d6c44c7ee6cb7ec3f8d810a64e21f77d20672a0e712dbdd952defce5a19cb521

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15bef8e5b16c25febfdcb8690a1be9e0_NeikiAnalytics.exe
Size 1.3MB
Sample240608-qmkjsabh8v
SHA256 d6c44c7ee6cb7ec3f8d810a64e21f77d20672a0e712dbdd952defce5a19cb521
MD5 15bef8e5b16c25febfdcb8690a1be9e0
SHA1 bc9cd634c76472c3c93b85b5606e100bef680464
SHA512 2a778d35ff6880dda8c7e015007984bbbe33c0a372cee64a7d1bb7aee2b5bd61449a4574cf76d1a91a8dfbd63ced0307258e3f7e2f4b27ad9e77ac8bfebee505
SSDEEP 24576:23LutmkEz+PAVV/bOInO4Xs2ztR4iegxLHgZpJE4VDd/SkQ/7Gb8NLEbeZ:2butmkO+wROInO4XrztygxLHkJE4VB6T
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4292	alg.exe
4492	elevation_service.exe
3152	elevation_service.exe
4552	maintenanceservice.exe
4144	OSE.EXE
4728	DiagnosticsHub.StandardCollector.Service.exe
4324	fxssvc.exe
4928	msdtc.exe
2100	PerceptionSimulationService.exe
1316	perfhost.exe
2808	locator.exe
4360	SensorDataService.exe
3880	snmptrap.exe
2940	spectrum.exe
3132	ssh-agent.exe
1864	TieringEngineService.exe
3864	AgentService.exe
2752	vds.exe
8	vssvc.exe
4220	wbengine.exe
3552	WmiApSrv.exe
1384	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2eb94dc3c3136770.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	15bef8e5b16c25febfdcb8690a1be9e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000145a6a25a7b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ef94825a7b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092651826a7b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035318225a7b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039fa2925a7b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053982725a7b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1483825a7b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1512426a7b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075964625a7b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2116	15bef8e5b16c25febfdcb8690a1be9e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	4292	alg.exe
Token: SeDebugPrivilege	4292	alg.exe
Token: SeDebugPrivilege	4292	alg.exe
Token: SeTakeOwnershipPrivilege	4492	elevation_service.exe
Token: SeAuditPrivilege	4324	fxssvc.exe
Token: SeRestorePrivilege	1864	TieringEngineService.exe
Token: SeManageVolumePrivilege	1864	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3864	AgentService.exe
Token: SeBackupPrivilege	8	vssvc.exe
Token: SeRestorePrivilege	8	vssvc.exe
Token: SeAuditPrivilege	8	vssvc.exe
Token: SeBackupPrivilege	4220	wbengine.exe
Token: SeRestorePrivilege	4220	wbengine.exe
Token: SeSecurityPrivilege	4220	wbengine.exe
Token: 33	1384	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeDebugPrivilege	4492	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2436	1384	SearchIndexer.exe	120
PID 1384 wrote to memory of 2436	1384	SearchIndexer.exe	120
PID 1384 wrote to memory of 2040	1384	SearchIndexer.exe	121
PID 1384 wrote to memory of 2040	1384	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\15bef8e5b16c25febfdcb8690a1be9e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\15bef8e5b16c25febfdcb8690a1be9e0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3152

