4ee671400a87a96e9ce02764cb94983dc637255256d9884551e8a6a068fedc1b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
Size 784KB
Sample240604-a76pragb77
SHA256 4ee671400a87a96e9ce02764cb94983dc637255256d9884551e8a6a068fedc1b
MD5 1971bca59d06c2b08116ae210fd41aa0
SHA1 d7d5fb272c021f8e098ad17669e4c4fa0cbc8b57
SHA512 e51e5fe92c866e3915dbe15a5e2a59ae73b63a5da496a0c1de0118b218645e5ab2e8de4ee160e63c703b7bbf1c7f82f05e5e2d75e6f46a9b422547b9d0d129f3
SSDEEP 24576:dKn0TXAmaouGSPGM9ZQ8GYelhwOXGEDgm6:40TwdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
220	alg.exe
620	DiagnosticsHub.StandardCollector.Service.exe
2640	fxssvc.exe
3340	elevation_service.exe
2952	elevation_service.exe
528	maintenanceservice.exe
336	msdtc.exe
4664	OSE.EXE
3552	PerceptionSimulationService.exe
3812	perfhost.exe
4420	locator.exe
4460	SensorDataService.exe
4180	snmptrap.exe
2116	spectrum.exe
3060	ssh-agent.exe
2076	TieringEngineService.exe
4940	AgentService.exe
3180	vds.exe
3428	vssvc.exe
2020	wbengine.exe
2324	WmiApSrv.exe
3244	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\522ee0f2c8648821.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\java.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034a7d87719b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090f2247819b6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c04fd7919b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e520b7a19b6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066ee277a19b6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008846b77719b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006691b7819b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acf6c77719b6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001cc1d7819b6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
620	DiagnosticsHub.StandardCollector.Service.exe
620	DiagnosticsHub.StandardCollector.Service.exe
620	DiagnosticsHub.StandardCollector.Service.exe
620	DiagnosticsHub.StandardCollector.Service.exe
620	DiagnosticsHub.StandardCollector.Service.exe
620	DiagnosticsHub.StandardCollector.Service.exe
620	DiagnosticsHub.StandardCollector.Service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1808	1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
Token: SeAuditPrivilege	2640	fxssvc.exe
Token: SeRestorePrivilege	2076	TieringEngineService.exe
Token: SeManageVolumePrivilege	2076	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4940	AgentService.exe
Token: SeBackupPrivilege	3428	vssvc.exe
Token: SeRestorePrivilege	3428	vssvc.exe
Token: SeAuditPrivilege	3428	vssvc.exe
Token: SeBackupPrivilege	2020	wbengine.exe
Token: SeRestorePrivilege	2020	wbengine.exe
Token: SeSecurityPrivilege	2020	wbengine.exe
Token: 33	3244	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeDebugPrivilege	620	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3340	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 3312	3244	SearchIndexer.exe	108
PID 3244 wrote to memory of 3312	3244	SearchIndexer.exe	108
PID 3244 wrote to memory of 3600	3244	SearchIndexer.exe	109
PID 3244 wrote to memory of 3600	3244	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1971bca59d06c2b08116ae210fd41aa0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:220

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1936

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2952

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:528

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:336

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3552

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3812

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4420

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4460

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4180

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1648

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3180

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2324

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3312
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 29e5d385d1e461c3251c91faccab3ff59220d2549cb871c1e191f8ce7b830895
