b02a6b0da8ba9da8b41de99edcfb9464c67a91f07d23080c177466e9c157f700

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
Size 648KB
Sample240604-bfz9bsge82
SHA256 b02a6b0da8ba9da8b41de99edcfb9464c67a91f07d23080c177466e9c157f700
MD5 1ad635597e9aac06c4b9aa29fdd376c0
SHA1 a35a84c6d81b8074fc7350be6b0f7194475117a5
SHA512 10dcf1c71339c854b5b15ba90378851e376bb8064670be00ca20466f418b0b73a97dfd4770d413a8cf9692151f5711d6a2f3033735fc6d2a60dfc0e24b998ce4
SSDEEP 12288:bqz2DWUB+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:2z2DWLMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3664	alg.exe
2680	DiagnosticsHub.StandardCollector.Service.exe
1060	fxssvc.exe
4172	elevation_service.exe
2560	elevation_service.exe
2292	maintenanceservice.exe
1352	msdtc.exe
2524	OSE.EXE
1824	PerceptionSimulationService.exe
2512	perfhost.exe
2820	locator.exe
4956	SensorDataService.exe
2864	snmptrap.exe
2492	spectrum.exe
3060	ssh-agent.exe
4488	TieringEngineService.exe
1912	AgentService.exe
1664	vds.exe
1508	vssvc.exe
3144	wbengine.exe
4020	WmiApSrv.exe
4380	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eff555e41ed82f9f.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\javaw.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da2ea0601bb6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b56760621bb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000464783631bb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028f3a4601bb6da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067536c621bb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000510f2b631bb6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000846be7631bb6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039528b621bb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005908c6631bb6da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000121bd9631bb6da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2680	DiagnosticsHub.StandardCollector.Service.exe
2680	DiagnosticsHub.StandardCollector.Service.exe
2680	DiagnosticsHub.StandardCollector.Service.exe
2680	DiagnosticsHub.StandardCollector.Service.exe
2680	DiagnosticsHub.StandardCollector.Service.exe
2680	DiagnosticsHub.StandardCollector.Service.exe
2680	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4548	1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
Token: SeAuditPrivilege	1060	fxssvc.exe
Token: SeRestorePrivilege	4488	TieringEngineService.exe
Token: SeManageVolumePrivilege	4488	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1912	AgentService.exe
Token: SeBackupPrivilege	1508	vssvc.exe
Token: SeRestorePrivilege	1508	vssvc.exe
Token: SeAuditPrivilege	1508	vssvc.exe
Token: SeBackupPrivilege	3144	wbengine.exe
Token: SeRestorePrivilege	3144	wbengine.exe
Token: SeSecurityPrivilege	3144	wbengine.exe
Token: 33	4380	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4380	SearchIndexer.exe
Token: SeDebugPrivilege	3664	alg.exe
Token: SeDebugPrivilege	3664	alg.exe
Token: SeDebugPrivilege	3664	alg.exe
Token: SeDebugPrivilege	2680	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 1916	4380	SearchIndexer.exe	116
PID 4380 wrote to memory of 1916	4380	SearchIndexer.exe	116
PID 4380 wrote to memory of 3572	4380	SearchIndexer.exe	117
PID 4380 wrote to memory of 3572	4380	SearchIndexer.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1ad635597e9aac06c4b9aa29fdd376c0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3664