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4552

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1988

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4928

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2808

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4360

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3880

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2940

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1500

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3552

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2436
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 f65d77c61dd740cc1af56789456dcdd2732bb83cfffbeca8a5799c5b72ff0fed
MD5 1554a5f20a554998b748a484a2a420b9
SHA1 6242f0dca096473961974909d8ae722e57c32a7e
SHA512 cc4fc358d79660c989c4b362fea4d518331a9b6ac06cbbb317ea1108ffa59d5b8d193ed339f98d80718ba9363fef8de61a607b9e6457cd68e54c1a9b6d35acc7
SSDEEP 49152:AuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5rkQ/qoLEw:APfTqi90bLqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e1acaffa919eff5925f7e4e8221414a0997a2feed3a702c0520d92b8b963f65e
MD5 3ba430d3452209c1e6eb966a1dabaaef
SHA1 abdedd9540aa76b4a0952be2b31cfea6385af810
SHA512 2400f3cde61ed4c6ddffb7454f4539c1a1b03c829e42529dba1002dcfb5f8c02d98be8e9d32029970280cf19fdb0fac756ddb09c857bce00347d38c344cd9ace
SSDEEP 12288:lcQirmNJLBsunEmMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:tiinBsuETSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4406308028d63cc91c1e9cbdbecd532cff4d1c529a739839353837932c7972fd
MD5 ee2a23e509ac8f577f0ffea9a75cef6f
SHA1 136a0dd8e534f78257be37210ba097e9914158f5
SHA512 9256c52eeab11e6b859324bdcc85e602fde55118a142b5a9f447ab5d7219a675b6cc7fe22399af8c0fd903631d0b5b89a25578afa37c3bc9e2309ce659fb590d
SSDEEP 12288:J7a3iwbihym2g7XO3LWUxfh4Co6MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:8+gkEDfh4CovSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0da2597e1363d38609e6eff4785bd68ec3a90fadbe9e6a135469a996025defb6
MD5 4bfbfafde31668443ecb9563940ce742
SHA1 a70f0f5a017c15bd8212cda905543be7debb9a74
SHA512 54ca0559678a15830eb11771f8fd8aedef34c75ada925987f00c19d4c27cb02376330a2a8fff2ebd254f6c645e31699f817fa080eca397f3c1dd8d88e29d5baf
SSDEEP 24576:XBpDRmi78gkPXlyo0GxjreSkQ/7Gb8NLEbeZ:RNRmi78gkPX4o0GxjLkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4cd52afc9ca74b47b7ba0d0e487d5bcfe80581f6931e7151a76a426c932e0d5c
MD5 a394d26067c2412f07192e05e48dfe50
SHA1 9ae730b6506a9fed85601f3a19c9eef5b51afb59
SHA512 053f778c62569cb01c63287fa91652007609dbdb3113579e71929479a58fb3b08bbbe661ea3af7b0137d62a0ea63accb73c0d1dd7031052f6e3de8d03d4270a8
SSDEEP 12288:lfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXV6MTmkJR4Do07Y86gw5CtCjX+NR:9LOS2oyPIXVvSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 dfa36eb616e37bcf765e67db455365e8ef96b3dd3ea2de5c0ad20c406e2bc7ff
MD5 634c8f1ae770f9afa7fb2fb9c659dfe8
SHA1 4f3d0b2178cc72c2c739e7dcae4486bec2a40c99
SHA512 a70571e96130180f73a5548d3630a1a45ec426a5054612bf6034e78c976fd2c6592cfde689c2f62c70b63785b6d12e8986396f447411164071258e9fc9592f3a
SSDEEP 12288:0MgMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:0MJSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9b03d1aa877bf4ead3165bd157dffd925f79a83385af1915215084dc1d93a26e
MD5 59c595352d44d15f3f66c7407ffab5c4
SHA1 63af757e6594e63333557c91a2d64eedac10ab8a
SHA512 bb1dd126394c81e50df6c9bd8e98a98f6fb50868bfc5e7dce19d0f6da229f3f212e9b72be66dde64618baaca920225bd907b6d7c417cc7b2a2e3018577ec7ff1
SSDEEP 12288:5eBNUbTVO86UbMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:5JIUoSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d4d874aa35e78bfa4f3fb2af046ec2847bcb0868ef91ba4eff0b4319c1d8fff1
MD5 c43e8df5b523c00803381456af3dad06
SHA1 678153ecca4d4fa12ede6a7b969c85499731b3ce
SHA512 058c767ed80d4fce640210a4c0bcf7731e23ec69a1f1dfd7810891ab265d48ebf3616ba9f737dee4668528e8dde2b7a4733fe2512a00e3ac2fb0f16d03f9dfcc
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:aQvGAdlCEL8c/yRNw5C6qo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 83f2c195b77e994d15409266a2444788fe5e561afa125ea3251221a7018e2d57
MD5 e41f0ca74eb0f879c1f40cec8f805293
SHA1 bddda28d038b077588206af8172cce7aeb7da935
SHA512 f6ee2de08f884d95ec40f57004ed316e8139526e86ba12317631e508f6377081a5a333a24d02e23930f92bb77acf316736de2855d3ba671c1572f3f34f84f3a9
