3a7201d226876ab8c960abb2f1b58d1e16892af8e1c756adb5cf0b577a9d48f0

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
Size 1.5MB
Sample240613-1edrdavckk
SHA256 3a7201d226876ab8c960abb2f1b58d1e16892af8e1c756adb5cf0b577a9d48f0
MD5 88ddf643d1f87e44ae5b6769fbfb48a0
SHA1 8a2e5caf83cf7f89b1942082d13dccec7c44e7a2
SHA512 28da2057c7a98c106fb24dd49b68d3e225e15e886046cfbe970536b73fbe00614c1670ad84c1a47cef67e0b3e9a799b95fdb4e01eb963d676c3b90d9092b5af8
SSDEEP 49152:cDmZio+wLYxJYIJTcIU3fWbM/snji6attJM:cDmZuwLYxejEnW6at
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2384	alg.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
3776	fxssvc.exe
4644	elevation_service.exe
3756	elevation_service.exe
4364	maintenanceservice.exe
1252	msdtc.exe
548	OSE.EXE
1724	PerceptionSimulationService.exe
2584	perfhost.exe
1720	locator.exe
3300	SensorDataService.exe
3440	snmptrap.exe
1048	spectrum.exe
5000	ssh-agent.exe
3372	TieringEngineService.exe
2568	AgentService.exe
1396	vds.exe
4436	vssvc.exe
2804	wbengine.exe
5116	WmiApSrv.exe
4824	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\80d8b3f5293b476c.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009793995ad9bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fbf0bd5cd9bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb5f035ad9bdda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d870355ad9bdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092991d5ad9bdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063fb1f5ad9bdda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077fa3e5ad9bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092991d5ad9bdda01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2408	DiagnosticsHub.StandardCollector.Service.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
2408	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3904	88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
Token: SeAuditPrivilege	3776	fxssvc.exe
Token: SeRestorePrivilege	3372	TieringEngineService.exe
Token: SeManageVolumePrivilege	3372	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2568	AgentService.exe
Token: SeBackupPrivilege	4436	vssvc.exe
Token: SeRestorePrivilege	4436	vssvc.exe
Token: SeAuditPrivilege	4436	vssvc.exe
Token: SeBackupPrivilege	2804	wbengine.exe
Token: SeRestorePrivilege	2804	wbengine.exe
Token: SeSecurityPrivilege	2804	wbengine.exe
Token: 33	4824	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeDebugPrivilege	2384	alg.exe
Token: SeDebugPrivilege	2384	alg.exe
Token: SeDebugPrivilege	2384	alg.exe
Token: SeDebugPrivilege	2408	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1496	4824	SearchIndexer.exe	112
PID 4824 wrote to memory of 1496	4824	SearchIndexer.exe	112
PID 4824 wrote to memory of 3480	4824	SearchIndexer.exe	113
PID 4824 wrote to memory of 3480	4824	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1208