MD5 8aa7d84c1ddf09cfa7a53956f8dc9ff8
SHA1 240ce8d2e5e2abad694925fded1f4a38c22fb37c
SHA512 47d69909ecc709ef5f7074c9573b76cd2e946b4f98087a6a77cd311c371c2b483a6f6c61d1cf3992fceb97b3839d7e691e1309cb6551a2f2028b978e69061f95
SSDEEP 49152:WuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5RdPGM7nmoOl:WPfTqi90bNxB7nmoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 01c3f37308167357a7dde8ae0ec78f8d0c5007c2e5fc0231d8205e184d0acb54
MD5 55ceadfef8b8244139d58917b26facf5
SHA1 1017a6418fdf4823402af540a7efaf904119032a
SHA512 f6f01561e7cc95f619b3f93ac2c26941f354861fb714c5ec20ff13d390b37770377e20dc0dd901301c73545983c3f829237c2f10fe48da58368a60d3183678a2
SSDEEP 24576:UidnBsuE0maouGSPGM9ZQ8GYelhwOXGEDgm6:/Su3dPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a99921090cad3e1080f01f834cd88f1035d8ca2adde09d9f002f23fafd520f86
MD5 2075287aa48163c143722a2c46f673d2
SHA1 de2bfa79d60001130ab30cf748ef2623ee1cc10a
SHA512 d1b4b1d795e553efd8dadc7ede97c542c1d0daeb9bc76cc26b9a35f643134c4154dff9c693205d0075a86d72dd24da4982a906d5a3e6f6b4c8993fd50d18d52a
SSDEEP 24576:l+gkEVfh4CoYmaouGSPGM9ZQ8GYelhwOXGEDgm6:MgkExSOdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d85f38ced002c3ae7a981f86dc9355430aa13ac7624f79fefa5583e0d28a72ac
MD5 e41217bf5abaaec98bcea1012dbc3891
SHA1 14d68a7014fd19b565069f10b6c682d7a7c62d76
SHA512 11636fb72685eff6dcad6cf0f3477039b364e6c3d35e68a9a60c78aac0d40c6069b2fd86b213421e2ff06b61eb50599f41a59b2042a731d9fc48e215a252ee08
SSDEEP 24576:8BpDRmi78gkPXlyo0GxjrVmaouGSPGM9ZQ8GYelhwOXGEDgm6:oNRmi78gkPX4o0GxjxdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ef9dfb29c8306806bc57c293f58b3794af631bfae0d72201a19a42f9443c4e77
MD5 eeb19610fd88fcd330cb073c1652ce56
SHA1 efa3edda3fdbba91abe77b29c1a788eec0eade5a
SHA512 e42d45124fe8af21497d261b6dfd904d83b78ef41cb646e112dcaf7246eff6e5e55b9f8f5f4c41d69e5635dc951c9c12d6aa705e7c79a0278195ffb287e48aa0
SSDEEP 24576:LLOS2oyPIXVYmaouGSPGM9ZQ8GYelhwOXGEDgm6:1/ypdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 3f75cb1fe9a653fcc7b6acef8a30e7748d728f5fbdb5869e2674be2ac5ddf1af
MD5 b52e905bb2f06dfd7215dd8f746bba7a
SHA1 13af2cb527e90b0f7d7e78111136e340e7b755eb
SHA512 f26dd256e1cefe58e05b469cd71a9100759f502e5bfa72554da894289ac59e88e58692da818a098fe0ed130cb152d564977c225091824b019d09adb75b5df525
SSDEEP 12288:UfAxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:UfumaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 97c57845ef4d4efa7b9913447b6e03e3fdb2ad3f26c277086c86b5741264a982
MD5 d5c88e91d32b70cb29d6cf813feecf8e
SHA1 db33694eca5a6c80c3cbb567de10dcac553cc317
SHA512 85bf675c71a6fd35ab283043579df2c86c603ae293003f5db5f13e5a580ad31dee61174ed26e5f6f8b3a8f5b18d15330a9646ec07a0fb3731ecf6facfc6dee12
SSDEEP 24576:RJIUTmaouGSPGM9ZQ8GYelhwOXGEDgm6:RJIUTdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 07c96433d3d64ab3223cbf478345dee273c3e77f0a834da367f2013c274a7b03
MD5 f79ba16497cba42b44357dce56b98752
SHA1 efc985e3f939615b6aa2ff8d07c3f3f6749e3041
SHA512 7982f1f198f040c9ccacf9bcef2b9ecd0006c34bc854e69adfdb8c7a4f0c99d9e4982299f5a75a8415152105eb42e1479b5162d60f1cf1404bac46fc4b87bba4
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:YQvGAdlCEL8c/yRNw5CsxB7nmoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 175e663aa359e4f414bb5fa10e90471455ebbb64d7e9fc877775988b85399b16
MD5 0a86daf4bb61c8d6116a783e4fd4fc49
SHA1 26994eea68325e4d8c073865e6094daa3447153d
SHA512 89abfeb32bb7fa11bca173e3f50ab0b1b89bf423832f4a02816a4708faa6924b9a77aab99f8b937cdeb1f400fe34c77fc9d0e08d6ad2072539c16e98cc7bb3f3
SSDEEP 24576:VdewsAjNmaouGSPGM9ZQ8GYelhwOXGEDgm6:bljNdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 54656e96d63d8559be37fa6e8b436afa91bfe421686f4b96cdc11d02fa8267a6
MD5 40ba67b87838aba8a646b67453a1d5b8
SHA1 43fde96595580aeb20d62cd7d490200c74976e8a
SHA512 c489616f36dbd1ada2ea910d2fa5baacbaded7504cff3a1276dc7868e1d46f98309597ba3bc71064c9c5030399000a5b3d193ebe8ba13f3d02bd223096e7f0f2
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHFDmr:HUEtQevvqc2W1cpV2EI32p
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 abd5dd6d32822dae1308f73a1c1acf5e754a412fc783a70835345b933ab0ef5f