SSDEEP 12288:aAwSfxL/2Dc3eDLLmt0LDQewsAjFMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:v3ewsAj2SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d086f7f40679ef78462da348ac1dbd12cf523d928b4ca5f8550447abaa67284e
MD5 afcee338e22988452e4b46bba73f616c
SHA1 83667bb68b206e5e6d9dc0ab74a52ede35d8ccea
SHA512 a3cdbf66fda747e98476cf2199416f2ca9c63ae7044dc54ec23d6acbd65976b7897ee9ae503da8e15ee6287729ca821d074e678f727fa2241a6bc8c6446e8ccf
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHj:EUEtQevvqc2W1cpV2EI32j
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aaaa4f8451221e20d454d52d158e64acf338e723163af88d85c4edcd3a8627b6
MD5 5672e861080fcdd07c308669399329cf
SHA1 1248ce7517d0dd71d219bd2059fbaf7272916017
SHA512 0343a7401687db2b3367f3b1fec98d777ce8ffe418375c15c52554eae77ff25deebd58964b4a613f9405e4fc2ad76e22ca4e3fd40c95b5dcf305951d35a4f259
SSDEEP 49152:QCbRquA/m2yL5zifFiV+XenmE3/zPkQ/qoLEw:5oqHVjnmuqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c67dce68907e0afc9996bed6c4edc25a3a5ca87c738573f4fc22998a9f7d253c
MD5 14c8ef39b6427a446677bcf0a6221e65
SHA1 e188aadd61ae8fe6167037ed52f5a72356bfd72e
SHA512 8cf0c8cc2e1fd810dddb0ad310349549df19bd793527dc89b9d9fe0ca236fb45b499ea5ee68fc12c1f3bf7e8f1e2e13c7b98ad6e430a78e3119b1c3f82d620c5
SSDEEP 24576:GAhGLJIFoiwtA5l7S53fSkQ/7Gb8NLEbeZ:GAMyFoiq5qkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 bdbed8d89262e9f5b253ad4dca72013e8b6a9699747daa9cd4de26d297d96563
MD5 c9f2fc3c1f54cfba88a4d801fc463ef7
SHA1 525bafd6132dc49486ac3a62112810b66767b612
SHA512 35bea41cb4ac7ccbd06191506ebc3e401bccbafd9d4901b373c184604f876ef088747cd81021f95b16bab4a4efc2afd6027a99df36778776891cc9cdfe11286d
SSDEEP 12288:Tmw5HEjsChN8BFgl0WDm+CeMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ywuxOW6SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 a0236594c98e9810d43fa832e4da3fae5efa44ed42fc99e4994ede86a1c342e3
MD5 2ba95cb34c406f0a8125775e40e14946
SHA1 b69e247a80077df936e70521846cb68b450ff8d3
SHA512 4a4f024a382499a252cda27f7378a18cc8d015ef49627e83d819c527dca6acde1f07cfb1ac55ce4d964bc57466e0a5cfad9b50df90c0ade52a52fd547f721e40
SSDEEP 12288:L4Z1IyVMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:sZu1SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 b08c1ef608c926d62797a67d6c436b57909292a05b89ced9cdf7ec4162c8711c
MD5 308816d0e781da27e1f4c8420a038ca4
SHA1 f3a2bb7c17fae055bb147119da7b856942f2cbab
SHA512 412babfad38e676d764ec58fe991a8efbe0cf4205258acc0bbd310ce6822d42f54f8353f45cdfdc1d959aa8d01e229ae66aaace17bc0eba00b6517b93b3f888b
SSDEEP 49152:g0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLB:GwfhY7g/rLd7yYA3awr341gWqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 02254725dd17fe3db4f2676061274e2dca302f366746543db6fe86dd387d8440
MD5 eabe3f712cd10b1b4a10ef872c0a5309
SHA1 ecf0368382fdb2e75c25db06720dd7ade902295b
SHA512 a553844a58b0183c12e57dfdcacc7ca40510d0868c16cb863ee6fa1fdce599dbd5b6be74ca097bd0b72f3e851c088e171b92525b3abef6bc468b5b28636bdb18
SSDEEP 49152:p0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLB:ZwfhY7g/rLd7yYA3awr341gWqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 88d577291c1a3971866073ee1e67cbaa8788420fa4569749b54909c9254056a0
MD5 e0a1a1b0fc98d4ed2afc0c7d861ae53b
SHA1 71363a5ef5e8181654f6b0e82536c37f4dd827f9
SHA512 08674b002fa988362b6723cd597314dfb3581101f1f6593f4c5ebc93be1b57a744b07eee010a3dd0205f588a85ab3718e6849d3c09fe227ad8ce5b354b67fb3c
SSDEEP 24576:TcTyYv0FteQU+5I2kjgD6iQacA6SkQ/7Gb8NLEbeZ:TuXv0Ftpn5606zOTkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 615bd34437495a69dcfc16cd5471c24eab47e767518c881cea7480a3ac3152ef
MD5 a2b4d027a27f063224f8086135608541
SHA1 d9d04f1268ca90cf0f657177b54f8fb38d10e604
SHA512 502dc392d94d89e3ffe355c0a444551bcded4525c2aca0acd7c329e633a72aad549b4d98504509e5833a887f884744d59c2d43af4e2b531af7fd13aaf410bfbb
SSDEEP 49152:Ly7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxvkQ/qoLEw:2mYeyxHjWjMTLqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 87d49ec4871877cbab93c85c7d0bb6f0d410efd64bb6714d4ffd2ddbcfe27a82
MD5 9be669db872fc8d48b0b6b53923b9414
SHA1 b8a72fe60550fe90df3fdf88893e18834938c621
SHA512 6b3f7215dd6f913abd23cf58a622f8103b49df7916cce7d84eb2230696376b3f125794cf108a76ed81231624fadf4b231ea3b5569b41614203016cb7e42b866f
SSDEEP 24576:L6drZn1WEci182IEUeNbJeRgUebgW816NSkQ/7Gb8NLEbeZ:LWnDci18yNNUgbYrkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 ccd95dd06ecdb320d6f299a384313a075a19ee1dc75931abbd05e1217f78c39f