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3756

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4364

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1252

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1724

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1720

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3300

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3440

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1048

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2404

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3372

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1396

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5116

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1496
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900
  2⤵
  - Modifies data under HKEY_USERS
  PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 ad3c3427b28667bda51a7d4f971e7e7c349b65ed6818344c28854ac6cc1967ba
MD5 1914a00f9818eb8a1a4ca7e13dde0036
SHA1 e51525ccb7823be805abf808b9c0b75c62cff11e
SHA512 1a064b58e2616296db0667f0c721114de41acb9f84fc3c522f32fc3cf8e9dc31b49a968e147c013f7e95ab6db67d1b53a40066488b6c5da983e19279d7264a16
SSDEEP 49152:guYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5+/snji6attJM:gPfTqi90bKEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 af700e96e6cae19161da6a6310f7d80b77b13fb4bae8039f70a1e7f8fbcc5c0b
MD5 e477bc9fbfe86b4a88c1c595318ab7cd
SHA1 dc6e33a396c8249db8d9cbdcf248d9dfe66b95f8
SHA512 c6c2b777be7e307aaf91a8c2087f116c2fa520ff14efe7de1dd89eec63e4935912b79f77f1d689fedf1c9f2fd75f202ec46c255240b6561eca5f9f4957adcdb3
SSDEEP 12288:9cQiQmNJLBsunEEGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:FidnBsuELt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0229513b56640c5f513d9425ce84576e684b6dd8bb2a447979241fe28a1ba250
MD5 9c4f0633b31b9713d856eef864d1e42b
SHA1 402d448b607c7bef4b85576ef8e3c6165ebdce8a
SHA512 20fe75cf1fe830234f83fcee2c019a1464d66a6c04fea8d2210255b292289a167daeb7bc1b83a6b397d97d9dcb0aca04ab6777153dd11b396035608ebfda2e98
SSDEEP 24576:Y+gkEVfh4Covt/sBlDqgZQd6XKtiMJYiPU:FgkExSf/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d1c232c74c68977a0c1ecd6f95c2cc9eb3790f7a8d049e231c100344b03c09dc
MD5 7dca60f1f21370e1bda6c70f9c9db165
SHA1 a1f510445dd6c093f26c61efacda126bba6ceb2e
SHA512 3f21d9589649a840c9ce1835f8aa273fee50d02c6b4a426ab43a55aa3788f32f2d0d432513537fdc712883e50b826e4bcef242484f9e558853cfe78c82c2cd00
SSDEEP 24576:BBpDRmi78gkPXlyo0GxjrIt/sBlDqgZQd6XKtiMJYiPU:TNRmi78gkPX4o0Gxje/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1a04e26b7544a1151a3c7e314419b7495de1cad8db1064b5afe6f4bc4eb9b0d9
MD5 e6fd8d299d50ed00f270c8e3fc6a13e0
SHA1 4b0c3d65424f1d161a62fb494fa5c04dd636ea31
SHA512 09a646393e6ef181e8346acef1055e6f75e877bad2a33419d776ca14703a0865cb266248201d2125527073c583e2509e16e6910fb22363cae30d51c08cd3f870
SSDEEP 24576:wLOS2oyPIXVvt/sBlDqgZQd6XKtiMJYiPU:o/ym/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 421feda211b2fb671d72d5e8e33ef1de019763e883ac57313626ba677efee42e
MD5 dd4047b39dc39c8f490d3253482133cc
SHA1 bb4953be03fae680f8b2d3078fa27232aa0d5200
SHA512 496fde5fb8f13447b749d5a941869be90ff2b1bffbfc67c985ba4e536fcfa6825bb29f9efc471509eac173ac0e72a2df1f404ce6592a73b9b0bafdd8a14f4ff3
SSDEEP 12288:qfKGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:qfNt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 24fe31c7b78ffb89c9a4d8e044eeb1d3015082ffa276f23b086e8de610818f78
MD5 d24a587d9ebc66db353e2a558b132533
SHA1 47c997099af34caf9c4f57b99ce0c6bf2e8f25f7
SHA512 b1b8061684eac6597ea4b2cb583138ca965178d23349a8b226470092db30fbc1f5434919d50e7a63676e19e04b55205f2e002b9359b2a7fa535d5e38aad942ee
SSDEEP 12288:EeBNUbTVO86UfGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:EJIUet/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 feca5bfbc6a8ee1699b6f27d35729459d5463978be3e196d1220719eb544eb11
MD5 49f9ba7fb92d6f139e46a459bc2d4259
SHA1 0773471aa7ba6ed4ffdac6a21163165e0eee1711
SHA512 ad1ded0d0a2e370f34031bb8cfd985bacedaaa0984595da3449e543db1f51b74a5f149b17c14bf6add984508119dda94f9e50c8e50083631e00621b9400427cc
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THB:FQvGAdlCEL8c/yRNw5CJEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 fd38a58f04a1e2cc5832635a7d0396dc03545f7d407ec8ae126356d287a826d9
MD5 da111597e960695136db1c9ff3f63175