MD5 b6945bcdd42bd81fcb21520129634284
SHA1 228100d7ed2b92cb3861811face90e36a3ab686a
SHA512 6a9329a9e37cfd50909148a4210fde6ad19b4538d0a0c22ad4c9e8df43894dfd1d7f6ee6c9b5e737a10d38cb5409b0feff164f0e0975ed2368a3e4c4a57da151
SSDEEP 49152:VCbRquA/m2yL5zQfFiV+XenmE3/ztdPGM7nmoOl:CoqtVjnmoxB7nmoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c9400d5a44181e4d2166b792612393b2a3392c2c19eabc5326d20b5d59af33cd
MD5 651e7f27ca4b9b986a0293cce72573b9
SHA1 287bf51ce9e6370d1ecf0622e58c6b90b2575fe7
SHA512 4ae5e1d543be9b90a805571377ba489671de182bb56b9e830686866ae48a8ddd8aba2783c8411ec9ea337aaf7aee79fffbb2e3055bc72db6bb05a768e4f97fd3
SSDEEP 24576:EAhGLJIFoiwtA5l7S53ImaouGSPGM9ZQ8GYelhwOXGEDgm6:EAMyFoiq54dPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 899e317461993f5bc39b2add57c6663a019ed3a71f6d8ea420f18739c0a79106
MD5 ef718a12b1a138e2348ce2334f6ee3aa
SHA1 25933ae79b1f8bae7394475ef8d70703082ce975
SHA512 8ad887eadb5e62c60e6faa78756ac939e634c4ba95a7cd0a46255b39a645d694cac78b9fc0d012ed3c28eb7331d3ab0f0c52835ec94d3cf9fc7c1a94f6f45603
SSDEEP 24576:pwuoOWpmaouGSPGM9ZQ8GYelhwOXGEDgm6:pwDOEdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 134ac950cef72d268641788e2fcb4384c9f1307c8b235d581a096280a86b783f
MD5 69a2d50749db6dc8359f33fdfd92470e
SHA1 5c57021b445a6a909efc1b92f42bf7fa13060772
SHA512 adf335aed898a9f6f06ac99eb5c4f66d92172e8d149f0913bc8ceb7fdbbb84d7659a3831ab7b2c954634de8b117a8d2c9484895094590bf23760588a9062cd50
SSDEEP 12288:VBZ1IynxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:DZuCmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 96d95c05c165266e790a58cf2c673fb220e694e3ab991c6f9c299f9113030ca3
MD5 8121045068798f9c57dcd5921fb7dc40
SHA1 25622f137d40477d1b6afc5afd27eb7e53ee368c
SHA512 221c5107b29a90493e64170df7e912dddc6230a124d1080727f2452f8603bab168c7718da5bd4d5f124b6ce103313b02b9ff9a0bb37dc63bc421093d63dff3de
SSDEEP 49152:q0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLo:cwfhY7g/rLd7yYA3awr341gwxB7nmoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 6371f507940393b70e80218982bfc221061200c5d0246e93e29ac1dd8011e857
MD5 d194717364b86a864f2506705e5bde43
SHA1 24af3deff5290b9895e0996f992b97cb913e09af
SHA512 21f2cb35872e8a4f8ae060393f7098443f767802809e1b6d21c1941ac2703578293c183918578771065ce6583880376d7c8bcb90cf5c0925d0f01a187f4de4af
SSDEEP 49152:F0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLo:NwfhY7g/rLd7yYA3awr341gwxB7nmoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 f107e8f837498c87ee0d496a976c083dc2b733c83f3673ac765cdfe0613c3559
MD5 12989d43303822e8f9e1e4afe12da6ca
SHA1 13dd28649450312953de235924b1a69985ae2514
SHA512 c59fffb341b71634fe03886cc8e84018cda72010b2aa9e77df76d140049bb1fba28172294dc8b319ebc8025aa39d0042d563925b3378e4989de36fcdfe421573
SSDEEP 24576:KcTyYv0FteQU+5I2kjgD6iQacApmaouGSPGM9ZQ8GYelhwOXGEDgm6:KuXv0Ftpn5606zOpdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 36f866ad86387b18241a08cfa6742f4f11fdd725366ccede10483f7a81f58f30
MD5 8c93889537ad28ed28e2113dd87b3508
SHA1 0a8c89b2e4eac7c5ddf2db7faf1d588bbf33d794
SHA512 015a3cfafdf7a2ababef9886f941a8e09538d8c07c411bb823c3ffe5f67bdb0af74937a8998749d88f223df7f0c168d941447346273786cf273b93ec70936373
SSDEEP 49152:Gy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxNdPGM7nmoOl:tmYeyxHjWjMTNxB7nmoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 dbb1c08708191fbab6d0f305a8971fc50ea98a2925e82f883a3d04286764c05c
MD5 fb24980b40143eade9727052b2819096
SHA1 7b6ad1a9deee2a7db580049493856f331e13c4e2
SHA512 cd8b27f605655476ce2260f393feca0065de04a6bd922b27def991d5ec89b8ed4afcab0ee8eb507d943e9db6819dc53717bc7f5c79ecbb5c52c6b0f7dbb35676
SSDEEP 24576:Z6drZn1WEci182IEUeNbJeRgUebgW8166maouGSPGM9ZQ8GYelhwOXGEDgm6:ZWnDci18yNNUgbYRdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 e3f286f5606e33190e7e277ef0258aaafcfde1eaf29001ff7964d0eb5df0cde6
MD5 95775b2f367c2af37f627ae1b1e69514
SHA1 34a0bc17b701491f23c72a0faa97e13a0ace2619
SHA512 9d7a394273d41285ecfdf376b250d11e4863cfe83ec7664b901d1d0addce3d0197986ca5fd8d08ce9ce6e09f8599230315bf75f70cc656f7fcbadc31777f832a