MD5 56946716fa1574bdc16668fdf3943a39
SHA1 54bc0ff9e4b7e1ed656d1c16de12b69fab611af9
SHA512 4cde400513b0c1f3580c55a27205398386042ef89b2c61976b8811dcbbf9b4ca4545d28420490492a1525df6eed68279d6eb1b4bde10311a9530c6c99e61f81b
SSDEEP 24576:Sk5lHW5EzMZupO80G2reD+melRgTTv/1ny0SkQ/7Gb8NLEbeZ:8izMZm0GhamSoYkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0fb9aac09c45a4ebae20a824e3b8c6eed5a382ba3a1ef555418d80071859c04d
MD5 5b98f577a363218b9fa43f9b860306e9
SHA1 6dd1ddccb09827dc9283e8fa736e097add21d2d5
SHA512 fe56ad510d0e289d55e08cd04744ec90eb3ea5a886a6dc5775ad4d28de26c1c11d86613ca14b8cfdc6a465b7f10cabe4a819dad1a1a0835e1091d452ed6f6532
SSDEEP 12288:/YMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:/RSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 70768eb6e5492a4729974e008f443d8d56d7b7fe3fb8f4d2f8dd786d342231e0
MD5 607eca9651ed0efa14f89ad9ec1e9064
SHA1 6022d1f25354323ac1d338e3261b925e8d4e73cc
SHA512 f03b4be855da10f1a3ece5be14b7df929ccc0da638282dd7464e883c770c74505f0141c0ce963e57b2def5ed13721c1704c5090faf440236f9ea85ef465a5971
SSDEEP 12288:zJMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:zySkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 da21e0efd273cc8993d991da6dc74dde060eb3bd2d29ad6a0d6e53c2d104f9b4
MD5 96599b80dec44539936fb658e7daebcc
SHA1 32a72ba276ad6f67fd98ad4c78945058fa443d56
SHA512 f5ecf91eef96988a9b530711fff1ea34133c5abb65ff262aaaeae445f46f639643cf785e213c06c3c904b2a85c23a17269bb8e45894307e3819bab8d49b4aea7
SSDEEP 12288:dTMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:dwSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3a7fed3048cf7df09e8781a71fac00303f480e84358702f8a79d833b234432f7
MD5 9bae70685e929c6109f2feda508669ba
SHA1 c4eee83d36858c8524a45da55c13df11f8dd7ea3
SHA512 7e6b48bbec3a093c992a76bba77b2e479227d0bba7b8a2c96f9618e4f8cae1849d595f4b98b2c0fc56c8201b6806769d899ee2053e6fe4993e12922ca09dbd5e
SSDEEP 12288:mVKMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:eSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c501fa51000c5be33d62cc2827bb7b1697d4b6be21a172916d9517a225059405
MD5 b8bcc92ab0ffb7cedcbc92819b89f5cb
SHA1 c0546a7a9f88c208ebc62e1a80be695981cb7b43
SHA512 cb5bff9078c42b9cabc0d40e0e961870db88d6a56d685c86dd0a93abe6276bfe66d562b8dec88fc4ce9f379881ad7916a6484c1eff4e2640fd7db6cf2e0a7d67
SSDEEP 12288:OyMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:O3SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 17b3fe5785ee818258945ee0c948a3cf13f3da9376a7ae899a9e0934f14ea62e
MD5 a7df06b88b0544f0a65b83946d0d85e8
SHA1 a41a890bb80f07de3252d724795a9ad5499ebb2a
SHA512 fa3863493419afdb4271f16970c49dc44b1e68e314ce9f4a7d0d001c978d9240b94b89c92a20bdad66b1d43f8bdf2ad38dc9664fd973c713954d58fbe4e39717
SSDEEP 12288:o9MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:oeSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 62a95a96f08467b90a78678842f9eea43fa985406be6bb0987ca728ea102663b
MD5 61c3e9d4fae58648ef7c48791904cdd2
SHA1 46b4d203782bdb9d6089ade83dedcb26ef43e088
SHA512 19b606fc024de2a6a32c74a329fc2b09fecd9fc1db807195982749b3346cc4ed6dbfa605218eceecf78394a1dc6a613bc9c1dcafab96d7d420e56938f240e0a4
SSDEEP 12288:5RMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:5qSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3ae036fe047e25bdf865a685952839ecb6ba81d0ec17ec04a478069b27b84aaa
MD5 b9dbad65528c2d11c47a11e4f2c9f0b3
SHA1 bbd59bd4355b0f096986d5767c2bb5af57afd4c7
SHA512 31c5b4ebb5754f00bb2170531f23a11d7a4b16dfffb29640e0b174155ae50e1d16c4689a3485f86ba112d7670f61a31ee26ad80b3e3c96c0f0cfa1e071b4c45d
SSDEEP 12288:iiZwbQzzFEoS2cPvypMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:FZM4zFVSOSSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1e700ce044160a87fc1d61a6bb7f2176d640df0229d97d1d72a73961ce5be0ee
MD5 34c787801c447f9629f8346cd61ced62
SHA1 960cda3b57802b5bb120904483b860467893a0a4
SHA512 25f082a135cb6dcd070bbe4fc0088a13c1f98088d033fed7d95e20603af46638f9c49ef79f3e4c5b0e9873a8ccc45a623a2d55dbba2e561ff9d14873827d685e
SSDEEP 12288:gkMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:gFSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 332f93db51c5d8c8bf70c3660b073c725fc93be77d97c01039da46e565bc3b37
MD5 1b04508950a6ae7a730226215c19267f
SHA1 ae2eedbfa98abfd27c080b47ae367dfc8d1ee26b
SHA512 c1ca308442b116ac4e84a05c2c32ce3a4129a375249f0ec4256948f88bf9628e2cde9e91640b8e3df2c6fe925bc55fe43e3e3bd794f773dfd420d7cec3806fec