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4580

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2560

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2292

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1352

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2524

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2512

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4956

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2864

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2492

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2024

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1664

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4020

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1916
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 e2f1db6dfffb77440f73ac3c320f7acbd5cd7d3be146626aa3b2e2fd832b733c
MD5 9f3efb1f3204c95178a01a749dc9bd61
SHA1 36ed0ad4ceb9010b03bebc3083c644fd69366f4a
SHA512 d119fcd1abc778d1c0b52d52796fd6d86393f86fc4fb8ab27c178c00e3af24f4af3e8f685a736544e41d89d95930cbd185f13370a1070e49fb7b17e21dcfee98
SSDEEP 49152:auYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5hMdFrIe78vH/:aPfTqi90bGTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 a4f372da96bd2f771263b2f8a44e8e8a362c87ec8f0b34912948ce8b2604152e
MD5 6b683c9ea96500e87aaf032ca1822e13
SHA1 9afaacfe6aa408d78616caffd050c349ddec5065
SHA512 a641fdf4e61ee81e7543abda1135b40cc71303e1a70a7c0c77d7ce971175abc589a96e9e2065714239cec9cb2d0f699d1ed400229e6ed1fa697a14a824171e61
SSDEEP 12288:McQiQmNJLBsunEh+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSlb:+idnBsuEiMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0e70c444b249ae7a591536b36cce205d51a0cbf48852f84b668088ad6fae0d5c
MD5 fcc0509017ec891f2d5bc21c45e66294
SHA1 ab97f01ded6c60f3cefa7af967f59ffdf64905b6
SHA512 2b38f2f48b3b2aac101eadbbe6c7cec008d371a03129fdd3803fb5177250d8c71221efa9bb5acea8a29a8114d04dd3b97d65c8a2ded2887cd23befe5e757e061
SSDEEP 12288:j7a3iwbihym2g7XO3LWUHfh4CoV+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByInp:y+gkEVfh4CouMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 83137b9f1cdc75fdfd70919c4f66b2272e713d9fb8c2bf9051d200b3ec39d300
MD5 111fc9b25b427a56e6aa5b9a7b7a6855
SHA1 63d4d331f01710ac068524943101b0d1cbbf70ae
SHA512 6445cb177029c7b0b3d98384b659e8c04a8c44a777d3aa76e6ff0074425110dee68052ed75558f97f438b96356bf96798d03f8f80d55093d7c152ae3c0241583
SSDEEP 24576:2BpDRmi78gkPXlyo0GxjrdMdIuwe3zfIe7xmvH/:yNRmi78gkPX4o0GxjBMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 56429c0226d948ded7cfe7d85b22fdc6805cc89163ce92123c6e91d0892b5f3c
MD5 32e8093c7c5f7b6502697d77bf15968a
SHA1 7f813469a5c6b2460fe2d20679358249cc0ec465
SHA512 6ae5eb2d250586e29678f16e9f0359b4484f0ef401f86f3278a2fd658f01f76a431553bdd7f34b8ce9e2992af80b47f829696b3b065d734f82ecc796ed2bc890
SSDEEP 12288:ofC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVV+Xq1gYgR+8DAoczI2ZfnwlQTa:ULOS2oyPIXVuMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 90fe41a9f6f3a018471670799a717d98aed6080ee83936475840bd33bd79abe5
MD5 d0c81b8fb9e102de9bb52cd48e7f71c0
SHA1 5e3121c834d5406fbf34c7801ccf924c494f1f45
SHA512 0f548f4e575806551b912adfb95ed04bf55950bd070ecf0e05e0208a3baf531ee090a781a9246df94137036133865363dd779ca0ff39d3b5e55572c31c79d902
SSDEEP 12288:sfD+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:sfcMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9274a5b82b7e33fa1478f6e6857fdd976429abc9a06022eb20f409adae5021c8
MD5 f7064bba90b6f7bd764dc3c75820a33f
SHA1 29baf9837059c17abb0ebd33904fcb8463b3b56d
SHA512 a6540fb00f06efd128545c87aa81caa5725c95ae17562af26bdad7209b674b63a2c55f2268a290f1617449dfc50848f168bd951fc570d686c158e8907bc15fc2
SSDEEP 12288:7eBNUbTVO86Ui+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0t:7JIUDMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6e44265cabb2f4efee1fd3017028672a1acc9379e1d07b33bbb3c4eb66038b44
MD5 93037a0c22fced21ddfa1d772883cb39
SHA1 57e5d351e330b1b83abaaf5f03077f5b9924cad5
SHA512 222b5e80f9caff431c46735b60d7dabb28c14e33327e8128b134465477d6df67f5028096ef72836ae7ea4da891b9c19c73d9ea76c7dc52d38b75fb285440e2aa
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH5:JQvGAdlCEL8c/yRNw5CZTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 4cbfe0f5a5ae577e040037f613eb57c3ae65141279727c83962f64c55607a403
