51eac80ac9592edee0edc3a35db70024d134d7810e04ceb8c51075d4fb24646a

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
Size

4.6MB
MD5

3044f33b7c7f52204199d5a513561350
SHA1

0cc02c74aac6d75881d53067fe5516c415b1d1ca
SHA256

51eac80ac9592edee0edc3a35db70024d134d7810e04ceb8c51075d4fb24646a
SHA512

9c0e44e7b62e9aedac230c60d34b600fa696efabb65e95c91cbe9496d9e0385b93fb267f904f7796aa66b7d9611438154fd9f07fe69372619d4c39207bfc4c8d
SSDEEP

98304:64+PG8W44ij9RvbGOZUR241QZgC51B+PRPQ8:KPG8W4HhbVURp11CjgJQ8

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 24 IoCs

pid	Process
992	alg.exe
4844	DiagnosticsHub.StandardCollector.Service.exe
5040	fxssvc.exe
2396	elevation_service.exe
3084	elevation_service.exe
2916	maintenanceservice.exe
1776	msdtc.exe
3944	OSE.EXE
3900	PerceptionSimulationService.exe
4080	perfhost.exe
2068	locator.exe
364	SensorDataService.exe
2824	snmptrap.exe
3132	spectrum.exe
3160	ssh-agent.exe
716	TieringEngineService.exe
1668	AgentService.exe
3856	vds.exe
2480	vssvc.exe
3020	wbengine.exe
4424	WmiApSrv.exe
4932	SearchIndexer.exe
3236	VCREDI~2.EXE
3956	msiexec.exe