SSDEEP 12288:jwMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:jZSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c6fb4af468a9babd481d8e13b5ff12ad48332d79d4be82b923d72394de7172cf
MD5 898c0be4b7f176b723006f987c23a4fa
SHA1 a55a4fbd53b188cd258c206226e8da611d4e9df3
SHA512 5dc70296e6cc09b675067cd4e2c84b1897fdd18bea9580802f5718ec8dc994697e076f9ea354e71cbb5e21f1ed6f093a937987a21ac0073624dac8787b7d7882
SSDEEP 12288:EyPz5L8VMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:dzyGSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9ba50a85e3d06c1602b0e4c53b6b88abc959252c2131724503f296fad3f3c8f2
MD5 048ebdd03257b25f004175d7b84b6cee
SHA1 e243499c2deec9ef00d7e0ebb04ca79608a5993a
SHA512 43f5a1c091f410344cf65a539f703833b1eeb6ea12914260b4b4f60099c9a662c00b2c47ec5da205cd1c11ba54903a962eabb302abc8bf6f57c833eac5cbb7ee
SSDEEP 12288:9kMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:9FSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 279ffab5dea6bce21725ae86ace667bf89e408be631699a292dd92dc2e38410b
MD5 7db277eb2d0f8dcfdac05523923c733e
SHA1 ddeccf1848dcbcdf7b958ed449a53a4b1ce89042
SHA512 75a1b0d818b37e742901004ea1c5f1e96510452716d45aa73af002051799d8e7786c8c71e823b9151f33e25884364b63816e30c9b58cce7d8894b62834c54a95
SSDEEP 12288:AkMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:AFSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 bacfc8acbac84c507fd621dba1a6131c63451294af4714e28f56b6eac0786056
MD5 ae54e317883fbc60b0da9edbaf21ea2b
SHA1 4bc31c7596ccbf24c29a8b2c8155ff01a4438acf
SHA512 9156d9d6c3a10c84b559e75e3663f1dd8e4e01218cc447f4c34c0b5733fb102543b233156486099eed8015232798a802fbfcbe7938d93c6abea03c711d58e4a0
SSDEEP 12288:3yPz5L8VMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:6zyGSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 00bcce1386c4fc48646a72ccff8d1bc3f06177acd2e79ce4ef933989a9e6d7c4
MD5 e008c0a39aaad837b0eb23e9fa23d49c
SHA1 3f648099c44a282191f10ba4cc9cdce97311ff3d
SHA512 683680281161f520c50ba5373d48c1bb14cac2dc6867833348912289b3bb6a8dc2a4c182649afc5f776800055dd15ececa92772e326a5247fe77617321d66746
SSDEEP 12288:jCd9wWYoaLHF3z0z04PDvhDMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:OTpaLl3z0zDgSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 04e964b1ef785eb160f81e9d3cf9057f4204b473bb90180ca52717dd30c6fbca
MD5 c84e01d4c8e0371ffc57c785f00d21e2
SHA1 0c1fd53d4838156e588f944646676907df631fc7
SHA512 e1cdcdbad668b8e65253372feb4f72ca21ef0d621a6504bcc3a19032775590feb7c3560931902867549dcb445a0939494596ea7461ae9fe5748686c2c95108a9
SSDEEP 12288:ni4e7NRdTfgwCHKy7GLbbdIvmMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:n3+d9CHKy7GZMSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d39510849331e565fce29244aac0e2dee9e33864f09b284dac4943cc54cf44f4
MD5 13927de5006c2f26b90cf568bc5c0a62
SHA1 025a5d80421c4fda250b7f12dd8dfbc9b6fad598
SHA512 48db540cb5ac89e6f279ea44d50b0a87b16e9f1593aed4d61f3342a3a9df4924257dd1f26fbd077d780acbd6826b8ed1ae5836c8b21c5b0dc53d9c11ff74903a
SSDEEP 12288:ozMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:oQSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5fdf8306d9e9444bd06d337de10dfb0895404459a7a81290f657bc15323bace8
MD5 040787de4343994f092f8821293621e9
SHA1 0413167f3ed1d9f6bc2061a7c4ef70e5173101a1
SHA512 26a56735f692800681dce08395553ccfd7655331910bcce5b3cf0084e4a59bcc105404bdbeef3002839050a681f5ba75db64fb2237eb8cf0c9d244957973a32c
SSDEEP 12288:k1MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:kmSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4f65a0d162ceb4d7dac2458103e8042018b8a001c2c772f00f14ae82b8075995
MD5 cd5613246b5b78234022e8b8d822f1b0
SHA1 0be88733cf357dc6d22e748742c14adfef28dd7d
SHA512 2aa651e098cdc823b7f42c6c00c8905a01d588c533c6e75d6f266e9fe89ff90f17e2a927f9625f3b0c3e94142f9da9b69d610ac41aed11d21954f7ace1c82ef0
SSDEEP 12288:umMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:uTSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fbf2b58f8af067a54abfc1c59ae553906f5d700dea0154c194938bd31a38d023
MD5 4b17704dae3a84f8e5e5137a2b9d0719
SHA1 16ad37db05f13d3d0566930a6dba190301eacba0
SHA512 752675506031acc76a9c43de944582763caf6b9f821d036f875c2853f08e6e74e3e0ca15a3192387a6e51baa14474a9087706addc85651df1a4d610345ff2352
SSDEEP 12288:8kMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:8FSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 67f875f7ba56c57700e5d2ef5d8e95b50a96746a67db17dbaa2f32dff1522f3c