SHA1 696a924a477acda1661c8dbfd982656beaf81af8
SHA512 7f40cad29a85f5befd26cd14e732f064e106d685fa550e208d04504b36806de28923cf8a3532b64d7eebd434a1c9b72e07ed8598fcef7c0116260c3df3d991da
SSDEEP 12288:jAwSfxL/2Dc34DLLmt0LDQewsAjdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5+:cdewsAjgt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ed42c3b63fef5f8e9591d3a522012e656fcac90270ad00cd3f9dd6359df117d2
MD5 23021baed34450e6df498e1440837b46
SHA1 8cdecf0cd0dcae6bece6bdf84240d6d167bef3b1
SHA512 cb12a2e8281a0e128653bd679d7888843e57068a06f490ff316bad392ff43f11f07a80e82d07a092dfb5de51f955393617f953499affeff6dd05b81638528037
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHRnW9:iUEtQevvqc2W1cpV2EI32R
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 784c74387a427c8f6cc7f863a8a0687a170fae2648adc33bc8939f43438af534
MD5 c081741c63732d2772572712f6496267
SHA1 7b6096120dca88b8c61f34ed88cbd84ee3659e43
SHA512 f6ee53509957c4359a0c88c3959dd40108c6202ffa423ef2faf03f2b08e91e738f1bece3e197e5a417e971907e5e515e278eef936ae3f6984b46954a97980413
SSDEEP 49152:JCbRquA/m2yL5zifFiV+XenmE3/zq/snji6attJM:GoqHVjnm1EnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 16fea0f73d46709e4d5aa2ca860362bf582febddc50984b757e18cec0e440c33
MD5 c132d780314c23be239b4ede58107d86
SHA1 3483c4225653f378ed079bac9f9aa287299fa759
SHA512 b6a3ef0c1c214b7dcaa57e205bbf00958a93410c79248440008c59f1b1ee33d43524e1489f64f45f812269729797664a967ace5a6b67adceae8013ab1d3bfdd5
SSDEEP 24576:vAhGLJIFoiwtA5l7S53/t/sBlDqgZQd6XKtiMJYiPU:vAMyFoiq5F/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 331b1e8e13b2284e938aad90e2dd6e1e070fa41d566d9b1c9ad3dbd53948095e
MD5 b6a8ae9961de5c79c1e5c5a079ec5526
SHA1 186e32847643e8daf3bb414c14db81cf6632df7d
SHA512 ddabfe550aa4e44887568f9b67c8b7cf74235d0755c702b68e12bbb115f6334b63aaf6bfb56d8cf1451e1da2f366a39369352a0d5375b68d713e0eff69da277e
SSDEEP 12288:7mw5HEjsChNVBFgl0WDm+CsGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNA1:awuoOW8t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 f148b49a650623f5fdffed25a177b77053f2b85f5ea98ef00af57655d7e29bb3
MD5 f047312bc36180198727da09f373b68f
SHA1 c25a40d2318e9fe548fffbb8347d5673c58cc3ce
SHA512 d9933594f3b3b021cfa97f6951967d2d1c4b170faeb43f5330c698a0bdf303a9e222ed3883593a331c9bcb7eda65b67561709d4f8298d2710778256c3bf13dac
SSDEEP 12288:3BZ1IytGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:RZuxt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 1e1d7e01b6433ac5785bfd623e70d4a204a2282c18461d25cc28272503437a39
MD5 eea696d57f63c7a830fef85a509aff75
SHA1 8954267c9a913ab0eb309ff5f807062846de8240
SHA512 530e0bfd8255a0398d0f9f31875da3295a5238c73ba597e4e6af64868849886f9c94be98d156dfc36dca689fc67f4b95b33d0eb74cece4ceddc525e8c46d6d63
SSDEEP 49152:s0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLx:qwfhY7g/rLd7yYA3awr341gNEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 34f975b2f2f55ef98967451ad99e07c869b7307182e6d440e796234277523689
MD5 5e4be04444145d76af28b251c6eade4a
SHA1 b69ed36cd3130f0b7aeb8231ec206e31147bd21e
SHA512 cdd2ab22285cca6e0b86563a793cbd588a5d0108879032ecf91e07a5268d57a5bf25b8f4ad9682922c7f3fb3fa16ded630dc82e298c7aded99f2fd63a7bd2692
SSDEEP 49152:z0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLx:fwfhY7g/rLd7yYA3awr341gNEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 e4f0c11db8893ea8eb887d4da56c5a211a8d2260cb8c53fc19594a0cbd2a48cf
MD5 6906d9db1d09adc4a4df8696c22c36f4
SHA1 e6712a02da2171c4b5b7ac0552fe84b71b5dbcb1
SHA512 55cd99f2bce7ed8eacc6dae6ed5ad9cd6c08c8b4bef5a0c7961ffa4fc73f79227158d7b22c46d1f03c83c1e88d22ce8831db2858f35da51494cbbcf67d4b5549
SSDEEP 24576:BcTyYv0FteQU+5I2kjgD6iQacA8t/sBlDqgZQd6XKtiMJYiPU:BuXv0Ftpn5606zOm/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 8aee06f62f2f228f8b51ec1bdd8f8bd01de539b4b80c25368c17237fcc91a3f5
MD5 71c6c64d203eddcec19aa078a8775b59
SHA1 fb9e27d95c111732e14c0ecdeea5524c96e0f867
SHA512 3128289dbbf6cc4014c05722d1b3a168746036197b621f4ce2787f376cba4ebb4ed4ac3447ad0646d6564af4664dee55777742b22c30b04ebb8bdc536af196b7
SSDEEP 49152:ly7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxK/snji6attJM:AmYeyxHjWjMTKEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 9deabd04d48bcca4d3a5986e68b8b6d24b08c2f0457d53c09a35519c030426fe
MD5 9daf68dc0bdd1eba44061f006ca4e30a
SHA1 3d0d2db3a40f8a7085000dccba106ab88ddead61
