDEEP 12288:4UFmDDL6ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:i6W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4d7b14593cc1b92a841bab9276b058209162501a32f838bd310ebc9b5732f97f
MD5 db6317a77918f04f9a042fa2ba2facbb
SHA1 eff1f55c1dc45cb8c30346bbd9ceffff610662b2
SHA512 4e9b772b60bf6fa2805e0f793db807577eb0db88e207374b5e287ae5c5bec07e2f24ca36da802e4fd37079b3436286c5b4d1c5c07fde4038a49f6fe44b66b593
SSDEEP 12288:YhZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:YhW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 3ef83cbc9224533fb79702fe72ab2e05953464698450554c2cc2783d73a573b3
MD5 625afa969c37c62f645e2d4c30c651b2
SHA1 6ec48b3593702af9ff57e8e69414b0abc07fec88
SHA512 0d3c6b534417fb878624bacb6f72d5ae5044d7f9b83ad2ffdfa582a8ca8624e675a7ba2b54cf38faf6f429f3d651994a082adb1426118e27d8f5d3ad2ada8614
SSDEEP 49152:La0h2GEkuAe73q3pp46zwwQK+pWAV7QqejX:La0hNYG4JwUWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 4a1e720b2d708aeafd65c3af3a14775012e2a276db9f84b169ee45ae36d3fd41
MD5 bfcd2a7305791c08e12486b7662f03a3
SHA1 a4b5f060c5e21f3dec79acbe5c43f4b04c3263b0
SHA512 983c18892610f6a0b5eff48e3bd6406c44adbd595e887775162fb65461ff86da9098655817340f1ed958c41f0a58ddb9087f0181ae704dc138e662630a95111c
SSDEEP 12288:ohbHjfXoZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:ohbHjPoW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 89abaeb30fc8ba6bd054f5d42087a8a821b7cc8e3b51cdf0c5fdbb1eb0062519
MD5 b917296f088b8ef9f1d57e693cb0b20f
SHA1 68b1e006d76b16dc151c64c4a2a7b44378ce05d9
SHA512 63e443fbf289d64deef743ef18130ff5827f858d23e8ff6a0681e61a8fae36fb3fa82ba73cd38b1c4cb281176d71ee1825779b2a82972cab3653ae3fccd3f345
SSDEEP 24576:a3YgnJcRTk4yti+R5dBR/QW+vxWJq0Q7QqtWLjXTqM:aIgnaTk46pBR/N+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 83cda684333fc69b81116088df56741124ff1850e02a783c8a7332e221ed3d9d
MD5 cf2241599a2bf7f9e8e2088736ba3444
SHA1 c892b88b447bbf216378f40ee5edc88c19b7b272
SHA512 0716e4f4c0ff8f2771f53e12814cf8238c2480550d827c4c339a114172d9985483f2d9c3692ad9c808c2758eb95c85248a2bb1f83fc4875aac53f45636664329
SSDEEP 12288:JFZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:JFW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 11156c7f000fc1c7d9eddf5e74925da32e4c58cd67c54a8cbf2efe06259226f6
MD5 4be54971271eec52ba485bc316692c4e
SHA1 79cf823776b1ad0211cd58ab05a3a3f0a3bdc56e
SHA512 de1933b8dd62b283d1aa262618e5b267d14813bc7595aef244505957515097d3346eee888966711994e9e2800649064bd72440f5a84b3409f1b7308671310255
SSDEEP 12288:aOb9A4LWOsvAYFTyZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:LpL3UTyW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 4ea01f73f9982f453a7424c7e3a1b88c8e6c8240695b28cb7c0d4323ffdfc1e4
MD5 9782dcd6c5b73bfa68c198eb16ecc465
SHA1 097d24c968383fd83f65e58300c7b5d177d17734
SHA512 b6f0b38e5cada39dd9716e2696f32db93401636c3ce6951b15041481d3862e9031bb4bf3e85187c4b2afd255f9ac4773732336a3046aecfd2dcf161a7dc72b06
SSDEEP 12288:PpFtpOWZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:jOWW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e470ded44ae319675de10f2989209fff1f119dbd924cf61d4726c3ec0badb01a
MD5 b80fa426d6c83d82df772f8bf1369fa0
SHA1 0f6c3152c30402016fa1012e27fca8e29bf49444
SHA512 5482deddb5bcc8b21e646615fe57f9e7d3d78ac9460eb7f8cba1624ac8a4a769b4552179b9fe0b22e88e370a05fed159235bedd1401dc7c5e712d7fa127fa713
SSDEEP 24576:b7NM9YqZqmWMUkPjZM48Mv6bEhsRW+vxWJq0Q7QqtWLjXTqM:b7cBWMpPjN8DbEhV+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 6b66dbba0c71dacdc19d6b05ee60c9fbc96eeed7b363ff6bc49acd3b81e0aae0
MD5 4a11a00b2483b4aa6017c7db03caabc6
SHA1 afd2c9b973a289b1b3a04f623e6013a80ce5344a
SHA512 ed10c32e2de68eac896217539efcfe8b0e3e43f1061b5eb13507b4fd1e147f09b3c911ea37c5b13421a6b15f6a743c88c930ca89402ba316dbb2a39b12a951f3
SSDEEP 24576:3W6BApg2YuyuNDYTabvcdvNYf8km1HW+vxWJq0Q7QqtWLjXTqM:3F2YuHNETovAvNYf8kmk+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 dc4b90d96f414069197b993b74593578d8740c708e8767d0b319ac0912b8f18a
MD5 064ad68c88a773faf25079d1f2887320
SHA1 95f1f6009fc4172b038f1fbd8db9465c7c454562