MD5 9743908c88d39e90520c61d9e32a4ecf
SHA1 ad0efaaca7dbb5328694b886b297b696b9e0d683
SHA512 fd138f2a6c96cd6cc37d4fe184c00e029325bbe41c3f9e8e59add104f1bf793ff55599504128aed076874ac2a0b2bb4c7cd211cb607957541d411dd1f11ea7e9
SSDEEP 12288:RAwSfxL/2Dc34DLLmt0LDQewsAjk+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIp:ydewsAjlMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8be4bf97ad887afda4863b1a71ed8638159ea49abefa095def47bd82a4d607b0
MD5 2d60abdef28b1d04be2d3b1e7311d598
SHA1 5974adfe132e006177fbcce580388d4a58ad712c
SHA512 dc701b2730adff508fa57848ce916301af095598be77cc2d2fb0bbb417a6c5ee6db22383f6d0ee29903e45e0c4eec22eedcb4fed56aab13c760bb8a8999eafba
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHuv:LUEtQevvqc2W1cpV2EI32O
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e463051457eaf3adaa537fdad12cd456a690a2adb8287fad6e375378cc817d13
MD5 cce9c12e83b3cd122313f63b02e47255
SHA1 bc053b0889beaf7aca4fd65d31edc49abecae803
SHA512 d215a7b34fc363236fe94bc08a890cb990c6267cc2402100c2ee38abc2c94d5d6e8e8fb2277b5da127986a76eff3f02d86e51984d3916c5b54c22e91973b6de5
SSDEEP 49152:NCbRquA/m2yL5zTfFiV+XenmE3/zFMdFrIe78vH/:qoquVjnm9TjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1697314ddfc04ee5e0616a31b63c6ce4b2ec7e8509781e27b30ec3235fc801e5
MD5 eaafd242afd569bd06e468f6e8df26ac
SHA1 e2fb1c4f25a80f710a55852a791830f4ae3e3cd8
SHA512 02b17206261ea8c5689157a45b942e4fb9d9ab27a7740292577590fbb2a85d03e7093d0ff70c141678d52b4417f4e44fe724abbf26b7409000260a84cc52a969
SSDEEP 24576:6AhGLJIFoiwtA5l7S53+MdIuwe3zfIe7xmvH/:6AMyFoiq5OMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7a8feb472ca495aa93e2b1c1f55e11e9e65b232046f13941bda325dbd7e78f40
MD5 0af587660edfa5179ef7d68b30940f98
SHA1 cf99c5c4013bcca0b2a23c6442a4d86d691895fa
SHA512 1838863778c96f4601c9a39296cafdef0b2477f56a78b7c20ebb69568d1329e4eb5f95fd1bc31563aa5e0908892c14203468b6d3d262b65b68c0e18a0cafdc70
SSDEEP 12288:pmw5HEjsChNVBFgl0WDm+C5+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xml:kwuoOWJMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 df59e4127c6cb6824c27f06ee091e2e9f87e70c08739e644539dff04d88d188f
MD5 bef81a7e82946120ee8fbff0eb732de5
SHA1 c20e51e95be042e7a5be2a6ba298e6c106c81df1
SHA512 195c06885b02a6b7c21fff9a4734fb29b914c07d21d3d316d87f9057801fb50de288ee72a319cc00bbfe5126e8092093074ed5586b2405ca9e3e5ac1c999dc1f
SSDEEP 12288:WBZ1Iy0+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:gZuIMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 88dec64b802b94c5e78b7b01481c32aa323addc6ad76e8f3f285df613817bea6
MD5 94f0641bad2f6beee1bff4b6a12ae6de
SHA1 cad6a05a376adfbd5da6ceaee1b18d22ba9f9498
SHA512 21d8fc452493b780443668686f26205a36021431748b014684629324dce5797ae2e6d2bc642710db78de072f297cbc31da131a663fe5e9c5ba2aa5fd6f50c52d
SSDEEP 49152:h0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLJ:RwfhY7g/rLd7yYA3awr341g1TjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 0eb2ce4425286caa0bb066dd5d718a16c794e8a2de238246cf41f525fe6a68d9
MD5 5661a952762a58375dedd0571247833f
SHA1 2ba5db2fe9be4e326d8d9636739882c4ca4b1116
SHA512 539dc6ef99726ada587912ace22cc26ad0a054e4354868548d07df10e4e7721d3e9632cb06f961f50c25ae87cec05e897b76958dcda651379ccb2afbcdac3dbc
SSDEEP 49152:c0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLJ:6wfhY7g/rLd7yYA3awr341g1TjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 2c978629704d334afd934e9a9c51b526ecb616e54807deedf9c379961e2689de
MD5 58a97068b7a5474141ace000a3f14c36
SHA1 cecd23d07419d310a4d0178a597115bdfb39476c
SHA512 10c197f694ade1e5ff4e7605611530240b7a797d86fe490e853002c95e556e84c0f655db9bdfea93d49ab487bf704d8cc7f8b6bdd99737ccb1f7799aa272e2b0
SSDEEP 24576:NcTyYv0FteQU+5I2kjgD6iQacAJMdIuwe3zfIe7xmvH/:NuXv0Ftpn5606zOJMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 1371d381c733604df49fe073c978f7f4a0e65632e56e4389c6ae4118fe6d811c
MD5 f28fa56dd6d76b1b6449a243bb09aa55
SHA1 64b2fd5eb5d4d58f072d48f409d222bf61c56324
SHA512 e714976c31d4473744ccd254c9ff7e7b428e33ae2d4666508be0c7a7afa6c3f7eb77803567add5fbe0ca147c6d84f5970015a2a8944254efd3494df3e7cbfdd4
SSDEEP 49152:Xy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxlMdFrIe78vH/:SmYeyxHjWjMTGTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 8cc8e500ba3224072a3e3645341530ad66d847fd0ceedcb02872a86362b495ea