SHA512 e30885e812421ae7e57214ffd1ab25d819341ddfb254876d1a028ba77b7b08b24a598bd9ac60dbe4a823185a87cb99f102aea8d1cee67b6396ea39a5a9e885ee
SSDEEP 24576:Y6drZn1WEci182IEUeNbJeRgUebgW816pt/sBlDqgZQd6XKtiMJYiPU:YWnDci18yNNUgbY+/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 417818fd5c71717efc0a7684898b900ef3dd146cddf7a0daa75d6975dfa29df3
MD5 2089048212018a9a8f7c2376308e68ed
SHA1 3b96c1e74655a06e708482185766af0574926349
SHA512 1bf7bfcb69a16a8077b9b4e5b80638c9bc8a57699b8867a3dbec6394171831f2b38e31bbe7b807f5d7c905ba1cbe458bef4b6ac0544188be49c81b3879351dff
SSDEEP 24576:Sk5lHW5EzMZupO80G2reD+melRgTTv/1nySt/sBlDqgZQd6XKtiMJYiPU:8izMZm0GhamSoD/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d77eeed7fc24faef449c83e549e62c9a3d262f08c10e83bb5c00fd0cd5156b61
MD5 07ce4e3e69db33ba574b031e3c5f4f7c
SHA1 84a884733151aef736af784708aa187fa24c0c36
SHA512 c565a9731781fba09afedc3c309d0967603daa0df6b348f2e2b0e7c83af03bfb240459463e4e35a090f162eaa2fd939f9068e260bb40beec65424512c94dd060
SSDEEP 12288:hSGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:h1t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 fb48edb9b3b0e6456a46b96fc5555b1e559e6ff0b90e08a32b79656c70f2c3b6
MD5 82804dbe3c4db6fab1113add0c3d7e5c
SHA1 8b9c2cdce9ac460720b40ceeb4a69253bd40744a
SHA512 09c5560f8cf005e9229bcbbb97a80c9308ddc854610baf501a1df805c72a6998f1702d817ff6309d30355214e8e582be2182f5659e553cfff0b432a9867edb0b
SSDEEP 12288:ZxGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Z0t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b7d34cb37f1542693361927c9200a444250b99ac315707105046ffd944f7feef
MD5 c532486ae4eed7991eb21e8e0c3fef0c
SHA1 e9dc7c31ab97add15d6e9f0d1339d8c3f2fa15c3
SHA512 dbeeeecdf603fc1e862359427e46e3ac25cb9fbfc33b1caf314c56f1b0548a3066f522c5d6ebc3844fbd89b43b7643744ccf80fd570465320631934fbacd6ff7
SSDEEP 12288:/HGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:/mt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 7f23c057cee3b88dcdbc877d3a7b25cfb76e79123656dbba048ccb47897d4369
MD5 61f53eb48046b9c99e50f5d2f268b8c4
SHA1 5040f95e7f3c55e86ad4a7fe2a791fe19a6a3dd8
SHA512 f362f15444d2af95fa98c32b12ac281f16d73823f200e4d27c1d9178723b6fac3bf125ae4f3c22eb504683ab7711c80fc68544012fdcceb144e1ab2adb690ba9
SSDEEP 12288:iVYGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Mt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a2147e8441204c7a6bfb5d46147b518adeb7c6d864253c057fce1ea8bc33cb54
MD5 f22c2b3c0e9f605a67411fa6b99154e1
SHA1 8cf08a600a853740d81bd11a7f9c2f276efa6763
SHA512 07c423008c47dd03bf2d2eb386d7a005208c661353ff2c1e296c4cf6d90a65dd376113a3085f983328fa61b926e1d2910fe159a3ea217753c2b7ca22d07f2c4b
SSDEEP 12288:TQGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:TXt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 789174913aa169c50814bcf2b1eaeb86fc9339c6e71a93e4917dceb2054f234c
MD5 37055aac86117d0f4aa4434adc907b4b
SHA1 9cfcccb07c51ae5dd81435800d7d73f0b8f3c210
SHA512 699d1f85dd0f8a8b367749587bd185ab7bf0567ba590858bf09d389992aef2ea4db90088862c46543ce67ca11673d0525aecb243f419c77f8576a9ec07db6e13
SSDEEP 12288:nFGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:nIt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 5b67c65b9ed8b3ce065ee4baf0e6afdb9cc13eb0619f69cdcda8ae9608c17d7e
MD5 76930a56f0d8494bab0ea4720874de61
SHA1 f2430f06015aa1fa341243fb849cf91059963bf0
SHA512 024b445082a011a391cb534d416efc58e978738af07a134a049723b7f29524ef5ab6cbac24777c35ace2fd3daec7dad7f9ac15500c9b1da7067fa433859c3902
SSDEEP 12288:0pGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:0Mt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 4128995e836b5093c5b7ee3f1353f449da88d147cd66170890c5ca12e0fe39e8
MD5 648916b2ddf0d3648e3c2de2d171f42b
SHA1 92800829d4c941614707b9a35478447714b717f4
SHA512 5f25fe99a886a1f2fbce31dd2c2b130526720cf21a6fe4de5f1f5d01c3cf78084725461130bc86031dc2b5bdd7ba7924c2b59fb0b070b3a89fd123f943d64b96
SSDEEP 24576:iZMSzFVSOUt/sBlDqgZQd6XKtiMJYiPU:iZMSzfy/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 6c9043f94a8b395ace06b6e22af431d57dee7bc324eeb9af4e67dce23a75ae21
MD5 5e6686158dff82ac9d5813d3a7ab92a7
SHA1 c4f33e5e76dff2ee0a58512501006867fecd6d49
SHA512 e23a586a70c8a88b9ca0f0a80bedf00c8c26c494e462a810ff6e2eff1a988a4cbbdba0d478d1143caa665f0019f10cd0d3501dcec6cac65d1f9795b99d62510d
SSDEEP 12288:qOGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:qht/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 e7428f02204e99033fca1af0a148ee3bafa64eafc49457260cc7fbf534abeca1