MD5 22ab1e722ee30903904a6c340ce2acb7
SHA1 ca9a93757214834316622fc0349b91b1c685f6a2
SHA512 ea2a9cf0f436114cc5e3f2ab8a20c4e922d493d4d56fc100109a86bf6b38a0a9665af387fece68a6134dcd6ded84fa77b6b037085499681484e1c87919ab4311
SSDEEP 12288:ezMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:eQSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 730efb447d04399bc98fe797eddf42f3fe71392f40e3b333a094df60ff2228ba
MD5 f7c57d3a3a67fffa26b68e344a826708
SHA1 cd0f4d9469e4a1f23b0acde2fcc2e89b4c37ebf5
SHA512 d94e923223c2b56dfa91ad107a80cd0c9e38d482e72801980a32fbd878d3d3cceec16b39cc5a064a8e7dba09c045e0d82f5f3151c2dafd6c3b8c0ed8001e99a9
SSDEEP 12288:msMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:m9SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a9d8b3749baec70c49b4b9e918a453506bc5cd82689dd4367e5438011232305f
MD5 d6e93adbe92d70bd775d22cc70e61942
SHA1 9ed69e98f80b17145089517c5d0f3813562591b2
SHA512 2612601df49642536f5f0730f84ea62d662d00ac31685bb08292e8ba77cece0988068547359989c4432445a50325d7e3ef71753bc2e0a45b743fcae28910148d
SSDEEP 12288:qyMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:q3SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 de8f823200763e5f9312850b11e10e8d76d2b77bb460a8b9c8a260704399dc7f
MD5 c67a2da2f5f437132bc4deb2a17b7fc5
SHA1 d87bdc1c3c04c3e102556ebe722b94e80f44aa41
SHA512 7d445411f0ba2a8694b0a9468b0ecda2b5946a03cc37c67714402e394f22ea96b19a9d0c7aea7262afc5a3505b8e7276eb798a4992bcf7d3bd266641da4e2ad4
SSDEEP 12288:GUFmDDLXMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:88SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9fbbbeb21f75d54a6e2abdf3ea27d8e20b37a7093a292f3a5d5b68b639cdcd05
MD5 330a5d8fb7ccfad4a7d631de175a025e
SHA1 54ed5edfa1ef605255d6bf18b0c0d69361bf9f12
SHA512 e49395edf0deb8f44f6aaad71fef97f058e6f74bdf6113f5f13525ac461a43770386d81331b651fc33d44165682118a6be2ea9492e97f974de22260dfd7f8e45
SSDEEP 12288:TFMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:T2SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1879e87c72b4af0574a8375d07a720d0987ddd3fcd877b1dc1be39cd889c1edd
MD5 b32b059bbd3fdc06086cd80e213a5630
SHA1 75546bbe93210cc3d5ddd3db758421f2c58370de
SHA512 7d945dabbb5d09547b16c369bff745048ab13f295715449cb427eef0f36bd67574e1a553b830eb6e1853c86abb8abcc8652ffbbd9ebbbea87b7d2dbd9d7e4684
SSDEEP 49152:za0h2GEkuAe73q3pp46zwwQdkQ/qoLEw:za0hNYG4JwEqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 5bb00eaa331b72bf69d0ad30e12dce2956038e1a0e5acddaf202f29f4f6e7015
MD5 666d2d1c5cda8cfbcb7c4b0216fdcce9
SHA1 c9aee75219f29cf70a513cd5e66332333d317863
SHA512 c9185257f0534e3561fa3ce9f2fc20ef1882b6f32c015512b3004bc0a0eb169c3b93baa5aacaf5befab6005657adc3d132775c9934794d3d391d44e5c323bd69
SSDEEP 12288:whbHjfX8MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:whbHjPNSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e9a0fdcbb0639b5185a79fe0c91ad6a283e9bf102d8a5fe3e6054c7ad78bc7a9
MD5 c049179b6482187dd88311f7ba9d4c94
SHA1 ca2303a9ba103600a5a3795abd901d153f3db39b
SHA512 43d31e6daa5c9ec8c743bbee357fb1ddcfab047c568ddb161279f86ca39a3394399eece246096c0381a8804f69f39f4594eaf0456645ea099ea68dedb86d8604
SSDEEP 24576:73YgnJcRTk4yti+R5dpR/lSkQ/7Gb8NLEbeZ:7IgnaTk46ppR/okQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c6143cb1b164f4b216cec67f7baeacc05ce297345c055db3b3c837325d97dbd7
MD5 10aa025e0b48bb9c62007ef7b262913a
SHA1 1c85da48579980702ca06ef823217470a0514241
SHA512 427766f41dcab7d7670514f2accd303ffe7a1c775f8a29940f929f445647b26e03167beefd69ae8e20b1865e06d4b5cbfe0c42526baa9d1fabfad32b8730b972
SSDEEP 12288:CJMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:CySkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 f01cee735195ee3ba97b79e4d5033b0759dc5d0d49f606173cc6800af58d0907
MD5 e548bda592e82a5d044ee50a6a0b1b1a
SHA1 515490760ae18a1502c84b95768ab33d456e636a
SHA512 4aba833253999034d43c89f8f7093c3a74650742005922b7c252e090ce5e2341e95ab677e7cc35f0c020e4e3b65119dff1bf24b591dc8f43bd9eeb2884a3f477
SSDEEP 12288:COb3A4LWOsvAYFTmMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:zTL3UTTSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 cf485b98b3b158f0c241e5029d8b9c4e34dbd6f911b6a7c085a29e24007cde40
MD5 6de949dab70403c76099eff52db77580
SHA1 58b68511d2529d50bfbd63fb9a4a3af625c2713f
SHA512 9661c82bdc7f5fba9ee35dcad84da7f57752bd69158b29b508988131ad0e58308d113d1f0039a879a45e8714770ee10425a65fbf8a6f2f49c493d9696590731c