SSDEEP 24576:ik5lHW5EzMZupO80G2reD+melRgTTv/1ny3maouGSPGM9ZQ8GYelhwOXGEDgm6:sizMZm0GhamSoCdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 420fa0b62412c3126fb54783f64a444cf9ae873b9dde29f324cc173dabef2221
MD5 cc9dd083c3d406b1b6e5862e83e55938
SHA1 64c0179c22f8d19b90818e953c8196095a52c39b
SHA512 73d6c152cdd9caf02b34e4b8ba3215b035969ecd17b924b6eae9627b03bcb6566f505953a18b4911cfc37388283f51b7208a78e281535106c1fd76494109c218
SSDEEP 12288:jYxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:j2maouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 4137a49d86e1c4b83816b1d7d291dfeecc408b4cc54bc5304767771c8ff71e54
MD5 832a8d9202b39d822ba91c1e6d42ff73
SHA1 cc34cf956bded5fb747c5972c1a0914eb8b7cce0
SHA512 ec1632ee44351f5f297f0221b13be8910e529cd3cb1d061bab798e3f1bfc10b66d41253248ece5299f54ecac0518f4472711490554746f3543ea0ee5972898c9
SSDEEP 12288:1rxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:1hmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 c5a7aaf67e6106cc5e839663b4797a7c14108b87f7dc992c1298ba0fac240a68
MD5 c87327afcdb30c98d9bb9b13acdf5527
SHA1 3bbf03ffb45d19e0625a0e7380792b9fe9f60b0d
SHA512 2c3f252afdd9bf8c544eee0e452021dab3ac6e60d21cfb8a9fc1c016caf18a0b51d69bea59d839894041b646380bcc64ce82c331d83a0341b462af1d4fb26d7a
SSDEEP 12288:j9xzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:jbmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 51d36873fadc285caa876234ba5303b0cbe40b08b36bfa80820c958c6bc820c3
MD5 34f872e3d8cd036d527256bc66eb9764
SHA1 3728a7041a4c65cfc688d86f4cad570e79bc58ca
SHA512 d2489836c1e658b4d8f7fb9e3994c7189023635f42a198f38a726a7aabcb3e442e07f68d4e0b9476d9a928c3887546d1de0da00af62a2c032bcacc902980fbdd
SSDEEP 12288:DVCxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:amaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8df2fe24ff37409bc1dd78bbbebbd0eef97238eee4e61406439d5d3f1ab42371
MD5 62477bc1461c80f4b2495b312aae078a
SHA1 98122bc184825a5b4d6f2ea31775c2424cc8b360
SHA512 4dd61fbe471433cf6609cf2e894ca9be6feb7a5fa8e9a698aece2cc8c6ab4427b3d038729a43d3a97e19dff827c5fe0ec7db6cd0f370a90ccc76f3ae5eeaadee
SSDEEP 12288:hqxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:hgmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 2f44153b629a871c9ff6dc9a28a38078a2e1e742853e132b0a0e75da1e73ab48
MD5 0498be9f298f38885a7d9bd8995b3b96
SHA1 0ab91c4fd082a56a8b27fe357e92df52c8ab389c
SHA512 996a458bc191cbc2af31fa8c5836ad6c946f7531a567fc9abca6141b7b8ca57e9ad93f8f54c3f9b4b854d2f4aea5a559c38f5d724b3cc3db511f7e8775e0215a
SSDEEP 12288:1PxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:1VmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 6fdb1215c0d3b99b5612c97ebb586823446af6e3fbc3d5312807188fd0d044c5
MD5 70c4e4986a3ec45c4e8a944f2de7d251
SHA1 89dddcdccd065200ddf325cfa18416a7f5a6e469
SHA512 1bfdd45a99ce575fe14a7c208251d4e0396a018c148f347aa62a731d7ab77892ce35562d37b65b8f67c9fae930bd1de9066af238ef5c62a978a12457a49cbef5
SSDEEP 12288:jTxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:jZmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 ffbdf176b9cf80e9babed8c598d6fc503f58ebfed3f39e419f517fe821c80bd1
MD5 6358b35e193f317e08c98b72abcc953b
SHA1 b506108744ab0c00d1562172dfe39511705b752e
SHA512 e9811ec0d72ec4e880808b14945ec06a55a7f437358628ad8c10132b196902b56374d5f543cdf62a3c884480ac7b819b9e32d2a838635174de295158b978e6a1
SSDEEP 24576:dZMSzFVSOBmaouGSPGM9ZQ8GYelhwOXGEDgm6:dZMSzfldPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b5cac5f1348e70753cbe340207cfa1da2bbf0e03e124710dd6f0bdb9402d0fe7
MD5 784f5afe964aa36846629855412bf499
SHA1 3333cd8984face05ade0cca1c1013ce689b4e03a
SHA512 e8e4bf68e146892e743e5d25fbd02039373f1ef4c7e7655325ee4b0572d4dbbfeaf7c6259b769870cbf0cee4442a364b403159bf80c3aabefb2d850461fcc0e6
SSDEEP 12288:y0xzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:ySmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 52ef07ef8fc4a834f2a561d962683b42b2c31cafaee58f5fa38552bec52e9290
MD5 3954306a2d98eb06bac3c7c0a88b2dc9
SHA1 97f0d761d219709c2e93b8c069f583030087c11c
SHA512 0f3f57b43bec7a63156bd92bd62691d4486add0dad6f3ef269bf038c01e6519b2f98493eb03b1580f64574d159499436d333c8dddecdf2b437ce06b364638ef4