Loads dropped DLL 2 IoCs

pid	Process
5536	MsiExec.exe
5536	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	VCREDI~2.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\msdtc.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b41a45c3c3136770.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240612094350409.2	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350112.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_a08a3e21.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350128.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350300.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350409.1\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240612094350409.1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA85.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350237.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350300.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350378.0\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240612094350394.0	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350128.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3fea50ad.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350300.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350409.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240612094350128.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350300.0\mfc80KOR.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350300.0\mfc80JPN.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350409.2\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350112.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350300.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350300.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350300.0\mfc80DEU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350128.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3fea50ad.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350409.2\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240612094350237.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240612094350362.0	msiexec.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350128.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350237.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_10d0c3b2.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350237.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350300.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350378.0\8.0.50727.42.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350409.1\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\e57c2e2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC459.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350300.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_661fdcb0.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350112.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_a08a3e21.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350237.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350300.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_661fdcb0.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350362.0\vcomp.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350394.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350128.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350362.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_40f01e47.manifest	msiexec.exe
File created	C:\Windows\Installer\e57c2e6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350362.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_40f01e47.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240612094350378.0	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350237.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_10d0c3b2.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350237.0\mfc80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240612094350300.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350394.0\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240612094350112.0	msiexec.exe
File created	C:\Windows\Installer\e57c2e2.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240612094350409.0\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240612094350409.0	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db6755f7acbcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ee5fcf9acbcda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000466c44faacbcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c3f4ef7acbcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031911ef7acbcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b5750faacbcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb990af8acbcda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000271c8f9acbcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb2b5af7acbcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bff220f7acbcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006bc957f7acbcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E58E8E6B4EC5FF4197F4099C9F9EAA6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\8E58E8E6B4EC5FF4197F4099C9F9EAA6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 3d004e00400055004b002d0024004c00640041004f003f00430033005900210035004d0040004a00560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 3d004e00400055004b002d0024004c00640041004f003f00430033005900210035004d0040004a00560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E58E8E6B4EC5FF4197F4099C9F9EAA6\VC_Redist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E58E8E6B4EC5FF4197F4099C9F9EAA6\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\PackageCode = "824BFCC8DA7C83E44A851335763B00A1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 3d004e00400055004b002d0024004c00640041004f003f00430033005900210035004d0040004a00560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 3d004e00400055004b002d0024004c00640041004f003f00430033005900210035004d0040004a00560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 3d004e00400055004b002d0024004c00640041004f003f00430033005900210035004d0040004a00560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 3d004e00400055004b002d0024004c00640041004f003f00430033005900210035004d0040004a00560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 3d004e00400055004b002d0024004c00640041004f003f00430033005900210035004d0040004a00560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\Version = "134268455"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 3d004e00400055004b002d0024004c00640041004f003f00430033005900210035004d0040004a00560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 3d004e00400055004b002d0024004c00640041004f003f00430033005900210035004d0040004a00560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 3d004e00400055004b002d0024004c00640041004f003f00430033005900210035004d0040004a00560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
3956	msiexec.exe
3956	msiexec.exe
4844	DiagnosticsHub.StandardCollector.Service.exe
4844	DiagnosticsHub.StandardCollector.Service.exe
4844	DiagnosticsHub.StandardCollector.Service.exe
4844	DiagnosticsHub.StandardCollector.Service.exe
4844	DiagnosticsHub.StandardCollector.Service.exe
4844	DiagnosticsHub.StandardCollector.Service.exe
4844	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
Token: SeAuditPrivilege	5040	fxssvc.exe
Token: SeRestorePrivilege	716	TieringEngineService.exe
Token: SeManageVolumePrivilege	716	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1668	AgentService.exe
Token: SeBackupPrivilege	2480	vssvc.exe
Token: SeRestorePrivilege	2480	vssvc.exe
Token: SeAuditPrivilege	2480	vssvc.exe
Token: SeBackupPrivilege	3020	wbengine.exe
Token: SeRestorePrivilege	3020	wbengine.exe
Token: SeSecurityPrivilege	3020	wbengine.exe
Token: 33	4932	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4932	SearchIndexer.exe
Token: SeShutdownPrivilege	1076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1076	msiexec.exe
Token: SeSecurityPrivilege	3956	msiexec.exe
Token: SeCreateTokenPrivilege	1076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1076	msiexec.exe
Token: SeLockMemoryPrivilege	1076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1076	msiexec.exe
Token: SeMachineAccountPrivilege	1076	msiexec.exe
Token: SeTcbPrivilege	1076	msiexec.exe
Token: SeSecurityPrivilege	1076	msiexec.exe
Token: SeTakeOwnershipPrivilege	1076	msiexec.exe
Token: SeLoadDriverPrivilege	1076	msiexec.exe
Token: SeSystemProfilePrivilege	1076	msiexec.exe
Token: SeSystemtimePrivilege	1076	msiexec.exe
Token: SeProfSingleProcessPrivilege	1076	msiexec.exe
Token: SeIncBasePriorityPrivilege	1076	msiexec.exe
Token: SeCreatePagefilePrivilege	1076	msiexec.exe
Token: SeCreatePermanentPrivilege	1076	msiexec.exe
Token: SeBackupPrivilege	1076	msiexec.exe
Token: SeRestorePrivilege	1076	msiexec.exe
Token: SeShutdownPrivilege	1076	msiexec.exe
Token: SeDebugPrivilege	1076	msiexec.exe
Token: SeAuditPrivilege	1076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1076	msiexec.exe
Token: SeChangeNotifyPrivilege	1076	msiexec.exe
Token: SeRemoteShutdownPrivilege	1076	msiexec.exe
Token: SeUndockPrivilege	1076	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1076	msiexec.exe
1076	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4776	4932	SearchIndexer.exe	110
PID 4932 wrote to memory of 4776	4932	SearchIndexer.exe	110
PID 4932 wrote to memory of 2612	4932	SearchIndexer.exe	111
PID 4932 wrote to memory of 2612	4932	SearchIndexer.exe	111
PID 2128 wrote to memory of 3236	2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe	112
PID 2128 wrote to memory of 3236	2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe	112
PID 2128 wrote to memory of 3236	2128	3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe	112
PID 3236 wrote to memory of 1076	3236	VCREDI~2.EXE	113
PID 3236 wrote to memory of 1076	3236	VCREDI~2.EXE	113
PID 3236 wrote to memory of 1076	3236	VCREDI~2.EXE	113
PID 3956 wrote to memory of 5388	3956	msiexec.exe	126
PID 3956 wrote to memory of 5388	3956	msiexec.exe	126
PID 3956 wrote to memory of 5536	3956	msiexec.exe	128
PID 3956 wrote to memory of 5536	3956	msiexec.exe	128
PID 3956 wrote to memory of 5536	3956	msiexec.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3044f33b7c7f52204199d5a513561350_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i vcredist.msi
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1076

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:992

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4328

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2916

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3944

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3900

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4080

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2068

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:364

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2824

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:956

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3160

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:716

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4424

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4776
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2612

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5388
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2AF01B46BEDEEAE5EB55ADA08A235328
  2⤵
  - Loads dropped DLL
  PID:5536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57c2e5.rbs

Filesize
27KB

MD5
b923d1b539caf68421c38921c8ee18cd

SHA1
cb1e3d200aed73db2796601b3364ca9cf4fb9aef

SHA256
51e91d1bff6b11fffd5646d44e1f8321b6bdb93fa5fffef18c5b6bc3beb0f4bc

SHA512
9fb9765bdc533f45bc18702c44f6a6cd2bc7e7a202ce26f914e357a488d5b134671e80fed2ef3310d770bea469eae7f6485868985013a5e0faaf58754b903af7

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
65efe75e2fa86c8535bc2eff179e75d3

SHA1
5c475c59bc68f0cc0f70c458113d67bcd1ae4914

SHA256
63b792c0550871572fa343a61e6499ee90edac0381975496d69a9df82a3d9302

SHA512
5db0b4c8c72c4ca0162c811619b0acf3a46155373bb7184ceb9a67ef917dc6773386ca395dee4a14e1c589b255c3725968031b186e64d89fba1181e80dff0fda