SHA512 256e6688f666584c85bca9e2ec37bc1ba8aebaff642f456e2b0e9d178a825c1983fec01c8daa11cca002966e74fa2462f82091bd017cc2549e20d912c29984dc
SSDEEP 24576:OAFs06+Omlf3NXEbToKW+vxWJq0Q7QqtWLjXTqM:HFs060lVXuq+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 1d07ea58ced4745cbf4080fd2e5581138bdb0a9206712b4745137f6ddbcf8cc1
MD5 02dae1a8bbcc4e9fbf39716ce2fd85af
SHA1 e6065a13d4dbd5f9fe9d65b288fe19c8c5de6777
SHA512 451741ac5ebe473bfc6fc6a431601c107e75784020172ccafa133fccf154c6a85beb8cdce0cb0d8f9ade55136b7d69806df983d58c13c5dc33c5dc93d56999ab
SSDEEP 12288:ACJnJ5D3VkrDzxxZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:VJnJ5D3WXrW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a40ce96f25ed370d775053a426fc2128b490952753e087bc54edc401a7f3d889
MD5 a6bd50b12b9e85d99c761e1ba6849de7
SHA1 7029ac7b71fe3941dcc5eb096f8ed316dc61f7e0
SHA512 709373634c1ae43f1c2baf8c671b59e2b19b5dc3274c7d4fdd9d3c3f4d9ff61a12e49430ffb5d0124d8cb55a160c0656a371e1581c67c2b71802174c8c4b6899
SSDEEP 49152:Yg06DIKdwc+eQnSt65aVA+pWAV7QqejX:Z9WAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 01e033eb15f749e80d84521db99ced5e69e8dadc0f7fc0d16188b997cf83e435
MD5 d0495416776add7e604eee5d925eb92a
SHA1 da985b4be2aea45dfa2f7c0a4174ee4487cd085d
SHA512 a95134afd6c5a51174d02f853eda60c028d7c6e5aab68308eee83a6249bd7a726ce70b412db2f0f8b2313a601aa0252601bc758c827ceb58d2693aff718e36d4
SSDEEP 12288:hEP3RnfZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:SnfW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 6a94cd7509a16cd60ac3bbc8b5888f60dca7fd37ec70eb25c44c0825037a79ef
MD5 35a11eb03fa9fa2311c7f4bfdad3ad7d
SHA1 600fb8b34b7ca48daf058d435f31eb20cb9ea412
SHA512 3298d5ddbc1ea86a33824dfdb9e8c3974d9fa8db07cefa69fad785a6b28f167860ce55ba6952f5bdd9249b96e4b8524be00a1019ae0cf1620eacb0c2f00de821
SSDEEP 12288:qjky4ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:qIy4W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 e3e00eea02fda6c3d5943303164516faf71a410dfade9e22941dbf01540dd103
MD5 3be70749eb3c13bba19c86d695713890
SHA1 78e7aff476e90a602bb48c47c22ec98ffc799146
SHA512 f52d8201b4188571262492bf5908fef97ea5bb0db812999e2d5203d0e490c8571fc78a1b6c2a5083fc4e5ab68b3bea2e335fa35cd30f3fc4040781c899e8beca
SSDEEP 12288:gymZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6q:9mW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b5580dead23b038c775cbe830aa503027804ad8d4f475d2cd3b089f0ee90e0ea
MD5 40150b331a813b533ed19ad654db22c0
SHA1 9a7978e0e1f33172d2e6c450bf1ae5708d117bd2
SHA512 286d65e695f94fa6939acb0ed4e776c15c4b4e95b2ceeb16564b788bc6f041a7ad4f2c093abb1884bc229132d66585af37fca3415bf2c9e8d53ceeae0c99c82d
SSDEEP 24576:ZQ9MxZKdcz9dw3pW+vxWJq0Q7QqtWLjXTqM:ZVKZM+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 35693903e763de2eff630c09db15130af176cb0a5f9c8190bc19309bc7c93060
MD5 654fd5dd9c60ba7191c7c117df671397
SHA1 9f22800666b0ecc0cdc1285edba2aaec799a5e31
SHA512 871d9082d67e3b87f715cc4b3753466da6c2a029904de93367df64d409ed6833b941b2fed3329499a391e0a921d04aa495c7674cf8a83b74a691198a8431e37b
SSDEEP 12288:XyoKo2JRple9p8ZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:XyocDAp8W+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ed7d402d41c3c6af8c0b0ca3205beeb740f328f2d26cd03a75555390de7dc4db
MD5 d69e62f41ca1d39a79bcc0cebd3ef220
SHA1 73cecb8607ebed84c097173fffc49d5ebe8696ef
SHA512 14797843b89d0aad5f9b789aa5f08e0b97988d4bdf5f23126f81ddee3137530ebc716660d9c1687da0254cc7f61195cf802a7f5e74cdede39fc6a5e500b32635
SSDEEP 49152:lWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKp+pWAV7QqejX:V0zuNIuWAV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ec92446a27b20be86928d0d0e2b23cb75b580f3f4a7dbf3b020b16cb2e142f49
MD5 af785d4148a45745506673ea5ed71fb6
SHA1 22adabf4a822d561027cf79fc06387dfb09045ec
SHA512 b535a205073b489a8886c397e7b67b4108945e75914a454421383acfbf01e70ef7203ab0761ac134bea379520dcc35b4bf1ed41392dd441c6e50e2744df49723
SSDEEP 24576:a1QT7EcpfxR+N5AWAz3ooiYtjMqbfW+vxWJq0Q7QqtWLjXTqM:nTDxR+N5YzTfjMv+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 9334b1f7deb0eb31ceb364a8cc9ce430a487d6a07ee75e9ce4b7b3d6c6225ce0
