b3d77f0fc32366619c98221afaea4e0d206122fc0a08c36d54fcf501ed281c22

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
Size 1010KB
Sample240613-3e2vbavfmh
SHA256 b3d77f0fc32366619c98221afaea4e0d206122fc0a08c36d54fcf501ed281c22
MD5 8ff9cca82d0f60da96c8e807c243fbb0
SHA1 d35a65e48daed33fa803ec6f66759eada8df3912
SHA512 868fcfc1eb22c95c945ed245c2b3299fc32406b29c43b5f12dd7ae71d8cd5fc30b43b21bbde3ea76e9e89ae6b6d229d8ac1c60d1373b6f7d1efcf534ddea4123
SSDEEP 24576:3EpQQJvKPzvYZHTHy71e1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:AKPzvoS71mgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1536	alg.exe
784	DiagnosticsHub.StandardCollector.Service.exe
4416	fxssvc.exe
2316	elevation_service.exe
5356	elevation_service.exe
4516	maintenanceservice.exe
4668	msdtc.exe
3696	OSE.EXE
4608	PerceptionSimulationService.exe
5912	perfhost.exe
5024	locator.exe
2476	SensorDataService.exe
1136	snmptrap.exe
860	spectrum.exe
1724	ssh-agent.exe
5972	TieringEngineService.exe
4596	AgentService.exe
4648	vds.exe
2732	vssvc.exe
5904	wbengine.exe
4664	WmiApSrv.exe
1776	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a69f2c2b3b9834c.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\alg.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\msdtc.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93546\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93546\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006493d522e9bdda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044b45823e9bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e525623e9bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000112b4f23e9bdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018fa9922e9bdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036701724e9bdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd10d723e9bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e212b823e9bdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
784	DiagnosticsHub.StandardCollector.Service.exe
784	DiagnosticsHub.StandardCollector.Service.exe
784	DiagnosticsHub.StandardCollector.Service.exe
784	DiagnosticsHub.StandardCollector.Service.exe
784	DiagnosticsHub.StandardCollector.Service.exe
784	DiagnosticsHub.StandardCollector.Service.exe
784	DiagnosticsHub.StandardCollector.Service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe
2316	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3348	8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
Token: SeAuditPrivilege	4416	fxssvc.exe
Token: SeRestorePrivilege	5972	TieringEngineService.exe
Token: SeManageVolumePrivilege	5972	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4596	AgentService.exe
Token: SeBackupPrivilege	2732	vssvc.exe
Token: SeRestorePrivilege	2732	vssvc.exe
Token: SeAuditPrivilege	2732	vssvc.exe
Token: SeBackupPrivilege	5904	wbengine.exe
Token: SeRestorePrivilege	5904	wbengine.exe
Token: SeSecurityPrivilege	5904	wbengine.exe
Token: 33	1776	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeDebugPrivilege	784	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	2316	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 4908	1776	SearchIndexer.exe	111
PID 1776 wrote to memory of 4908	1776	SearchIndexer.exe	111
PID 1776 wrote to memory of 872	1776	SearchIndexer.exe	112
PID 1776 wrote to memory of 872	1776	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8ff9cca82d0f60da96c8e807c243fbb0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1536