MD5 c746422585fc0c394dc4b8c23c9bb195
SHA1 df22e631d7ffba2548d5cab156b389d144e2d453
SHA512 c001c80614aaec2fbcbe395ae0c00f6510fac85847512e47fb4419edf31e2749a693b84d9ce7e8d7cf8d9296766be8d8629f1cfb721f5188093ce506116b8f6c
SSDEEP 24576:s6drZn1WEci182IEUeNbJeRgUebgW816QMdIuwe3zfIe7xmvH/:sWnDci18yNNUgbYhMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 cd8059ce85c750ae3328604e84e2d7a302065e4589eca8d0f02955c2fb01b535
MD5 3dbbf973159e611cf60617afe843a33b
SHA1 104149f1081c8e60ef112af2d60cba44053b9744
SHA512 410381cf27fbc3f200d968178abc6ee219e357330144ff783a2a48bf52dd175113ad12b644525fb97cbda3e7068946ced2e7f45a593999f8a86e89b3931fa3c4
SSDEEP 24576:Tk5lHW5EzMZupO80G2reD+melRgTTv/1ny/MdIuwe3zfIe7xmvH/:jizMZm0GhamSoIMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 9ad15d7b4788213e0d8198e81c661e256febf4681856a2034ef7ada28b603867
MD5 a6bc4f8dbe7608da794ca45c34a5e493
SHA1 f3e65552dfe0d49e8f0428baae81e2fe404443a5
SHA512 a8de1e5a7cae54c7d21765393e6b3bb3519a179b5aee8ba414e0211dbf314a499afaea7e993e01e1fc6f05071f41360d4bc16bed561dc4c7d27cf49ce96f81c7
SSDEEP 12288:h7+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:hUMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 913c8514332f49e819513fb3acdb4bcb147841f4cad34d79a5f393591266ad64
MD5 f9e6f9501e2e3d6fc1c0b142b4bae134
SHA1 d964c4725541193a1de82786f3acd24d2c1e3764
SHA512 585c996e13d5d0d74a799066503881a4feb346fe0c874539a42138597cfb81a01a1effcef11052a4db44d88fc0402a63a96122d245dc7eede85d40f7fc2f4e82
SSDEEP 12288:XY+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:XRMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 e02addce57bf358a4b2a62d268c8ae187d9b76e2eb274c54d3cb73e0baf3f061
MD5 ca34d1104f723c726569de447385f792
SHA1 6131a49e856549f77ef1768c251807c3c55d2ef1
SHA512 c550e50f5ac0aa603078571788fe5f79a41edbd15d7f9abc1b1b1d3efbdcd0653d72577bdc6cd19547a2712fa9596d62901d69ab948b1e1e910619d3e6e0d419
SSDEEP 12288:c6+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:cbMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 e4b55ce2ac3216e0e01822d710e69578a2e32335be510c124ca537def0cb7656
MD5 a499672f9139ed8fb8b777b41f0b45e7
SHA1 b1ad29f47d6c7cb554e754908fe4f78365487183
SHA512 68b11d813f391a88f8a17910aca3228448d4a272456ccdb59236a6ff9e723355e75ed888eaf11030f3928d3906c08577ceac76b554031d4989a0cfd3efd852a9
SSDEEP 12288:0Vl+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:HMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c32aff5136f4d46320feec232bf39fe4c34bbce3f1c66b34dedb4e127bc84a45
MD5 cc8619504a24dee43a5bc2f4e9c8ba60
SHA1 27975c40d254946f8509688dda282b5b64a57e97
SHA512 f078422861709386de07a103cc3c52d6ea666bdecc64abaf9026ea5213a6b2ee471a8c5875fb3e47cc7b811625ac9dc9c736af0dd7c23c0a810451f9a6fe0ddd
SSDEEP 12288:Xt+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:XmMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 066f967f99c7fbcf2b6154e36e775860fabc28ec534d0259c3027f36b060fad6
MD5 0f9e561209afd6889e61ca2a25f9aaab
SHA1 525b2a33196cbc002e8ee894ee65fbc87a600f83
SHA512 3706033b871214a2de43e0563519614dd19210ccf865b00f34bf5352efc1f1247fa983cfb50a59a163db43ca377d177951de39310770fb9263a87593e7ae5cbf
SSDEEP 12288:mc+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:mdMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 512286b0e5e91c39b5478671f05c9727e742ffdf3bc5f999991933d9b6775086
MD5 1dbfab02ea55f05aff71dec06bfaf3ad
SHA1 03fa2a761085407b3c9c2eaab0bf06239c29328a
SHA512 69b4accc55aabbc4ee9af854318e469451dc42577b21675acd4e3bbfee497dcd468ce8db133b57076164be49e3ae017908ea36b769c84e6d00f5ae22d63922ce
SSDEEP 12288:Gg+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:GZMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 150e4307d41d7ae5bbab1af0eb9d516cef0a03e57fad4ef34ea2a5cb6b8e8fec
MD5 806af415db602802215a7ebb425586d0
SHA1 2c796085890e228ffae77a34727a2dd97e63e0fc
SHA512 66b387994eb2866c34315e28f6b53ee461acd1bf9e02b13d954a55a4248316c9b0732e836353f5aaf84f94cfd2499eef6e4db6f6d95bdbd1177b466492388a0b
SSDEEP 12288:NiZwb6zzFEoS2cPvy4+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUM:QZMSzFVSOxMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a9deeeedb07ed1490b4c520023fa3f2487753dc08a89a1cc895afbddfd99b244