MD5 7b6c8b6bfe2f5cafcb34366b0f45dc67
SHA1 cf29b715d6973776c5f002064422b05bb68cf604
SHA512 322e4d821c3545842a1df7385584e307f72cde851a5f54b7caa2bf364e093c0825c77bb44707471af5105c5ab939b0299b3b16ed9f78881127b1eff17dd841fd
SSDEEP 12288:MaGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:M9t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a689dfb5c03fa5a5be729ae21cda1387174935418566a19719f15638eeb1f78e
MD5 63657d3d086c34a4b142931a174082e3
SHA1 7b78b2619d6300364ed344140657d528402e3a70
SHA512 6d7f21c99d61412b220657cf93bb2aece13897ffa428cc357ed0c3e0c69f2f420a47f00035085588a3e39a0242c143c3208f73481320eceb8b998db9808ca7e6
SSDEEP 12288:kyPz5L8tGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:9zyQt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 56cab55fd1dd4797141d37aac11125c0bc314e018eeb75a1a7ae794cb189a876
MD5 edb9c603089945664cf77d9b57805bd3
SHA1 aa05e29177825d63172e4d2ef312b21198ebd801
SHA512 09cef024d18a2d8d4e70f195cf28208377c25bd44bef7de2da775bca3aa0ae4b0ee60d56d5ecb02bb652db50b6e87e8b6afe091a61284e0820f818116eee3e72
SSDEEP 12288:4OGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:4ht/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 86d6f50f0b778bdd344e08310f11c67c45bd2b997b4429f866b840c3a011a8b4
MD5 667dbd1ebec4e8b18c44dbe2485d49be
SHA1 718d538fe40e09c06f52cc346ba8d9b734dbe350
SHA512 72e4ffcdf3d9d80d4a02d454cef9bb32e25614a9ade2f6d95f9869fd0ce1b84ccfef99e60fb3beb394c8c9cc3d05e397d2ba3de1cf2340196d36f90356594dab
SSDEEP 12288:DOGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Dht/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 3f8230d3d7298890886fea981481e2b432158b1987e2c128af443ac1329c7e4b
MD5 2f8cd11b933e758f8f6477120f7ff722
SHA1 f6675e2dc42d08d0da0eca97c602b6cd5f8a2260
SHA512 c72eeb0437490fd5f0d5db917323c5d18da8c32da8bcca74b93a538893c53b9f32704b9497bc0b449daaf7677571de2b1161cabd9ea577854cf5898c672d9c56
SSDEEP 12288:AyPz5L8tGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:xzyQt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8380d1c61b1f8e1c57259e24c68666173dc01d4bcd9b825c0ee43a24447f44e2
MD5 9a5547ba25b32d4ca2063b1a59e22e24
SHA1 86005f4a088ecb0953be4ad74fcbcfae08534feb
SHA512 1ba2731225079cc000221e41d3eea8b6d800767a15895d14751f21ea0a9db648bf5b73639c37a856abebc2b0c6e95e72b2d6bfa2564d3cea55e1ace364f70757
SSDEEP 24576:3THaLl3z0zD2t/sBlDqgZQd6XKtiMJYiPU:3T6Llj5/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 fc46e048590eb051d17e73ef6b2f84633b58759d0089576d1b3680e84cb57abe
MD5 fdd3ccbf8aa15e8065ab2c9d66c74c7a
SHA1 fc2644670086191d27066f39526f2a6300b2a296
SHA512 2159a2e78c6127a476984adb30f4a998a4c047f55a3b74b4b2520e6ddddf1032b5f02c2d3ee9232e73d794fc168242843e153cbed659d958807d22ee7ad44315
SSDEEP 24576:J37d9CHKy7GZqt/sBlDqgZQd6XKtiMJYiPU:Z7d9CHKyay/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 818d48be39d52e76ab0033f9dcf79dc9c2ecee4b690f071158e67c5f68ed4624
MD5 6f099029b2eeede46d786d83afc17d77
SHA1 b050d2860ec129ee73a93f6c11f2e4c956d384d2
SHA512 0e136790cf0664721a1e20e2ce82969b26b49c4863df63ab5d947850e2484052331888f0d60ace042e510a3c9fb2425d89f1f0f2f5b3ba19c4b1d858c8db5276
SSDEEP 12288:UnGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:UGt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b43eb410696abb7ff893087b6ba07aa3ba11a82747f72d8a60f494c37e8b85b4
MD5 ac58b7466827a01980416248fece7a14
SHA1 06fbf0a15d0197b478a4c268d45aee9a5796a3b2
SHA512 540909019063c80f5954206cf7d42917cf659998af1737fc3076be17bf649ec3ac4757bc146ec2dfdcd80f3cf67d0f66fcae051ef60c371b6cff15289883a6c8
SSDEEP 24576:hcP4mcvIjkGOxhKP2l71SNKbrh/8KB5t/sBlDqgZQd6XKtiMJYiPU:2P4m4IpOO67N8KJ/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 53adbfabd63276c98ec344b3cf481a07dd6e5a20127cbc5dae9ad468335eb9a4
MD5 da7752498ea937dab07abb33ad5d447b
SHA1 7744ec2234de95cb2649a1635927dc2ab79ec5ed
SHA512 4816ad7a78da033bd3f2734b04219568214ed6c7481d897bf66c750da90fd1f6515770f84dc60f4e615f4a45de98a97066eb5b40e7771ac4b5ace06a4293d04a
SSDEEP 12288:fUFmDDLrGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:/6t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 296KB
SHA256 1956f844d2d23092bc3494c854281d751ec8f3b215a1675e3d83e33c5ef1d425
MD5 a2b08f35211131a805c71ea59b9835e0
SHA1 63838d20290c8c290c85cdb7b55c9107a295592f