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
797KB

MD5
fe9fb89f3bd271822543eb65a6b39072

SHA1
32e832a051e1bbe346a90d494a4e2fcaa4da3b9a

SHA256
cd946b5940eea5a15bc9defc872398b1f38bcb57019e4c5e8f4d7231ddce9b7e

SHA512
ba0d4645291a0dc155d044d3f510f9005d68750e1f0e106e053e9afef7d2444cb1897f28a3a7e9fede10708b37a0665e175f6b3c0a1923307d830b16bd7869c6

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.1MB

MD5
f7b5ea461b0d61950e5a4efc1b4cc0dd

SHA1
25f8e76ad4b8bd5d8f384c75f47871759ee438ff

SHA256
fc34786c344310d338644bd3d96bf9ddbd0b28cc7073c8d4c10f0116d74251e8

SHA512
df2beed2e838bf27d0314f0f7aeff9e93f74bd30123ebd601dff6a68014466f4fbef689bcf30952795cbf95aaaa880e097138bc047eae18f2d78ffc213dfefef

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
6699bf891516b14f67a023de83611401

SHA1
36fcd2154c9da30b93f2093b8ab00677e6a90106

SHA256
fb8bdeb6bf908dea46bbbc8176fd1b16391a2c7376529cca6b58559b6cb28a4e

SHA512
ded432aa9347054a56522467370becb83b1a4bec500daaaa2be2ed4983fc9457c16fafdead177331864415a8cbd381f688ed8dff720ab3cfe4a97da4f2ff2eaf

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
6a52add6c38d376a198979fc2f128ab8

SHA1
778c9a08142536245e99c93e1f3a5e42b87a35d5

SHA256
63130cc98407cb91ae694f6acea57a617e21016585d4c0a344adde97e1a91f8e

SHA512
51c29e21ea6000030f99564daa6c2d984af2997c0ef4b62017cad4c170b822664ea6eac52db75c957180c6f23aeca10810e8c27443a2cd110317e8b4b0878aa2

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
582KB

MD5
f45f0618fa902823159cda1c871a1a4a

SHA1
973b7c17e7c587890f75d40fe21a7e32198433a9

SHA256
7f94f9fc04da90769bc42f1fb2acfcb9cadc1eb6d99faf49fb4ee5f54f446808

SHA512
584282702d0df75978b6147b9eb0eebf4e01047877530cec5ae6465ae665e183f7e24661f211991f9af6dea881750c4405c645659432341060bb04a26e39a3cc

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
840KB

MD5
f0de8ea5bb8fc27eeef29bae07c581ef

SHA1
ad672306f59783654874befd4b058efa2a189c1d

SHA256
16cbbadad32ea453f341c8ea79d4ff6b50e676f6202e7c829885938c16b29121

SHA512
78bfd5b52387439e69a2e3d9068b82f667ad25dfde2c2bd5010f758f5756b7887627bad1831952efd86eb520ba2ac02459f36607c45cded3a320b5d4079eb3f2

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
45f158ba1cf1f5210163a58b0a2ecfd3

SHA1
0217657de88bc1a2b69b71869b70360b0240f27a

SHA256
fcce67af1de7ac70b444a14adf385da1f0b8f28724417b6a71c300274db331cd

SHA512
5ae18bd29d27e208074e15d3ac4f858efe774ae712612e7974437a382b6d6a8597db289e18f5d1642eba2b955405733a60de46b1c7ff17cf4ee4f8113c0275b3

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
910KB

MD5
de81e9a3925b1b48b2f672de9c1977f4

SHA1
199c185c5c89ace3879d2969e199fa7eb7c5210a

SHA256
66d3024a6e9c90c9ddfb2839ebaacc26b58bbcdac4f79a1efb4fdf09f71d79a9

SHA512
469c4a0f0a93415ae47a962ec92aa64b62836c4d89a16b130bbf9076344c95e15342d6ba07acf33cc28a254edaf016bc0714fdab8368a6cd4e72159d3fca3da0

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
88cb6489b0e7d919d881f8e1a20aa8d5

SHA1
83f4f9899725d5aa877c11486a492fca3ee800dc

SHA256
e28f156ffd725cd5387c0b6170c5d4b887243019ae1c245eb6c65041f5cc70e6

SHA512
f80c9b8f483dd7d78cb7e73dc44e9c25eeaee6f847c99d62fab968237ce5657807833706cea8f260dc34006df511a287c015e966520f168b8121fe2d5f98c801

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
2ed4c1c6180cfc067222cbebb0fd447e

SHA1
3c4ead5a70d6b27e51135d120ed0e9ef617aff7a

SHA256
da3d4698207a3c29c28d7005d0ca9fe58742b998d8ccfce129410a3708713b2a

SHA512
fb9a177185d50bdbe5a4f5a2e2e4c65fe191fc8dab319ce4a7cccd37b5f9a9d7092c720df620290204a4e1a630b00d00f13cdd766178cd1b883bb090f1d08b23

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
cfef6abf845aced507d7ca1c3d910fa8