SSDEEP 12288:ApFtIO6MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:3OvSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 008e0f2f3d10c28413f9b4157a1200179407a19e7ca6c86fdd0157b411f78006
MD5 1b7cda29bf6f2a35cee62782cfb686b1
SHA1 cb93eb4de51aecf4dabc4df28e318b761d807564
SHA512 90caa2ab51917006ecd87eb965bd47bec6c973af208b91da3bff9f3b3d37b589b4b72a2ba1dceb106dd779fc63064733154bfb5111ddff42436a49c8807d2e6c
SSDEEP 24576:s7NM9YmZqmWMUkPjZM48Mv6bEhsGSkQ/7Gb8NLEbeZ:s7cBWMpPjN8DbEhgkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9dbdf594ba660917433e48d6f3fd3018e093e76b6ff74d19a8374f19d95040fa
MD5 9abae910af4245b22d5a8b02fb4dd04b
SHA1 dce692c990af147326f8d0030d464928d03b961f
SHA512 3fd48d6a85fe2877eb75588f6b6c4493519eedafdea27fb7fbff03c48f5da15cc05ed0b5906bf7a0de41ab0dacda692c4708e13cccdffe6680f0edb720995942
SSDEEP 24576:4W6BApg2YuyuNDYTabvcRvNYf8km1oSkQ/7Gb8NLEbeZ:4F2YuHNETovcvNYf8km/kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 4c4d5f7514f5477ce7dd8c979f84205e45a352e773d1cf458d6a2c8da5c8f5bd
MD5 4c79fa2cc0406a95724ca623b5568940
SHA1 8d68515aa084596b072d1faa9fa96853661144b4
SHA512 1c584b3d489bb6e90759e03a349950a2ba4d78566689b7d9bc02ec0a4ce19cdcc13c00c5b4df3d3ceafa597e8ee1cac2ee245463a660fde7947c859a2ddf8bdd
SSDEEP 24576:0AFs06+Omlf3NXEbTo7SkQ/7Gb8NLEbeZ:5Fs060lVXu9kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 0fbba3c29f189e7cbb9b793bd9cf8693237c0bcf68b9f4ca91153b57457a1843
MD5 3c2a105215cb31999a44f9a81a6d28d5
SHA1 140dc421f48d60a6ba68276045c697298d0095af
SHA512 0097736977721b1b3d55ba3f2ca2f13b8f0db4f04b5b65c86ec6e147808f547a03854e3516a7265547102d44be088f37ca4ff6140bd5726e828a43830e90df6f
SSDEEP 12288:dCJnJ5D3Vkrzzx1MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:0JnJ5D3WHESkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c595f3d7f24e73c96045e6aeb5adb3640e215ad6813ba93bf4cb330b9e150eb4
MD5 d7bf2884ef5d308fd79c389af19b406e
SHA1 e9e79e027f2899e211c728753526e8214c34e03a
SHA512 159cd575c0a683dbe8996bb474c4439fec00c2796a27440d732d5ad0fa67fad9f6bffe306643a1b50d66b27136f449f1faef49419400dd54e395376e23c4daf2
SSDEEP 24576:wEPohm6/7IIXdwcXrif7qQncjlP65i3VulSkQ/7Gb8NLEbeZ:Po06DIKdwc+eQnSt65aVzkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 d1879b88c0694fcc922cc0fe6f22cb53c7b57db05c3540aa2fd27250ae391863
MD5 72e0b508d9741cf181904f2d49aff613
SHA1 d2b72f01786c4066860399b297b7eb1a7c8720e8
SHA512 5a0583449a9abae64c9219fe1dc87d0e1340697b30427102bcb164c9c57a7c0dd2f3a38229b7704aea110949dd72900c6a29582a22ea0b352157fb1dc3b60209
SSDEEP 12288:8EP3R1VMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:31GSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 3e6524f107835d6d1a97d0be6cac05adb9bf75def9e9ceca3fe573a087493c37
MD5 d4416f0c1967c3f712e1ae63db9f17df
SHA1 db4cc5d1251f96c9546b9b80ec90a6254897a161
SHA512 78699a03283493c2bde5199c69f2fe678fd07d812a6a4bf72f49b0d6fc565b3a2c4bc5473c4d7742703ab6becfad614320ae41e30b3ab139cf999d683d579f94
SSDEEP 12288:5jkysMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:5Iy9SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 7b91bfc4c2745e1ce64977171165bf6fd6bfc1579210577e8c9d6f8ccd55691d
MD5 8395935d6a761af9d65b67a3c3db3d4d
SHA1 73ca1cbe5f310b54585ef3a41a18c71fc033aa2b
SHA512 54d25c26de324c4ac9d0d91d42f1e872a5f104defe3c16c3968316bd8bcb26aa9006ab4c7cf00462b881f5c85a64bdd4ed43db1386019c64439ba1f2a70e3b06
SSDEEP 12288:MKqMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:1fSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 691b2e73d89751975814d726de5626d725b137fda66d886b8e53975ffd1552f9
MD5 f7bdd77e7143a5d52ee608b9137f8bf7
SHA1 8e17ca06bc52d010c6405ad4d8d7f40449ca718b
SHA512 feafc9dc1780cb18ee5d5f4a777c71f0688c2e2c18ad53b5b3c07078291c74c5f59af994a8b8fe7369b14def27f3f780d1ea715e657300ca38fba43263edf659
SSDEEP 12288:ILQZb3C97GYnZMv5zBcKY97MD3tMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:eQ9MxZKdcz97w3OSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 bf539dbcbebb1d467e0394cea7ffdc5480b03353d2afe8d09af8425ba8eb67e3
MD5 f5593fce0d6c1becc292140aef2f4055
SHA1 6777b08f12cabc00d989ba934844bec66dc216cf
SHA512 2c7a34c53337cc6de7f949c516a64191cb61a986794b002113b15d033113d091d18bca844dbb11f98a549257155af49e418482aeeddb412fbdc08abc7acc82a6
SSDEEP 12288:byoKo2tRple9pQMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:byocvAp5SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e8f35139d15d9176374686d8456f5085fd7ef2d08d5d4ef8c4369350d32c823b