MD5 dfc6c1c49c70c73e4c900d86ca002f5a
SHA1 c8b8d61b83bea571cee23653cb3bcfce40a6d5c1
SHA512 eebfd2ebedadca4d5ee1cb546344777178cf31e1e828f894d2ed9a72095013bd1508fff6a13bdd4ab38ad211176aec3fd0e3c3a7d480dd004915c9ba33cfe74a
SSDEEP 12288:W3+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:W4MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 846b44182a12fb1226655b9b0bcc46117510043a22d7d5e96f331424fb6944f3
MD5 18f20a5f8c81c4bfd11706676dbe1f71
SHA1 0405068434f49cbf5c874bd600dda5a83047d2f7
SHA512 232391fd74c23de17ff6718a6742a4c39e0cbea93d2458d6c30455cbebddaa1ed66170659383d9539a3d31e92e80776a15f445cc288998c9760bb9f1b08010cb
SSDEEP 12288:IT+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:IMMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 1b462fc198314068df29c16a2742c50d1f59981a27091b88650333859da18463
MD5 69844765d5b1705cf4ec7f6aa5315cf3
SHA1 58d897cd622c324b0e1dac063eba6a04ee7f853f
SHA512 6f7449c2bcc0573d18fb3a8222c622cc19d5fe382ed08835128295ef6591e85b5d3591940d6590d325fabfffc86a42fa6873c485ab2e4d6b3427ef72d19eda24
SSDEEP 12288:W3+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:W4MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 4e15f8630725bb2c7d87ce623245d2febd3ffbc54c0132465654d16aba6a4bac
MD5 5ba8c3c19de3f1ad89ab84e0669ac514
SHA1 9b79873e4a1afc926c4cfbe5ac1cadb67438bc8e
SHA512 72a6743bdf5463a6257daf7517dec1904cab26103238bce30cbe49ea40abdb223b5dd97ecb708c01ced3513694ac8c247af3a0c5b72a6181d4d359e3df8e0c76
SSDEEP 12288:i3+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:i4MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 6495b776b38b123255de55e4ad717029d3adf587179449ec3399ce1fb7a0a6a1
MD5 668db2b610852f44cbbae20e8629cc6c
SHA1 f7f508e10e732bdf17ab26c697b468be671c6999
SHA512 66badd11c3baeaef3ba1bcd9b344c53ec1b7a0d17ecbe2844fa40e2386007d1eeaef949a4af9331cbf18c603df0d54fd009878be252de01c729ac2c8b78b34aa
SSDEEP 12288:VyPz5L80+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:8zyVMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 b59e36741006eadbcb4a8080453cd737d4fe2c1f3c7e2637bbf55cccfd3f5c09
MD5 65478c7134508c6ea1bbe457ff995c76
SHA1 824147d78e061fd7e4295c169b28ab7235eab87b
SHA512 907c410affdf9e997babe0621f06215aa6b4fe2a4af79d5a5a21a2a3e8231b8fcdff8e9ef52cae47f7c2f442f5e238ef106143c60d039f432bda44af35e09a0f
SSDEEP 12288:ICd9eWYoaLHF3z0z04PDvhq+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xml:RTHaLl3z0zDrMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1db198c441f9118e097a1e9e56876411fcc7231b34492152cb41fa7ecf96c4f5
MD5 3f541e39cfb166b4f8553209a4102467
SHA1 3bb5f90e039c5b2da32a0b2f87821eb98d0766d8
SHA512 a92e7ac38b03d024efceb7b73bb4eb1fbb032930566f0503b418f1bafb941650357f8f4215232d2241d8f643cde811672ccbf538dbf0f2c591aa447cc4ef0de5
SSDEEP 12288:Ai4e7+RdTfgwCHKy7GLbbdIvh+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7o:A37d9CHKy7GZnMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 7204028ddf430408dcce97ef2991b7b5dfd7b07f8d24ad076c9313a06a7abb68
MD5 420af1d8344678908c94c1b5e9310df7
SHA1 f71396ee62a796148d0ba313ee8dfb26771592a5
SHA512 445e5b39f1f8f49f1161bb145a380e30960a07ef67dd06f26499563a87ef5d37e9615c6632d674c03793acf3860cad544f847782c9cd997b20191bf4a61930ab
SSDEEP 12288:/a+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:/7MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 100aacd1e64edd8098615f3967d0318e1b5d258a9b8d9c547cb57c929f52d960
MD5 8715b077c4d2ac0d5d624c5764b1832d
SHA1 72836586b9a37eb40fdb0bf7b8f05d5db730795e
SHA512 b20c9c51bf43e6b1a59ac2b9c7c34152f177106fdc8138af6e21e06348ed2b75b88cec1f41a49ab121bbdaf107cfa70984bfc997a08630cde8224fa7768cf4a0
SSDEEP 24576:wcP4mcvIjkGOxhKP2l71SNKbrh/8KBgMdIuwe3zfIe7xmvH/:bP4m4IpOO67N8KKMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 437e4bc65c468451a5516e13b248e738f0bf55a78c00a4840cbdff04d883bdd2
MD5 5374cb2b2f522e7fd4baf1f4f39a4b43
SHA1 164c53a972fb9c291a5552e044d491c22baaeb54
SHA512 245caf5e4e1baebe2b05ea46a757af9c57b7b3555a597084a43ae02af7c039775b33f8d2de79d2bd85cb070c63d291e14976a6ab07f0cb58c96097f77fa72ea7
SSDEEP 12288:0UFmDDLO+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:G3MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 37332d6c9ada3d441e9f357b5eec627bbfa00cc5317cb88c0bfa937ef6d2850d
MD5 28afa906b9f5fdeca46ee0b2f3e8dfee