MD5 35be3cd20b75c8e70babdda51ae1f550
SHA1 26320fe121b4d85f6fc76aae12c6209a93284e43
SHA512 94b88210638acab83623aa165d8293dac664276bb7a1c5055bf2acae2be238c76ad92967aa0dd9299b5d8adee75f94f95e73d8715ff4493bce88cec47fa153f7
SSDEEP 24576:kTMdOz0FFS+imSLjW+vxWJq0Q7QqtWLjXTqM:M0K+imSLy+pWAV7QqejX
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 fa0b88552e929b64a0c8c245a023882857acc17ef0cbbec2438b813ee413f101
MD5 cb9dd5dcd37af934926d85a883718a05
SHA1 613400c13f61040d072710421e359ea19ba9f02a
SHA512 2639b23a819061c15585c93c5b0e9ea4475e15b222922d34af71f5928479389f659eae39fa18b10aec985ef75e6639b0c55f5e388deb9c01e755e72e9ca82535
SSDEEP 12288:/4KyZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:zyW+vxWJq0Q7QqtWLjXTqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/512-44-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/512-50-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/512-52-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/512-424-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/844-108-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/844-101-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/844-96-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/844-445-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/868-148-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/908-24-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/908-25-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/908-16-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/996-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/996-164-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1084-89-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1084-83-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1084-94-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1124-149-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1408-168-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1516-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1768-141-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2016-146-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2784-147-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2784-447-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3240-450-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3240-169-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3504-144-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3528-41-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3528-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3608-7-0x0000000000B00000-0x0000000000B67000-memory.dmp

Download

memory/3608-8-0x0000000000B00000-0x0000000000B67000-memory.dmp

Download

memory/3608-107-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/3608-1-0x0000000000B00000-0x0000000000B67000-memory.dmp

Download

memory/3608-0-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/4312-449-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4312-165-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4392-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4392-65-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4392-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4392-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4392-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4728-423-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4728-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4728-40-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4728-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4800-92-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4964-150-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4964-448-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5028-73-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5028-79-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5028-93-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5032-145-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5032-422-0x0000000140000000-0x00000001401D7000-memory.dmp

Download