SHA512 1e2e0e4b8dcb21c62147e0257bdac94c216706b42ade952acdfc54ee7b5b6e748f14a8c1f6a15d1e4458f00e52b7443e8acc4c55a4b25584218a81a2a69b868e
SSDEEP 3072:lofJuV/9PYj0gQtdBRxSrxDV6kCRRPqtX9Ll90m1VXo4vpibaooPX3yVE+ZJQ7YP:urpdCP9
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 dd98931b07c8aefedace2134a3553611ac8996bdabe69dbe041024138da7d177
MD5 4ba8eb1eb7d62bd3e8f30f2ef1644043
SHA1 d3c47604c0762ad4e31fd6881eb04128c848c724
SHA512 77cb33122490d30da1ba1edd34d0ffa384b9d3e57f54d35a49bf481825575670da8b2c010bac583d5cc245e6d7cc75bd353556de8b8c69019bb1cb919e6ff13e
SSDEEP 12288:EeGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:ERt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f4f8e89907875546a7d4dfad19e0478b76dc727943bf9d8d2344a07744279ac3
MD5 ae32b161b80c0fa65573d641485c0fbd
SHA1 f2de13d518a1f263f50c2a8ae0ac9c91f58c5ac5
SHA512 c0ce292ac65ebabb6a2ebeadf99c96994eb8623c53119b6472e572e3ce555055d83f4a2ce776be1e14128ddeee5274037808d20a3a8ad0cff29ddb6f0aafd943
SSDEEP 49152:4a0h2GEkuAe73q3pp46zwwQ9/snji6attJM:4a0hNYG4JwSEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 7fb3be926200ab52f0ce4f434b4022c242f296851fe5f7688decb2a79db28b05
MD5 1293314174be7dc0817e5bbd14940c64
SHA1 60c68f650a3b57b255e7f09319cc72a075edb168
SHA512 7f641d3f2b77dc3376ad1e68c0646c02535803ca7a1f01fc39e03b7f7cf18fd818459a86ca850115d5cd89c3125047494575f41dd9126097ead3f9af348f4ff3
SSDEEP 12288:ShbHjfXhGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:ShbHjPEt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 265de04858a69c370347890a4118ed0af71eaedbb46118d06d3b14b64cc7d291
MD5 1adff4aeafd933653fefa06e4f576793
SHA1 daba49725e31caa13b90829022ffcc90a702aca0
SHA512 1d2a20738b84c241ecfe9712920daf01859394963d1c66fcb0e0b1ea71a494a29e10776a04d7a7a82b793c9b669340a150d745e47e00feca26b1c7c971e63e19
SSDEEP 24576:43YgnJcRTk4yti+R5dpR/8t/sBlDqgZQd6XKtiMJYiPU:4IgnaTk46ppR/m/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 60124d082deb77008f7ae03d9b257917fd0c8a00f34ae126d92d1322617ae35c
MD5 369d5257bae8812ed1be82f72f5136f1
SHA1 718a0c207847c8ff8115fe91ebea8b918521d463
SHA512 a087889202a87f2e517a145fb970cec28bdfc328315655b8847452a5873b81921ecd37eebe08d6ae67c6d66e8c9616af8ea6cd774ac9c31f29db3b0cad487ea9
SSDEEP 12288:nqGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:ntt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 e79a9600b987f14ff9909023e2fe77c0fd82cb7b501473fb787eaad0c90fb218
MD5 4bd37303ec01fb78dfb08064c4e0a1e5
SHA1 cfa6c607e8822e4b920e3c253c561b3ea5f0ea9f
SHA512 4ee1cb6bc995e1386468b793cecf04a5583a5e0b7a1329939719a4631738e176d1cc547d20d81e9541e74a346ed97e6ac77063c61e2664f81b567890a6ee9fef
SSDEEP 12288:zOb9A4LWOsvAYFTzGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:cpL3UTCt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 7b7d2140f20680f420b2a3b7dc674654cac7466170b9473d7d02872eae392553
MD5 7eefb149ea590d8aad6598ff87a11c5f
SHA1 79404525fb4290e155807d0b1db4d6edb4309d96
SHA512 0f7e10636dda751fb23499fa5d3d465adad811d96160b4130ce952552e836c81812f9bff5dd25350b4d41209626999c70c99bf0208b8a12fd90787ec4a31ea85
SSDEEP 12288:7pFtpO/Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:HO+t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 86cdd4930377941f47b4f592b635499e22741b5fcb34cad6fe72c48b675eca40
MD5 55b5fedd3ae3d54e5144137cf87f21f1
SHA1 1b10c10e65dde2521f5c5a063b69952ebaf879e0
SHA512 b36e8f25f873bcae8c673e60fb78e033ec92570fad43f8cddff938af3303a124f8d42c5ed35f0c47f18df511eea37aa8920ca91e36e4352124da98b012bf072f
SSDEEP 24576:q7NM9YmZqmWMUkPjZM48Mv6bEhsht/sBlDqgZQd6XKtiMJYiPU:q7cBWMpPjN8DbEhe/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d953f036ecd09e699704b5921c873b4f2fca595006c96a8f620c75b8121b4333
MD5 7bc893f0b5e3d95cc7f4b7cc1b3b03ba
SHA1 8a048b5b30cf89f30fac47e643e871c468ab403f
SHA512 a2296ce7316eeb5514fd27fe2a88c0248edffadb1661776d1752f9fe458042ccfe4bcf173694079d3a9db6cf38fb5ed5d27e63e91699e4ade89ea57cdaed7d9f
SSDEEP 24576:OW6BApg2YuyuNDYTabvcRvNYf8km1rt/sBlDqgZQd6XKtiMJYiPU:OF2YuHNETovcvNYf8kmz/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 38a755494fc8033a8fa04cf49fb12590b014547e59266886313317644d82a774
MD5 df98f6e1b6996b403b80670a21ef24c7
SHA1 a2a9dd38baaaba29875b566edacc831cd466fa1c
SHA512 e34ed20a52fc84e8ab80fcea242671867c0144d0a030e95bcf167eadf565e6e5084cd584a9c364833e5eac51d5a6425dae6718da96cdb16f151f09b7f45117f8
SSDEEP 24576:0AFs06+Omlf3NXEbToqt/sBlDqgZQd6XKtiMJYiPU:5Fs060lVXud/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 eb453ce913cf4bb1ed67db6169ed1bd97a381df11e719af1349da06199307270