SHA1 db6e43bfe85213858dcee42fe598ac957b0b1896
SHA512 485f730ab6806168af99e417dcb11ad1411582782d7fbeb63a6f0293c1048419baa96ce62855b02ff50ed2620bf55e4b959120858970638a5ea5639fbd1649e7
SSDEEP 12288:WH+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:WoMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6b2ab6d89395905fd64e7788b0c6aa91513d11a2a491fcf8f026ca4def62b7e3
MD5 427292176ba27d9524f5010f20511b24
SHA1 aabee35dd18d1d4b49f63306c711de0f193977a9
SHA512 29e64901b67a8d6aa7ea206763b7d31b268984a6aa2727a4c69c9b0b84de023066c3d682d9df75dbc7b81cad9b124d4f4236603c1c34ef408991f673c82e35e3
SSDEEP 49152:3a0h2GEkuAe73q3pp46zwwQmMdFrIe78vH/:3a0hNYG4JwuTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 fb62eb64c79aa9c7798498d99062d90bd8e0b24328f7e4a7c93c8c4f4d734f2b
MD5 75d0def68ebbef703ab7f6a4d9e216b2
SHA1 73080c29265f7dbe636e5cf45367a04f57404d0f
SHA512 b0847882377569035d40b188a1a252ceace6d0e170ca4862a056f53b5183a58ad56f29b56b1464de4bcb838d4fe396a3cbefc8a10cc97a86ebbbd9a5e38ca1fd
SSDEEP 12288:EhbHjfXI+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:EhbHjPhMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 3e1dd156e5f358c69b4dd9b114ab2ffd5c04ad7047e1e14c79588aaeecc1c342
MD5 913c04f78bf04568aece8aaa7157bff4
SHA1 2b3c59ab7ea93c07b93c5d1d33e1dc51da5b0f47
SHA512 19de29310499fc9dcc5dd08e8b38c54820020d574380057d384585cadc00e3ddaa40061577a55bbcb780bcd9c09e1b84011a9c8853ed4c3ab8e88d84eb43b994
SSDEEP 24576:/3YgnJcRTk4yti+R5dpR/JMdIuwe3zfIe7xmvH/:/IgnaTk46ppR/JMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 b452977134fb310b8160da4f8b59eae2177d67cbcdb8784a3d8cdb53b99ea4f5
MD5 09077ae57b8c5a3bb125fbfc9bcfbd02
SHA1 24d8ca14f5a33fec192402bbaa78f175b8d5fdfe
SHA512 f57d8fe3b0d14906f2b5fa01eaead4a6f02715d7327f1879c617539fbe6669ab22ae3ef8d2f5a04164b9b5486cd25b1cdd386685b0679e5c0e6abae2fdc85a6e
SSDEEP 12288:6j+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:68MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 35d2f3924df0cbe9632aa857d0538311d8dce577673c131ccb3afd33663aeb76
MD5 39cf9d2c3229aa292a7d8505c3528f66
SHA1 fdd568baa70458dded7aa741e2eb6fb2cace8460
SHA512 f7ea1002c281237961399c3f909ad3020d1a3894550496f4a6fea9394c11f60efae63ff29c9a912b4a17f36b2021e82518c3dcab04842b87efec2448998c20e0
SSDEEP 12288:bOb9A4LWOsvAYFTG+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSN:kpL3UTvMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 4fa8d661b303d484aea29c1f457bd299d5e0c84946b1add377f9231d061777fc
MD5 6957b540d1bd2b30b3177c50ad2b5745
SHA1 b6603a2c5047eb5c00deda89153662cfbe9ae955
SHA512 9da92fb6110b4aaba95c701fda4bb4a702adbba005415bb86d09d6b970f88abe48b090ea5132ec5be35bde0c784b3195377a59436217eef7b3fa3b5ab48e58fb
SSDEEP 12288:8pFtpOC+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:2OjMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c628fcdd9b29fbd7df74527af92ecafe24a79ef4ccba11bfb601983635bdac72
MD5 b13078488253506f09db7cae898a8324
SHA1 2f7bd8769e0a138b714e2fa320a7d7c230102e13
SHA512 d2a16385c426095c8aad9b2985a6970df81aa29fc973f8be419d0b74a2b9a4b2f64ab6797a68bdcb3b92480b68c0f50f91290dc6b8a5cf0ee81a58758831b367
SSDEEP 24576:N7NM9YmZqmWMUkPjZM48Mv6bEhs4MdIuwe3zfIe7xmvH/:N7cBWMpPjN8DbEhBMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3b17db23b4edf18f60af30b05495d6a83a1820ae0fd79a8ec4225de224276edf
MD5 b19bcedb0028622518bdaf7fb272bd4b
SHA1 a91ae00ee1d81746de056557738df193689d2124
SHA512 9ce240d7933948d9d5e6db526180543c7f5a69d00f46ba9e8e56cdaed4de75c1ed5603664c085658ff701e12ea0ef680a7d4a0ae1c998f4edd39ebbcba8e6b6c
SSDEEP 24576:WW6BApg2YuyuNDYTabvcRvNYf8km1CMdIuwe3zfIe7xmvH/:WF2YuHNETovcvNYf8kmYMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a2fc3860fa7b5004d735edad0fb49a613c84b1ecba3343491d696c411e824e44
MD5 02417cdb580dd9e72c993511d258f152
SHA1 47050a5fddf9904ea6d329e011bbcc98f40ae28c
SHA512 f45eb0973063d50d592c942d9d271bb4af81e8b4f7ef370f4dee35d282ad7f96ed2ebf3575c2ff77f5f64204f375aae81882e686093ced40e795d4f3037935fe
SSDEEP 24576:+AFs06+Omlf3NXEbTonMdIuwe3zfIe7xmvH/:3Fs060lVXuGMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 7f345f80ed352c764ecb41ba946abca31c526f87cbe6bf9e1bc0c0c7251ea227
MD5 abf7aa7c0f6971ef3535a45d3b9dfb85
SHA1 21ab4025cafe1331a56a4ce16138070a8dc1fc97