SHA1
28e6880d0e6679c82823cb5351d24700ca35752b

SHA256
fb73cc1af6fd740a4c91b40301e73aa16f2af2b45b8b1cc5bea65335c2625a6c

SHA512
42f2cfa5e710b0b6cc4dca7fbc3b5ac74bafe0b041f9fb1b7d02d3c3e3e5cfbbd8f2ff5b5feebfc3cff67b3994e46498614b13711dbbe62e8290cea12a43f9bc

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
cd6a36a5562864b09bac1a0c115965c6

SHA1
a7367bc9be4cb80af27d1a32d22c3e513dcd8f82

SHA256
72f869925a8c8ee4a7eba694d65896e6ec663f3c2f96d11fd03309f712ae6755

SHA512
7c6aebc06291d7be8053eacf0bdaa5d241503f086c28cc2a4b2a0b9df7cfec5aa8f3d6531f5f7b4c1a6465f41cf9199a9f06778377510de41f9a592ce9f3ce51

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
656KB

MD5
b4fa59771d570a78d7f1c04ad5e74676

SHA1
9202e9da9d13e21dadb538a075434e085d6c4b1d

SHA256
cb9f1ae9f1b059ac39f77b04a5245a614e5f98220edd0e94d744b09f647dd8d2

SHA512
7ba84b7697cd13d1c652bdadacdb3fd52563cc3855df390d34ef86203f5242a3d1a6da3ab02d00b506ef075d8277d3e73344a1ebe419a13222b90cba44207125

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

Filesize
5.4MB

MD5
524cae7014b543db1238c390c71eb756

SHA1
373037914862a8861daf26328b7856b7e8cdd52b

SHA256
b07b40c1f5197d637086f6b5b8c80290aeb761159480f39a53a78aa72b9cdb96

SHA512
d6142a36104e0af899969cccd4683f160e6c70e73c9cac20d51d16ea861a378d1232951e3e3b6a42abf98a462506aaa199406b4349ef5c493da7a4b7a3df4f5f

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

Filesize
5.4MB

MD5
ea032be2ae9a654089098bb9a55c1e17

SHA1
afcedbcb1c447d2c1cea1e6565e71343d6b7ab99

SHA256
e2e2c4f13f1a9e4c3ec176ce02f99c1698d323bfcc38c8126fdb37161330bc5a

SHA512
ec254dc9f8ad10cb2391babc478347392530c5c6381f30cd3858b64439fdd6e415acff2e919271210a51970645a8d8b79617e8a7acee8f99d1eceea766b80af6

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

Filesize
2.0MB

MD5
cf84b395bfec8aae79d2576a9c79fbab

SHA1
7b4d091cab5c97659885f8043b52704669e94dd8

SHA256
60631cc0db20caccc7fe8f0c5032111f36384d7d56e319372c02c4c15b96a288

SHA512
34a8a8233dd59b9474413fdc1b7077bae1961cee25e76a3c59011900426b880b9986cb3d3a5c9b784a2ea8273b54b09725c7d1a93bbc2bc7891ac50c535dbc0d

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

Filesize
2.2MB

MD5
aec98d19ca2b7088eff810f6b5476123

SHA1
0db999d91824189dbcccec890c1000dd57b8e65e

SHA256
8431658b3da0dad66c3bc7063b0d7d6e5f00f6376e03bde718beac260421a7ce

SHA512
02304fa1b1fc70cd6693e991df8d75f4721a73c15517e8fc5169e0a4d4c04e58a47af5afa2934d079151c0594f2d67dd538cfcc3d963016b9f9cf35e5c307439

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

Filesize
1.8MB

MD5
42d4e7271b2f46a2798eab3c5f5c51f2

SHA1
541fe1cc117e782002e5fb1cc74304a6ed6ea86f

SHA256
da24b8b6c9b185de3e8ae13f3b483e76f0bdf7f4ae085490c62076c356e3fb72

SHA512
78143aea5926efc6c186c373cb0c453fef755c7f26edbbffdd1aff2084c26435f17b942d57873f9f911171bf5a364f55686d3bcc0f9c770aa64ad465239242c5

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.7MB

MD5
d0e67f8e35b4c4de2b342c93441afaf5

SHA1
524e19661511b0a7f70e9e424224f267b7340ad4

SHA256
eab1f26a5354fc7ee8471c5d8e98a8a4f44041f5b8ff76b8fef6750b672dc8b0

SHA512
490ad75ab3901254287d2786e129bb16ede4ab481bfa5b31d1a536cac6d01a58a39effd71b88ae751b91cddde9eedd890768f0ca5e6cbef6e1136971f2d6a20c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
581KB

MD5
2b662f46198bb70e4db75cddfe21162f

SHA1
3b1cbbd0f70ffb92c3a59930bc8b4335e089a7ef

SHA256
bbe2047460bd6ce61e132270f1f9cbf165d0dbcaa6a1acb893226acf6236268c

SHA512
6032fdfefaa65af8623ab7cb3a0738a23403c00f75f5e9c2f0a2a57bc229172941d695d5e8378b4d9c20370187b791b887ee030ca86c05dd323cb266a7a83a57