MD5 392edcee91bce5cee4e01b806ac2a9cb
SHA1 f5354d1968490bdd3cd3b08574c7b96d8d8956b5
SHA512 f918ead3214d330d7dd180595ffef9e3ccb86a69f31bb5014e5125040cc8db0edfc3e43f9e31e2e7f7c294aeeaa4991a4c45eb75fadb50acb36d0b6b15115ad0
SSDEEP 49152:7WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKckQ/qoLEw:r0zuNIoqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-402-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/8-617-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1316-413-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/1316-296-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/1384-621-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1384-439-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1864-612-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1864-372-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2100-401-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/2100-285-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/2116-0-0x0000000030000000-0x0000000030167000-memory.dmp

Download

memory/2116-15-0x0000000030000000-0x0000000030167000-memory.dmp

Download

memory/2116-6-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/2116-2-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/2752-390-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2752-616-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2808-433-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/2808-306-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/2940-340-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2940-608-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3132-352-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3132-611-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3152-50-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3152-238-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3152-41-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3152-47-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3552-434-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/3552-620-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/3864-387-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3864-375-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3880-556-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/3880-329-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/4144-72-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4144-66-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4144-75-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4144-239-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4220-414-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4220-618-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4292-25-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4292-234-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4292-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4292-17-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4324-255-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4324-256-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/4324-268-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4360-581-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4360-438-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4360-322-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4492-31-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4492-37-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4492-30-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4492-235-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4552-52-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4552-74-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4552-63-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4552-58-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4552-60-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4728-250-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4728-244-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4728-252-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4728-371-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4928-270-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/4928-389-0x0000000140000000-0x0000000140150000-memory.dmp

Download