MD5 f3912dc112c26106b3a96a7109f49f6a
SHA1 97c737cab321470aa36437ed5018f42b5a703466
SHA512 ff89e0ace6e4caf15523d9bc34cc5bc32c5422147bb8a7697f67bbdcc8a88047440fbaba77c4703406c938798a50cb6541e52c0dbabffce8284960f8de7dcd3d
SSDEEP 24576:qJnJ5D3Wt3t/sBlDqgZQd6XKtiMJYiPU:qJnJ5DGtd/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f76ab076aff0d17a83a52b0699d30aab979dcb8ee1709c35ae6c38b80acd54f3
MD5 535e461c08854ea4fe6dff339d4f5eda
SHA1 5c3873b84f06b5348a8488c1d767a5a0267e3482
SHA512 b008fbaa1addd6094c4384e30620c675086090fcfdce364126de3beb1c75b64393d5f845c603bc63a20a4949dd56907a4f2f52c693f1a901779c4b143e8855af
SSDEEP 49152:Ao06DIKdwc+eQnSt65aV3/snji6attJM:NhEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 dcd80cf6969a923e5ed66d57b80b7e473702b48615f22209634c3fe481c166b6
MD5 773b027c7883c392f9e52a6a37302e6b
SHA1 7c629c1f3fa1e9978173da41c03ae4a59d320152
SHA512 0437fdd7650ea1dfe764fa1101d9012b7ca5676c02171e119475614eeca1443b7e6723e7a47a41b722527aa1d7ca136af476fbd6f61fe03a1f3ec81b3393fe11
SSDEEP 12288:gEP3RrsGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:7rzt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 313405efaab406b2ca83e576a362c380ea10b705643b07835c962a332048eed0
MD5 8d40e861ee9712435530c40c14b00ba2
SHA1 0f54b2c1f44bdc468a3ca994e97099a2976a1bc6
SHA512 aefdd75eb65925bcb5c74341fd61b75a51f268c57602da40b2a83822be79a652a806d0e7f0ee7cb399ec414b1801052217206db0a5b3a0b246db2c169b277796
SSDEEP 12288:YjkyxGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:YIy0t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 8d3a656d90a9f87a3ce4fabfcb66f0db7d6eb3b3440cd4aaabd476e633fa5c44
MD5 a70be48c3f9ea8755e5a091b3bf861c3
SHA1 015af91cd905f545535aacaa2840ae7bb88dac17
SHA512 b185d778945124edc7b6c550b05acac04a59a3572afc6fc79a3c2b694a4e3a8338c93e08a791034294a61e5bfa27c31246a770cf9e3e6012f5b60ea3c0654a7a
SSDEEP 12288:6FPGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:4ut/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3a026077847bfda0b73c00aef2fa0a3a99823cf5c079616e67d4956092a41537
MD5 2c6109b00ee3e14659d12507b153d302
SHA1 6750e366fba15b76ede4e60d2f025f6ca79c458a
SHA512 b580fcc900f87d9133d82afb718c6372f7fbe20c1d68c119546be72ca6f8d4f157602e9c22e1e355a68835a5d452125d79198804ad45dc2c472ea487b3de5c04
SSDEEP 24576:PQ9MxZKdcz97w3Jt/sBlDqgZQd6XKtiMJYiPU:PVKXr/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 6b2a3dd41ec21a1f8a1ecf104b473c61e11660117cdaf1a351e4eb74b0f51357
MD5 f4cdc426430e19dff34e1e0b263b69e3
SHA1 fe016dd82014fb965cb2f45b88e6bda5e0cc3f4b
SHA512 c3824721b78a427e6cc5de833fb062c7cca41e9b8b1173a3087fd442f2f50d80aafa09393982a6eb881fc21b902959f46aa677d8bc95dc80da6794b7b765b1cb
SSDEEP 12288:UyoKo2HRple9pdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:UyocxApgt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5e81b2d92ff1ecdd49f641fb0973a055dfed8c127dc814842c738a969fd4fff1
MD5 fb179ef6b6a0c01dbc0e65c9c9da1a71
SHA1 94bf501197ba60dc5248f8a6ea0445a2de66f0c9
SHA512 5d0b93e931b16c775449b0a21307e8768e11ff1160c3f27ec0ad09238330b526160f21d381366279a4bbfd60b220ba46d074e85d5f1c00e28106b746c1c522aa
SSDEEP 49152:uWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKK/snji6attJM:I0zuNI2EnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ca6cb0283963850a9e134d7499e2000ed85500ba12b75acf3dfe24ef4058b5e6
MD5 3d7756a527c23708b8b084d61d16b6a3
SHA1 18dd65539de06bf88c69b18cd5deaa0fbb210c4b
SHA512 43ed5c6c3b63fd127344232c45b5a19eba5193e046d360cba8282888a00a4364c81c94669a13b6847f6d00eed7f6321718b8c1ca954c4d5429c882850d9967f4
SSDEEP 24576:Z1QT7EcpfxR+N5AWAz3ooiYtjMqbzt/sBlDqgZQd6XKtiMJYiPU:MTDxR+N5YzTfjM0/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 810d387d3607383fcc57d2bd56f1fc2033a8cd09bb297b371ab68bdcc0065fa0
MD5 12a8c5e5f8d8a073528593b0d2d3948c
SHA1 3c6c06a99ec9f482c4bb8065f22e35f991c37099
SHA512 e11496c130c54981a715b275b6949ecef90389fcdc9ce526a3579c86ac31d36bc4f5fa11531238426e5b0342d04d11d0a74c563769c63c37cb876d284ce17e71
SSDEEP 24576:JTMdOz0FFS+imSLft/sBlDqgZQd6XKtiMJYiPU:D0K+imSL1/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 ba24baa6798c4e3ac491fdef12e639c62c4d6fa254e4ad356f55f45c7f1317f9
MD5 07e878a46be07c1e1847cdf212c0c134
SHA1 be13de4730bb03dfd2a98176e63f05bbcfc6ceb8
SHA512 b9b3c233d5d69076e40e269281acd7e5eb33e14007a7a910d9c60673ef6d86477357c8d652c8c7e721f98a466211a9e503c1d72c7568457d030a7727652ac233