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
581KB

MD5
cec44e0dfec53e062c6228858f096354

SHA1
fcbf2ba3d132d516f48f9de30acf0a0e4728879c

SHA256
6603674d3b604663b5959448644b36eaa77ecc941d6bbf9354acd3da32f60b55

SHA512
4284ebe3cadbe899e1691366644067177f62a4e926c46fbeb5d52e9af622ce78c4242afa6f3ef9cce469c22181a6739c1ec997602788a463e2ef0bd8b8a58e10

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
581KB

MD5
53ff2d11c7b64206b120bb9d9ca100ce

SHA1
06d13971ddb7d8d6a20c9af8a5ff972ffbef60d4

SHA256
0d5a6c8efca8f6930024add7b119c95d0b34a6dc976d9ad7bae1eef686fd49c3

SHA512
d3464559131226a35684e114e661844c8a0663b669cbd208a151e72f264119a9dda5c347f79b964670bdceb40f3b665c6a7bb63c7da9ac3e1e579aebbe67980c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
601KB

MD5
5c997c7ac6ad8352899c240a89294741

SHA1
dfdadac365d5742963183466a19510f4a4a1d1f7

SHA256
37bb110ce477601514e1b9b4d82ab0a9199cc4ac11705c5b97962d470b0b1951

SHA512
a50d61a67e3a4d7ea8e28ef32f2c061806cd566b26eaa6701a7e9cfbdcfad416939d6dd79e7019667aef0d2e6a8758737852119a684da29cbe0c6d9391882cf3

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
581KB

MD5
0fbafb17b59a3718f8e6a533834f4414

SHA1
de936acffb153a6e4b80e2bf5f30b6826066ac7c

SHA256
31333e4aa942a114dc81da839f8e985b2e87102df4d8b6152fec29f28b4b6c16

SHA512
4d1b81eaacb394e113f6b841c71e0047d87f9fe7869ad0f4ff1574eb7cf44791898ef90794e244451a66a86eb0d20bc45e4bfd38f565c80d24737f6930c107e3

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
581KB

MD5
baf349c4498148ee967ae344a397414a

SHA1
3e3c242e3177e2854ea673355d164bb347624368

SHA256
a9c0a4cbe30aefa77fb4ccd8fc2c580fca8c4b0838d254f7d8f45d2db102e0ad

SHA512
231d1002ca42cbde0fb88e9c5c18b31638642bc536f13eeb76ea9c8ad3d1b3ed4e6813b226e0e1e2b443ccc2519a012332f9223e18d9440c72ea5460f13ddb20

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
ce7462ef411e8ef3f8d0f2c784981e47

SHA1
09586310760285aece374c5bc98e84c4e7888a4d

SHA256
b729802ccc180ccea2347efbf2b23fd2b8d4e1ac7076713b214c5d53411a3b04

SHA512
4ff9c5f2b3e0386f9d0b8a3c1bb3d5c22baa2bfb7946f23764ddb31c27bd2dea0b90cc47dd2b66e93f53ff57e8532014f56a95b8083916675a6b667939029157

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
701KB

MD5
91f34751cc12e2d8dd71a54849ff5263

SHA1
7ebd0ff2af27dff4460ee34fe6bd9f216d31f28e

SHA256
c3c7b73ded5cb38a9a4782a469b4c22d4fd6793b04b4f52a0cf43a930774e312

SHA512
96065036fd3b49baa43bce86d061204e31d49f5b52236222773c910621fb0c04009364a996afd911bee1ad6e26c8d3f25e7936e6c909b73b1d32c9757fe57082

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE

Filesize
4.1MB

MD5
45109081338654c25e42aea404b7d40c

SHA1
7474003f1dffb4439381cb628ded660d28a41bdd

SHA256
00fbdecf2f47d72cdd20a60d685d5d0f56e1f5ec571a7e43eebe1b178285eb76

SHA512
cb89ea354aacf4560ab59ccbf1ae5f9d4913b0b4b6130bdaeb6f8eced7844c416875d0303e0f141165ca1681f6b9728d46a96fa44b3a2eb45616d904658179e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab

Filesize
309KB

MD5
1f759e1b809cc291bbea00b43c6e9f74

SHA1
4038059d53fd925a9142642bbfd800e196ed888f

SHA256
044969556a9ff7bfeb95cf1cc30fee41e57417814192749a6e7b2820ea1803c8

SHA512
23682155c290c46c4673a80b6775f9e92ba1c855c4609454ed258d23f7a97cd5adff3a709a7348759755aeb941b71f4f13c7cd7288be4270aa772ef679774fdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi

Filesize
3.8MB

MD5
fa135204bb6146fca799cf06d30c444c

SHA1
774b9fd7ca76502ae6c732432377d71dfd75a15a

SHA256
cd7eb3fe76c008e2af85cab033f620e04e22af941797083a5fb51e269bb8fcbb

SHA512
b2c20573b92766353db601a31d4409397fd5de3a32f9bde4b3e627b48c5b859d33c93f96ecb0c177eb16768f5dd744394857a078a7302fdf0f0e4f5d2543b73a

Download Submit
C:\Windows\Installer\MSIC459.tmp

Filesize
24KB

MD5
7bfa56d222ecc4267e10c01462c6d0d9

SHA1
9b3236a45673ff3bb89df3e690784b673ae02038

SHA256
6eeb255e1d5333a7b4f1b62e36afa1bea5cfd6c7e32058bb3a9efebc4d9f2ad6

SHA512
10cec6bfd08a8b7cac1acbc3627cb014554ba71f44eb4bfe5b1471b81d6d292fd83a352d553af0de75fc1668a1f13d7f6f6c7bf1c6524117f363a3a7fc9b09e9

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
aed9c7c77d1d16767f71ee5b3b66072c

SHA1
2b7e039047dd292c42a805e8f7ec54873845ffc0

SHA256
c223e71c869df4d09a3c4dd457f9e74ee7c9906345f20a10582e954eef6f5329

SHA512
575123dfe6d7fe36d701f9b054899dafdf094da6a53b2cb85a1e3a9b30e03e732ad44f722253625086c8bb9d6b34f011bd243cf5a7d29cf7d7cfa1b698c28304

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
aeb56365ad5585f06781886ee9912861

SHA1
aff0bcc8b6d7e1fbf746b2f58d0683c44b328390

SHA256
50ccd4b36b68cec158b867c0df404aca71933a25352e9be562df98aa15f53723

SHA512
df568a3a5d8cd6367370f4bdd4a097316792c756d909d5d16ab663419725b965bf5292156aa6ff47ad82298ecc4ce5328848b619ffcedb349269b90c63438e0a

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
f13391393e1ad6fd381b3ad600963f31

SHA1
d870754749af418713971d7b26c609408a3503ba

SHA256
4633d50549f26088b644419963c74ca4661af7175bd9d4859ba44be21599a910

SHA512
70490c0d2efece21cf3c7fce6ddb22f39417749b8804addf6dc0436cdadb5e1f54b857ec6d6cde885d2fecad7a17e3a3cba6836a7dd4506d899ac57178f88432

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
e70834a46d5509544d9943929466c10e

SHA1
f2f37ab6e882966e19756908b11b86c38257786d

SHA256
098005047ceaf21b4313c28349ac246459287cc2494a2dd6f5bc5cee6e8a06e5

SHA512
7e222e317938ca6c6d639d4ebd20196c0cf53022a126d9f14298101dfdce04fde8bacfe06e272142947cbb45d60d93e1e92e92ffc9d542cb65ad9d589a1d444f

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
bd2958cc11e8937d94ce03b4bc702484

SHA1
11773a8e809d6699a8a1cac4e54738eef6d9f26b

SHA256
546e61c95d06197ff740a141064d104332805eeecdc762d19811d0933b10cce3

SHA512
067c3665fe5d06f55d5be39b70584237b17ec573b3ee17c96548aa5d3bdb5f8457deaa264b357c29f8d8d4920726d9253900fc75606eb4154952167b1d409c8c

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
d6778dba19459274579ffb23c56bb719

SHA1
db8f2187ad4bedc75419a306d0491aa5f0256539

SHA256
a9db402a78e06e9790e69da36ce20cb6ff6fabe9cfb8dffc9a1c70122a4a461e

SHA512
21a859ac59a50c35dadf8d0b9948ac41c9a7075bee84682b69842a00f3afd381dd049c58aa838ca8d25215523982762a7d7c35f4ef280fa7e8199e089aeb9af2

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
7a45ca1ce4193f678ed567a62a7fd7d8

SHA1
7a434c2a526cdcfcbc80d60a8580ef951a2480b1

SHA256
ab8739e70d3e940712bffff53ab64dbf65fd0f7e9e5d45b7ee488c177b7f3868

SHA512
f1f717210871134cd6be656a6b8fb2249b046ab75d539a52ee153a29022ed4d8208155dd05e591227e451c6ed4f15253ec946176d96dab3d32a410bf43ad082b

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
6f44a7d83840cd9330df3099e32ab1a7

SHA1
71c68bee614c63bbb6d637502bc9e522619e22b4

SHA256
849f505b6f3808a04c1335e4f2184dbd76532ea7736f20d76ed2b0afb2f0ee73

SHA512
5d44855ae993814859f82833618613b2be0b6aa3fc6b92d2cf96eb5c14ddc9032f8906878a0f4753baff2bfe83064a6e33959fc3351f898b91a3cac73a711d77

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
cff858b53a625b43142be56621a84143