SHA512 73e79465ff73114195d2204ec93aa27bdd815f9a808582ac6eb5d9275a245973128fd5835a5843207e05cde586ec8be0ad2581710f257f5f69127e8def2bb9b6
SSDEEP 12288:RCJnJ5D3VkrlzxX+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSlb:oJnJ5D3WtGMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 37e89a8041b60f2902164b0b19651c34052228a82a0b0670b5fecf1f7d737b3f
MD5 c1e8d48417ac1d351b3c7821475ecbae
SHA1 4c4ae4cc324f628f4255ece6e41a3fb73b2982e2
SHA512 93cb516cd673d0bf95f60d383942dd82f5a746d5254dd6435bb837b1d966cdd0741755fd82d802d78efdc477d2119f2768d8ae3b70132266ebfe12f903a013c5
SSDEEP 49152:fo06DIKdwc+eQnSt65aVUMdFrIe78vH/:gxTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 c62fa0dbff2f087334b6c2026946e797ef7fbc870d0813a2b97d7e6e0d9b13ed
MD5 fcaaf8dd491a90941bcd2a320dec2349
SHA1 f2327fe13852dde16377177f355e37233cb4d87d
SHA512 abe372bc1904cf344c423ea36d746d0f8fdc3149b6aec2f528974146a5727c90180db45cb8a8090f58b4e62f4d41d5469594694bb82becead2b3f8efad10193d
SSDEEP 12288:dEP3Rr5+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:+r6MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 178d715c8839e79b70abee8b59775340ade1398afa0258b6959eeae08b57ff86
MD5 2c7a5a0fe8915448cf2c67491d86a7f1
SHA1 7fa0fe0c90cb6b10f73d6aa3b2d6aa454f19bee9
SHA512 79f833f7104f6bb062ac4408191373373d945a68f3257cdfc49e8429a23dcb3914630c9d0d97809befba747ee8435a8e2406993af1e4726c96913faf28b67e68
SSDEEP 12288:7jkyY+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:7IyRMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 a6c4210026e31e90684a8e64ff767fb5370d41e3cf667891f01397d511eabb24
MD5 8c4943b060fd19037b9e7f7090d10e92
SHA1 3926a83b7d02be92c68d154fa835e9b9e10cfce5
SHA512 1fdadb3599c92c9e78bcd43ecf9cb9d165e2a9242aa07f54a1bbe7e7867be783230ea8413d22f33edc40a5dc79311c9c66623bd59198947b0cb58aacb09eb3ba
SSDEEP 12288:0FS+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:yTMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 bbd8d1598e74896ca2ea8ed92f33aa5cfa4e3db594764b00e1a7b54fca6000c6
MD5 cf353d53b120d1510ff533bf000f5dd2
SHA1 c776180c360c515d213c70127162f9c5fcd7381a
SHA512 6dc9672f9cb0320cb3abd5b3d5ab6dbf886b9c321682f5d6e56ecdd602e50536bd9bd631fe9ed5ae885345112d9a3c4d70fee41f8a213d207a91c3a4bd90ff62
SSDEEP 24576:4Q9MxZKdcz97w3wMdIuwe3zfIe7xmvH/:4VKXwMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 f0ae3104d827705066300890e4ed616a01b0b3795c56cd55aa3244e037fe5f83
MD5 710e330328d56b99bf5bcdc6cdf09737
SHA1 a47007c1de6fce27fa3dc7e6b5e7cc1468159d4a
SHA512 3c8a55d74b38412d624cc9e3f21dba5dcd306867e50402f3d219a96562960d3629560c37dbd792757bc93505f2bc831094a8fea6d89e2eabb78e51a0c06b21fb
SSDEEP 12288:HyoKo2HRple9pk+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl++:HyocxAplMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 df96337f640f214bf83155cc4361acd147b79b898621eaa883845286573fdf20
MD5 bcc228980215f2566db1f452bb6fa8f1
SHA1 824f4284b546952251b2b76c197df613cf3a264e
SHA512 5b82edd001cbf74691ce339544a71d528f26ce45585290f2a79eab021ccc32e79ef07c948cf05cac10d00a7695ad8705b801b67f6fc754e1a3a8a148f1eda330
SSDEEP 49152:4WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKlMdFrIe78vH/:a0zuNIaTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e584a99f1c3b3815461b342542ac905ad0bb3ec9813ee9317c1db8347c7fe2f7
MD5 8914f7f0b6d47b6df7bf51c1857654b2
SHA1 2a1ac64a37ad218af3e810a010f4d5d14dc134ed
SHA512 a07f83c07c63ebc559f255e6577fbf2aaecfe4e72981efd903980ab4696fb02075616eabc446874ed7d544564932ce605d916ea4135b9a2e9c20e8e8ce422af0
SSDEEP 24576:p1QT7EcpfxR+N5AWAz3ooiYtjMqb6MdIuwe3zfIe7xmvH/:8TDxR+N5YzTfjMDMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 665fc97ac714e71cb266be8b16726e496cd60a9db1aa7ae25247ef2b2ae3f89d
MD5 e2f760c7f7569472c14da36167921178
SHA1 89500f61f305164152396574546fea5d44ff852c
SHA512 7d287468aad798cb766596e2fd25edcf36f86d7040850a6730c2be64916d42247a7be7e4403a28822c0a29b7f884e5e28e84c33938af78c57e3db172410d3487
SSDEEP 24576:hTMdOz0FFS+imSLeMdIuwe3zfIe7xmvH/:L0K+imSLeMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 401296671be9ff3d87f31c2ea744fc6ba61f943505d594bcdac415135901eafb
MD5 6ab9221650356365ad04770701e5143c
SHA1 b14cdaac1c1cd6a04cefa866b2898e669ffc5b41
SHA512 b2bb01bae92f4880feb29e449b3766129a033534f3db1cdbaa0b2305c210b4553782f9af2fdc30daa5d0a3fa7f2e462d0409414a158c50076796fd6a9b5321b6