SSDEEP 12288:jwxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:j+maouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 8ad287bc4fb96a4259b48fb513531c62f2bedc46fc63ecc71e961450a91842d6
MD5 dcb1962c1e626fe8ff00be4236457267
SHA1 fed8350b7ab093b64fb9a95be1b1211ed134770c
SHA512 0301f7c81938cdca36046da77780f668150d0588cf6a11edebdc1c2fc634fe95dcc07c7eb98377a084acaf07c4eb7a9d52537b882e7b2f367a01171b659e7afb
SSDEEP 12288:MyPz5L8nxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxK:VzydmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0e37288fb60207cd81672d33f180bbd69f25a13ecd05c59ba058394d411426a3
MD5 529e756e084e459410951df3b0aebef7
SHA1 e926d1d3756cd9e4b5f8a77e0b2739bec31604a2
SHA512 48aa95328b4b4ead1b1047c5b0a6ec0145d0ceb8d3ecfbae36eb2a666d613e4b5845a0ba8503c4d7b158af1314902f459738c95712c039d638a9b150e21c5a08
SSDEEP 12288:+0xzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:+SmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c3fcf3eaa6e5bfe9d10b157f1434e22b578f81eb96f82ccf1e4a38fd829a78cb
MD5 9b4e750de6d19f3414375a68e5cce493
SHA1 8217ab54ddd285170b614b14f5da716fe49dc4c3
SHA512 d8d0fc14bbd684c61e1269ba3844301e566a61c1f541892b49a7ea0bdf30e11a79e07dffb9a9aaa0fde529bedf0d8ba2e2a25bc32ea6d5b781e0d977e4b6b3b4
SSDEEP 12288:q0xzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:qSmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 4ac7cb3a29ae08cf17c515189b81c7d88ef644c8acb5585cb41edbd4f61e5718
MD5 425a29adf5c3e42455df9010338582ba
SHA1 7a9fccec67eb9b6639debad4a8527d16f98c61f9
SHA512 1ba234b590bb41756decf035e12cd3a0f4156ef4fb8c19532bde5cc9695f246ee31776c0850ca5166bd5d1d5a35b2c98cb9be8e4d27dd16ba5325e160d13824f
SSDEEP 12288:9yPz5L8nxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxK:0zydmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 f063c518d4c00d6efad9247f373bbaccddecb2c00d664743c6af954ab6bc2e68
MD5 c7a5aa291043d0f5fcfe7a34cd0f0160
SHA1 d1cf129f4615a2ced264874ee3803c4e9e7863c4
SHA512 cd838ef7fb5d10d1d62fb9c68b1c84da1bd3e06794a013c19fc28faece142c990f260da4ebfe0a03a6893f522a2be905b04efc846c8142334df448e800b0952c
SSDEEP 24576:ETHaLl3z0zDLmaouGSPGM9ZQ8GYelhwOXGEDgm6:ET6LljcdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 2829548fb36b6fd739333d1b690a4834fd9d41b9d3297e7123ccceb801472e17
MD5 ad9174fa3e4119027f7100136eac44a6
SHA1 faad7eb9e2ef9305274f571600403b36680b7ae0
SHA512 de7e4b4ee07c987b33640cb018a3f3420f84739c1a9271f61a0e3ed497946ae640189ac27c548b59f859c740e85d6f8922c07d0c75e5a8d9e3f172d4c05cb54c
SSDEEP 24576:w37d9CHKy7GZvmaouGSPGM9ZQ8GYelhwOXGEDgm6:67d9CHKyaldPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 55e071b3a09680c2d78b12716f1913fe6245356a0cf300664a15029d79b3b451
MD5 88c1f1a98fe0ea2eaeb303edec561bf3
SHA1 e70e8dd50fa3deb813499740b0318460b891e4ea
SHA512 c790d756bc39ead9cf1ad2ff3c412fe8e43cadf4a5b6fc98e41409f09855197aff3a3d615897886b7a7c08865ab36257322879270495f96790956174c69491f2
SSDEEP 12288:UdxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:U7maouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1509b70f3f6e4e981f4b422c0c2ceab719dd09c7fe09b2adb3ad656cf46be78a
MD5 ccbffb67dc52f2cd49230cda0db034d9
SHA1 6c826b115498343faee24fd95470b31ed5b7123f
SHA512 6746f76d4bac152da77df28ed1e29409fda5b5a25bedc8316562407c1dbdf6eb0d735cd550ea71841d9bd42937b2ef291e2066f9fa538d9123c97cbf407b2579
SSDEEP 24576:jcP4mcvIjkGOxhKP2l71nNKbrh/8KBqmaouGSPGM9ZQ8GYelhwOXGEDgm60:YP4m4IpOO67W8KsdPGM7nmoOlv
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 6a4060843073fa52e5d85990fadcd78008f0d89c41a32a0b85f7212c75ce694d
MD5 ec85ffb1035963f2c34ed6972cb9f2f7
SHA1 df05c9f5e4243bdcd1bb63b1f4a01d80a711de3b
SHA512 24573629d01bae7629b8b4c796a84c666c7a4fad302233134f9797a6bad629f0a2b32b6f21ebe75b7a4ad0aa5c1b6630f361567cda0b4f8e863e1a35f06a78c3
SSDEEP 12288:oUFmDDLRxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxK:yfmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 fcd56e71f86d43c68cf619d8fe5a7b4e9328af5a42f81b5eda77bf70e638f0b1
MD5 3cc9b31c712b880644efb2b8e6abf3a3
SHA1 7af5dec6414cb7250c326f23d31e89f699ac2d9c
SHA512 2a552873dd91ee5816846e8b93ffc6e1180bdec8dc14965d12efb31b81509de9bcadf21459ebc6951b6325e592473223e69c87ca87cf5438936cec73cc4d2626