SHA1
e52b72726fdb82f130854ddf205996ce2c9bd66c

SHA256
cac4d08b405c8a266db26d4e812945c439813d0851e9270b95a72cbe013b853b

SHA512
7030cca2426c35da2e6bf01911632cf018db12a0a39b5a96a0913285a6daa622dea4ea1ed72a23cb0bc90a99640cf1b80be23e93f0d72e45925fec301b284002

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
bb85a225b0844f8c0b3a601413a6b747

SHA1
9ac27edef430b47def7450c3b81bc8a8f0e54f1a

SHA256
225782e561cc0f777fa23221b9a0188e580e0fe4d71694db134f93bfb06a7374

SHA512
5a8161b97d219ad949ae1823d0d1fe930532d47fbec36579a7874af4a23fd5704df5303c8798562fdfc46228109c4ce33fcbabde47e2d50da8c280d4a0ece3fa

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
444589a7543a0717b1d06e692a59f4a2

SHA1
3673977a2f3ab020b958caa3ca90193889bbdd14

SHA256
31d8fb15618ff72e6aa865f00ae977d646452df954d613055e05bf134f3b8e86

SHA512
e89031d0796e124626bbb1310300bfd19bb0519faa5a1f041f07332d30ba847b2bca0cffc87cf629c00259396a221943b98ba205e950f212bf4e89bdb94c2bfe

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
9d6aa448bc405da33a36b59864868fe9

SHA1
c651b1263dd35faa5adb893a51b59ad5f5243efa

SHA256
6568f9c8500e5e3ff90f50f55c13a1a3225bdc578a8f228741515608bec9b8bf

SHA512
fd8a07a206832c4b0341288f1e73bc7abecd94459de7409fce3fb257437a1813e961388fc6deba545d0679c1ae1e8ff6ea79503d0f2a0ac2a5dd885ad1040158

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
71c6f62525dd66575d339f0b13eaf883

SHA1
9139401a318d3c62265f31b0dd0c15314edbdbd5

SHA256
e91130330c77b912c86ae7cc86caca8bc197ccf99c2b833661cf621ecb7f62b4

SHA512
4ff05734a2ce3097f206a610e9e1e73d8ac32533de581e2ddcdd9ae4cc0b50c2759aa6d8c9f397efb3c2b53d4507717c8d58a5f2ff0fb0171b9e4cb5977cbc66

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
aa2bd606626267ba990ab287d3a91162

SHA1
6c7099227f85197eb0a3cf1362011ecd8fa74f62

SHA256
456620ed94683a8a997ee52282df05842270102dcf3df554a109d8bce5d64057

SHA512
f9e8fa17fd3951f00fc94a3e4019e89480a74779e80d017b4f70da8059276b411711544d5b9b261a63edefaad3ac49d56a18e5f99d5398b0af01c30d7b81860c

Download Submit
C:\Windows\System32\msiexec.exe

Filesize
635KB

MD5
07062bdc2a4f5fdc9fb536535fe0b7c3

SHA1
b77fd37c969dfa7a204d480f730de8756ee364eb

SHA256
98d458766547babe94fa4d896ad2229bef945e18635f97baa8b6eacdadf0a4c8

SHA512
f7313cf620f3ea91e543a36f168453345678f783a25758a4358d1ff73f5e973e052bc968a77bb2d3586d4a41614a79f04c503d00dc86482db63bbfc673b257d8

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
95d924095e9e72a30bd7bc914cba296b

SHA1
155cefd9b617946e422732280fbc04db2012d86d

SHA256
4d077b25b52e01d0d656645d06a4364b906919b6275cc364bcfec2a9c46bad33

SHA512
405c69e5b61f150ba6669c4712d43ebf0ce6f1e1bd063f8a493920d94a975947ca1a4dd42084c9c4ddda9ecc3acaa4a3f64b11f281cb393cc486ce0c2da2b544

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
9dfbac8bd799805371e779489237b19c

SHA1
8c26119d31fbec0b574a893e63bdd5e0cb980273

SHA256
1a4e4ab5aaf436845fdd5ac6734c85a4423566e63d4842a950c2384a06ecc211

SHA512
c88a50ba0f0b25c2a71a9310e191441f6d2f4ef4659d570fad8719467c8f42bfd9c57fda70cacd758890c0de4ed991d83603df9f0a6e6eac2fce8dc1fad0db5a

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
bf538595b26d615a1ffd0d3115690a72

SHA1
5f52edd777c3d38c6af8158f288f688812cf98e5

SHA256
cb125e2557e449098e8d6d78107a65267b72ec0b1fe96e2d23310dd7c1c61838

SHA512
2ed99ca35712bc1458565bdc4a7fe2a6969c335f637e88a9595dc02c133b78514fcccc2ddb0d07d41ba430e248f062cd13caaaac07c832292954029b01a9837f

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
72e9529f122e2d79a60f8e2c45cb07f1