SSDEEP 12288:m47G+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:dvMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1060-40-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/1060-46-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/1060-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1060-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1060-48-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/1352-203-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1352-91-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1352-92-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1508-607-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1508-249-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1664-228-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1664-606-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1824-230-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1824-125-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1912-204-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1912-215-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2292-75-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/2292-81-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/2292-88-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2292-86-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/2292-83-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2492-601-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2492-176-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2512-130-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2524-227-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2524-104-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2560-70-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2560-72-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2560-180-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2560-64-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2680-33-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2680-132-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2680-27-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2680-35-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2680-34-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2820-133-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2820-273-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2864-156-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2864-520-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3060-602-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3060-181-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3144-263-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3664-128-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3664-21-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3664-20-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3664-19-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3664-13-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4020-262-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4020-608-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4172-53-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4172-60-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4172-175-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4172-54-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4380-274-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4380-609-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4488-192-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4488-603-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4548-8-0x0000000010000000-0x00000000100A7000-memory.dmp

Download

memory/4548-0-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/4548-90-0x0000000010000000-0x00000000100A7000-memory.dmp

Download

memory/4548-472-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/4548-473-0x0000000010000000-0x00000000100A7000-memory.dmp

Download

memory/4548-9-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/4956-519-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4956-464-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4956-144-0x0000000140000000-0x00000001401D7000-memory.dmp

Download