SSDEEP 12288:gkxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:gimaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 dba50b02000f5f5974c7f46a83b8c755d22236a763b23613dd9875d7429ea947
MD5 0a92fb854bb7213656154fee4f441092
SHA1 67d8bcfb221a449d048f4b44562d3bd8f192c7f1
SHA512 ea504bf42d1961f07c189213a3d88fe2fe65dd7db2b83cd3ea96b0a0b5defdc83f840ee1612147fa42908f91a4b685f3862f64321724a65683d27d942e3163e2
SSDEEP 49152:Ka0h2GEkuAe73q3pp46zwwQgdPGM7nmoOl:Ka0hNYG4JwFxB7nmoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 fcdd540904b96eba1e90c70b8f7cc42f313fee70d388f3c927d71dc4d34ee3ff
MD5 66795f020b45a5075ba8888e54032b14
SHA1 caa6aa1daa86bee84c63ba4aa7693530f5080285
SHA512 2c4472ea40f5ed9ef6bda326837f34a4044a339dd3baa8b18fdedb5b613f00b6e3f4f0a6e8ae438ff9f061fa54cd00efc4a20fa017022c3542550562f54b7557
SSDEEP 12288:MhbHjfX7xzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxK:MhbHjPRmaouGSPGM9ZQ8GYelhwOXGEDE
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7d777b626fb091f23ab4d9f74b418171b491d27d0c0533d60752799e0bb146ff
MD5 b1f90007e5594a6a3577ff0338cb7c7b
SHA1 37b696fc2ecb53a898c9aa2cdc9d6c5ea5a0eec4
SHA512 0e2700e9a4742dca99873284a775abc5e5e001b7aed931475f62025906c52d1b314d1010de42e93a8886a4500b33e7c73e5882611fe210b7c4d4c140f093a4c0
SSDEEP 24576:83YgnJcRTk4yti+R5dBR/pmaouGSPGM9ZQ8GYelhwOXGEDgm6:8IgnaTk46pBR/pdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 740c43acccfe68f57ccba11c607e63e118046d969d112c2e40e916f085c57b4f
MD5 46167f8ba0ee57c1f17af7e2b9204991
SHA1 1c2da9abda10892c4f4dcaf5eaae408490120f79
SHA512 c22bb4f1e2f6672507eeae0817dae2c1d4037accfdc3c6a3589180e8705f993e790dbf84a3158d0d6bad5faa843496269f9288c4c5b11c22da193c2897e1219f
SSDEEP 12288:egxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:eOmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 10939522e0c4229eb21403e1591db1a332148cc4177967d2e55ff6e55429b485
MD5 db8fdefe4e05fab681328aac1dfa0217
SHA1 90016e95055f4818500182a8fc020ec1f915a5a5
SHA512 026cb0226cfaafaf58776f6a2d19bf9a7d3c0179706f4c1d9156019fc9a724dee8a05daf28af5b51a1ec672e63d6c4f7afcb72e163bf88bcd392a3d3dcae5214
SSDEEP 24576:6pL3UTHmaouGSPGM9ZQ8GYelhwOXGEDgm6:6pL3UTdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 5dbbf210e1419bb017383dd30dbd3e9bdc14a23c6cf64cdd66fa48496f1a25be
MD5 2ca0eeaff9b9d8c876198ca7a242e64c
SHA1 1ee8a21f992fefce4ef33f46793efd54159053e7
SHA512 0aae24cec0f01bba48099d2528864112ad338dd99c0429a39a3685b0fe468c5873413dc5653daab4750668bf7b6d4e4ac98782325a409bf42a9ccecbd3e40ba2
SSDEEP 12288:kpFtpOFxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:OOzmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1c294a7712fad3143b5a71335c89a8aa7eded779bdb01434c72ed140df72a7da
MD5 1d7ac19163249cb0a99436b98557de1e
SHA1 b30d5360f3404188f31b88ce24a2a29344ed4ffc
SHA512 f32b8ed0d504853404c170e5394042f6abdfdfeeca26cd86d3555e3c90545d3e6c2f994dd65a75372189319d31955540aee3462e5b8366183d38618a755c277a
SSDEEP 24576:w7NM9YqZqmWMUkPjZM48Mv6bEhsSmaouGSPGM9ZQ8GYelhwOXGEDgm6:w7cBWMpPjN8DbEhxdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b2f377f33b53b6621a9c7e079fff0239185c7ee9b35651ffe35cc4d656b3f64c
MD5 22c575401d48ac620bfcb274dc1c03ef
SHA1 d390bb7fca58ecbf3f14b651437d69b7e6090928
SHA512 d0fb4a1c99bc7bd1206f151fd349a66072908aefba5f264a56454a0097040f598fedbd8cfe7b6518b226078a522d8c79642565c8a2d24537bd3f58f8787584b2
SSDEEP 24576:7W6BApg2YuyuNDYTabvcdvNYf8km1UmaouGSPGM9ZQ8GYelhwOXGEDgm6:7F2YuHNETovAvNYf8kmydPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 979dbb4ba375dffe5f58f10deff579e9a3b21d66767193d655e639aa64a7265b
MD5 98ade006051b8359349b03d833cacb47
SHA1 7b270b00c0da9b7ee71a92be3e40a5bab5fd0111
SHA512 541a679600744b92b46247c44f46513dc2fdb5f5354f380c801112a7c6ce08a5028054065430bc0101b0f5ef8d3f06276715c4718b5df2e1b3834961dc5efcff
SSDEEP 24576:zAFs06+Omlf3NXEbTovmaouGSPGM9ZQ8GYelhwOXGEDgm6:8Fs060lVXuAdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 550a7af1a277566d8d971334c2be35e02d21f17e96bc419e6e4613be21b80400
MD5 cb9e4895889d0634141ca182f0e5f62a
SHA1 c3ccffc283fa3ee1b8f4267614742c674116f6a3
SHA512 6e4993a215b5b1ad53c0301c71b9f49dbb05b5000971c0648164343af9dfd850efe564862f29314347292bfef2fc5424450ff94789c62d79bf1f1d07e1875cb2