SSDEEP 12288:y47zGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:xCt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/548-123-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/548-240-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1048-669-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1048-190-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1252-225-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1252-105-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1252-106-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1396-241-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1396-674-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1720-155-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1720-276-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1724-252-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1724-132-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2384-149-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2384-20-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2384-28-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2384-27-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2408-43-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2408-49-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2408-42-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2408-154-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2408-50-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2568-226-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2568-238-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2584-151-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2584-264-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2804-273-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2804-678-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3300-176-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3300-297-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3300-668-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3372-214-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3372-673-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3440-465-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3440-178-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3756-202-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3756-79-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3756-87-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3756-85-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3776-66-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3776-54-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3776-55-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3776-62-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3776-64-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3904-476-0x0000000000400000-0x000000000058B000-memory.dmp

Download

memory/3904-117-0x0000000000400000-0x000000000058B000-memory.dmp

Download

memory/3904-0-0x0000000000400000-0x000000000058B000-memory.dmp

Download

memory/3904-1-0x0000000002300000-0x0000000002367000-memory.dmp

Download

memory/3904-8-0x0000000002300000-0x0000000002367000-memory.dmp

Download

memory/4364-97-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4364-91-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4364-104-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4364-102-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4364-90-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4436-677-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4436-253-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4644-189-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4644-76-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4644-68-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4644-74-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4824-298-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4824-680-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5000-203-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5000-672-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5116-277-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5116-679-0x0000000140000000-0x00000001400C6000-memory.dmp

Download