SHA1
81766df02e81dea9490a66fa9b24c4f14996f10d

SHA256
3302c1305af3ce7cd65afd5182fc3fa0942f6860551f5476c14df071e5fab291

SHA512
97be3b9b18d1547a9810b28cbb837a3f00202461de0835db8d8a535400bea9f9e5077516a81d494675d82d2c2b9acc35db4a5e77aa74e0c598a1002b487b9e35

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
72d4b70bf2f212a62671a781a7dcb3cd

SHA1
6bacd81c760a9c9f2d6a54d12be1d135245dce29

SHA256
81dafbcc179e521958aaef01808dd07140c672de1631b103c2983a33ec223224

SHA512
c0caed46113ac3e4330673e5cfd88ee7191691d8fd748af1faf97575a4c38204a0279adf351830f10069d681dd638170dcec848c05555e643293e393fa97da9e

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
877KB

MD5
6b44d94a641152c1f0d0a4f0daf3f6e5

SHA1
4c2903b59822382ed16e102074f2cae6f74366c4

SHA256
120be8572e0133783680f5be899a89ae219e9b11145a6647c7097cd8f746ad21

SHA512
2f4a86a3b1f789bcc230ef4c85412bed251120757b53615a56a6e4a3296213e8655209f3dcabcb9b95a06766641d3056bc38818b54929ea289d71f0c315c8606

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
a3763fc71a623c6e7910592b7119d0f8

SHA1
080169466458aa228028dcfb5067aa9cbe4679d8

SHA256
b833cb6c417fabdfce3d04b3ae54c65c1444ecfc687f7502c32617b20138ff01

SHA512
ec1765920c3c565c92c4fa0fe5f92f94ddc8475821081c26fd4910b580b2c6f2f8dc63d060df8dc1a1aaa6f00d184d2b3ccc06e1ae22a68539fa567dc1ce1296

Download Submit
\??\Volume{8a2a71c9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bd130511-3906-4a61-974f-90a9e6cf7026}_OnDiskSnapshotProp

Filesize
6KB

MD5
9d525ea836078c3e283a3dab82998769

SHA1
c9b3f392679277d7a84790a23165a9896df0f388

SHA256
18f88f45a3e04fbf5b1c661f0829ae90c8734bfc9469517f8685d70586f01d23

SHA512
136bc7fd7d1cd918889c875daff99f672620dc32ae2ea3b6247e64c0d37f1411f4f444b581b21b2865034a8550c8f568da45ace055bd3442cb51330f672a58f5

Download Submit
memory/364-149-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/364-552-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/364-270-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/716-570-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/716-197-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/992-18-0x00000000006D0000-0x0000000000730000-memory.dmp

Filesize
384KB

Download
memory/992-11-0x00000000006D0000-0x0000000000730000-memory.dmp

Filesize
384KB

Download
memory/992-19-0x00000000006D0000-0x0000000000730000-memory.dmp

Filesize
384KB

Download
memory/992-17-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/992-126-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/1668-220-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/1668-208-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/1776-99-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/1776-88-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Filesize
384KB

Download
memory/2068-257-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/2068-138-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/2128-0-0x0000000000650000-0x00000000006B7000-memory.dmp

Filesize
412KB

Download
memory/2128-748-0x0000000001000000-0x00000000014A6000-memory.dmp

Filesize
4.6MB

Download
memory/2128-98-0x0000000001000000-0x00000000014A6000-memory.dmp

Filesize
4.6MB

Download
memory/2128-5-0x0000000000650000-0x00000000006B7000-memory.dmp

Filesize
412KB

Download
memory/2128-7-0x0000000001000000-0x00000000014A6000-memory.dmp

Filesize
4.6MB

Download
memory/2396-48-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Filesize
384KB

Download
memory/2396-54-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Filesize
384KB

Download
memory/2396-56-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/2396-172-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/2480-574-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2480-234-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2824-439-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/2824-167-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/2916-73-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Filesize
384KB

Download
memory/2916-79-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Filesize
384KB

Download
memory/2916-81-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2916-85-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Filesize
384KB

Download
memory/2916-87-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/3020-246-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/3020-584-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/3084-185-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3084-62-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3084-67-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3084-69-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3132-529-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3132-173-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3160-194-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/3160-569-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/3856-223-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3856-571-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3900-124-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/3944-101-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/3944-222-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/3956-768-0x0000000140000000-0x00000001400A5000-memory.dmp

Filesize
660KB

Download
memory/3956-575-0x0000000140000000-0x00000001400A5000-memory.dmp

Filesize
660KB

Download
memory/4080-245-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4080-128-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4424-258-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/4424-587-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/4844-31-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/4844-34-0x00000000006C0000-0x0000000000720000-memory.dmp

Filesize
384KB

Download
memory/4844-32-0x00000000006C0000-0x0000000000720000-memory.dmp

Filesize
384KB

Download
memory/4844-25-0x00000000006C0000-0x0000000000720000-memory.dmp

Filesize
384KB

Download
memory/4844-127-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/4932-271-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/4932-588-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/5040-43-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/5040-47-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/5040-59-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/5040-57-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/5040-37-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download