SSDEEP 24576:MJnJ5D3WXAmaouGSPGM9ZQ8GYelhwOXGEDgm6:MJnJ5DGXAdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a92cd3d87e151f6d5b16aa5740a83a6a6841ded172db2820a14c92df6927d962
MD5 19ded9cbfc67102fd2823865e944b7d7
SHA1 7061a00c5dec179c20beb6cfb74854bcdee7c73b
SHA512 7013c03aa6d416cbee625d458495a8f33f8c5a54c343c3efaca0a1b45721153c1f50cd06a0bafc0412cab6affa0570cbb1206179325d224496b68ea256cbd042
SSDEEP 24576:kEPghm6/7IIXdwcXrif7qQncjlP65i3VupmaouGSPGM9ZQ8GYelhwOXGEDgm6:rg06DIKdwc+eQnSt65aV2dPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 fcaf37d56a6eec2de8083a7cddd052b1d2f9d51fd4b7a10b587a1e4c62a2f9b1
MD5 d8e29c55abbbb2a30a80e0a80c912a86
SHA1 9848cb68aa7655a2bf5fccdfff5fc18447628697
SHA512 89ff83ad072e369492c2b9f645a38f459105f7c571842d9973c098abb7ea9adf1e713f866071ea93560a71a7b64551d8c73931f54c37c231c546743f08a57e9b
SSDEEP 12288:ZEP3RnWxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:qn8maouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 7653ae87f4ee3471246fa522b0881efe2a9a14d1ea8151e39926c10d3fc99079
MD5 bac5b7d26b060116a60f70bef5027736
SHA1 d254bafa2553d0e30e41792b8e4e17fb719ef391
SHA512 f790a1e7ca5fe612726125984e0a0f751c736520a8cc8a991e544ff24b2af1cdb14c193391ed8363a42bbafb8e0a59e274483ff3ff520af7448c4bb5318d6498
SSDEEP 12288:vjkyrxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:vIyhmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 e99271c315915b23852533ee81a20455e0cf4985784d1e804f66e2ea4dcf513b
MD5 c6774190abd9bc69a339d58eaaa374fb
SHA1 4b08d552a8e9e17debb72ae092b25a7c808d6691
SHA512 8313ad2267e15bb754b714d43045a213b9f4e53229c345c9d25b872aa79e4faef23f7f8f7ab23f6cdba57e552106776643f2b8562e1a5653028b5e05f560e7db
SSDEEP 12288:py1xzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:YDmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5301eab978364d59e7e1608bf5d3ba38755bae1acac8f6107c713a344f9b06a9
MD5 4ef864200d0c27d105340aa9800e9625
SHA1 67b908df170187b2d45847769649fb65944bd9bb
SHA512 45098bf2e6a01266ce619e7da3abff787526c1b04e696ea9b98fc8e060123f4156b272027dc887496f88084ecc4609068e6665518ebeb06548009e6dd7a883a2
SSDEEP 24576:iQ9MxZKdcz9dw3amaouGSPGM9ZQ8GYelhwOXGEDgm6:iVKZadPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 a5e7e52d8802c402af7eeecd535bccf784e8d901c32aa2367bafaefcdd143a0e
MD5 81b4e04a9712dc278a9620dcef61ce1c
SHA1 6e9e6ab878b00f2c1a5be519495ea48bb64cd7d1
SHA512 8618605251d1a00693b9afea1b0cc18144420d37c28fe46d319a00247304b0b85868075066cb3ecf0557a5cc91cd6222f2a36183537f650c286519fda3ce6c47
SSDEEP 24576:hyocDApNmaouGSPGM9ZQ8GYelhwOXGEDgm6:MocDApNdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 775cdfbd64bb9bc4ed19c482097e00c99a779e95ac0f3b2a83877e7510b65b9d
MD5 f9b0d93b069dbd72149c606b8c5b38c8
SHA1 294a55927da1c1165217f95e5309769af171cdb2
SHA512 7dcabf74c925326f374bacbf05af4e410275a814282928a93984135ab88a6cefc5dee9994f60a4f0269c2c3e65e10791aab549afd131fcce16fe185f0e994984
SSDEEP 49152:cWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKNdPGM7nmoOl:W0zuNIHxB7nmoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ece018dba559d422361b962b6b8b0d92f013b35960066b34e15f5f0bd000111f
MD5 a6f3c5b3096d75fbdf263c0e47290b41
SHA1 c36cafaca039e4de2ea99a44761b48ceab033502
SHA512 c4206bd6a460c4e528e4d77be9f28364181a1722623f5fc686d74d4a85bfaf83d81d3f24109c66e41cf6494ac4edb5f48a1bb0791bd36bd2fe31b4edc40a5826
SSDEEP 24576:t1QT7EcpfxR+N5AWAz3ooiYtjMqb8maouGSPGM9ZQ8GYelhwOXGEDgm6:YTDxR+N5YzTfjMTdPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 c7ea8ed5f4c237d6d87121398793d17662e1addb188b304bf1b713ef62411739
MD5 ad124dad738d6ff3dd140c40a0672c7d
SHA1 6c424dd19590590f545ee55379b66e6e0f4bf11f
SHA512 d8dd019da6807463a0769303c04ad85492ff11c3829ac7cb0c75f93465fa1181e653e98df6cd858e8a7da2dbc8d44da05caec60be98a70d77d52a2c63de76e2c
SSDEEP 24576:ATMdOz0FFS+imSLomaouGSPGM9ZQ8GYelhwOXGEDgm6:o0K+imSLodPGM7nmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 b3204c7e20dc1ea3a60039af4b9e24bb3f658c5b182447b6783062f3f2a8f697
MD5 b9adce1896667a39faa1dc81f6790395
SHA1 775cf8cb2f564cc88b82cb2fdf1f575ec21e6ca6
SHA512 0a7e0798a9e8df56ad59da611496da2de10ccaa63968b454ed54b9d039db3696f4e543e67d4b8fb86a546f34318aec142406feb9bfd2960be1e773a35149b40c
SSDEEP 12288:P4KpxzcJsxDcaouKmZk3SPJ0Kpt91AfwQ8X2e/eVRlhwVQXGw/1+mgmwjjxo5:jHmaouGSPGM9ZQ8GYelhwOXGEDgm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/220-112-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/336-80-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/528-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/528-62-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/528-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/528-67-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/528-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/620-23-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/620-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/620-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1808-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/1808-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/1808-371-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1808-373-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/1808-0-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/1808-98-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/2020-566-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2020-161-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2076-145-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2076-561-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2116-511-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2116-120-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2324-567-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2324-165-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2640-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2640-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2952-52-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2952-144-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2952-49-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2952-43-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3060-560-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3060-141-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3180-153-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3180-562-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3244-170-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3244-568-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3340-37-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3340-132-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3340-40-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3340-31-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3428-565-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3428-157-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3552-87-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3552-156-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3552-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3552-95-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3812-99-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3812-100-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/3812-160-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3812-105-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/4180-364-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4180-118-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4420-109-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4420-164-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4460-490-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4460-169-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4460-113-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4664-152-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4664-78-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4664-81-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4664-72-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4940-148-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4940-150-0x0000000140000000-0x00000001401C0000-memory.dmp

Download