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1128

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5356

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4516

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3696

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4608

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5024

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2476

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:860

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4064

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5972

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5904

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4908
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 ba66ba6ecb47a43aaba3e9b3577ff61bcb7887fd9b89add3e536c6efa23715fc
MD5 4e2bef9f6a85bdb9b7a99c84c1b07aa5
SHA1 390ce45c90248113be48edb0fe74d1a5f748afd5
SHA512 68d6b4d1ad1d61aab9e3a668dd5976362466263171fc8b0d96989d7ba7839de8a2039243c19c6fb1476e4a7b7298bfec3761e8f25b3eff927b19c94fd484f658
SSDEEP 49152:wuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5amgiTd8DsMcDKGfWbYCGE:wPfTqi90b2BiTLMiKGu8CP
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 c5162d2aa4148e70c34c9979248b7f80e84c3bba41f458dae599d1c2ead9589b
MD5 0168ba5be735e11fe8aaacdd4a3a2f89
SHA1 a5c5382ce9ee5f0139e807dd63f32fbd04e7d44d
SHA512 67eea34f4091c0e60f235fc8b16334bba1db923cd2e3db17d76353a03b716ba83c9f236f2a47a8bf252b685eb8c7f86159a1ca601e6bc98b132b2883b42cd997
SSDEEP 24576:ZidnBsuEle1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:ISusmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 2fa4227e961787c00a7d6963ecd616c8f8bd2beca31fdd69ae0311d8f030ca6f
MD5 1e4578c31651762135d24a65e7f5665f
SHA1 b3ea3785a4982345c22716e53e1a5cfaddba9c0d
SHA512 58b5806fed1098d7d5bc5e3ca8c430d05e4f890914f7874f89b97d154156c32d8b07a90647cdd96413e7afde411350626858d2cdcadf59659765c5a45acfcb18
SSDEEP 24576:2+gkEVfh4Co5e1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:rgkExSLmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b7b613024ab177b8c9fdabbf6022ac6b7d2009ea579c48783fc076df4d517ec0
MD5 52b426ff47a51a83fcd9f3eeb8ba1e05
SHA1 615b559de9c93f07b0dd64f6683d16c43101d860
SHA512 8a0b033f1b1da0810fdb17b89c024252f8b217f07458c47dfdcfaaee2d9317c99f2cb36230a0af0ae536dd4703b2e1dac7f5474e87aae6ea1eaffc7bab7127f2
SSDEEP 24576:nBpDRmi78gkPXlyo0Gxjr+e1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:BNRmi78gkPX4o0Gxj6mgiTd8DsMcDKGI
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7539890a9797756b77f953466a6b1b0d9e6da7a7d69362e3dda9cdca8bc39ecd
MD5 22a1071487158e17bc21e57774f47cbc
SHA1 dc7de94b4d886ef52c25c3098db06ab906710aef
SHA512 8e10a515eff76faead175b0bbeb558905a110761b6a2efb4a625165135e25c28d30523fd9e73aa5340b43d284a540c3b2b9009c0130b6b570c75325311a263c7
SSDEEP 24576:VLOS2oyPIXV5e1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE://ySmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e762cc4317ff7a9eefd39346c9583d697a73f7cd1e9a9f04bb2823d8af9b5b0f
MD5 38cea71c139a775097b7a35212e75c2e
SHA1 3fb5d6e29fa78fd79b17ad3f2f2dff02231337ac
SHA512 3998ed762647feacddcef36caf887d189c73c04fb83211615cd8aa04865754f2ed068571a456f2034baeecaa0ca967acec47f78140c76913c7c2cdd7ccf326fe
SSDEEP 12288:WfryndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:Wfre1g6p7HF/w/ftDsBUiScD7WGfWVbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 58d0f21a118c1ee9b9779704401110e30eb3dc265cf9ac241edf991d9be4f19c
MD5 dc81daf0e111ff688e2b15dc0def3e52
SHA1 294f782bc78cc0025f58bfe618e3336acdcfee6e
SHA512 963d9c0142e900955f425aa9b20032294f6e7197d5daf897f485c74d9e9bb5be9bfa63d49427fe80bb69dc49e002cf22404b2a4094de253b58ffdf5b9893863c
SSDEEP 24576:MJIUYe1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:MJIUYmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 76d0748f0c29c7896c87c5c12b160dcac654b6f10fe98e976b651404859df944
MD5 ced2cb487551074da9948be1b340c104
SHA1 ce2d181262fac9b19e0d7b15e2c6ef2b306a58a1
SHA512 9dc1b3d61381b6b6f6af1870255c094b35751e93148ce93abf898f25a48b1508f77ed9c46878a92ef98d5145245e5a3d0c0a830333d1d5d6868b97a7fee4da75
SSDEEP 98304:dQvGAdlCEL8c/yRNw5CdBiTLMiKGu8CP:avyEYc/y3w8PiTBKGu8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6e18aee4de0dad58fa283ff79da2cc2e5e0a122f98c055436a9abf38b59497f5
MD5 6ccfeb43c214aaad085a7b09c566dfc2
SHA1 e986c877e73a974b075184898d7622453e644312
SHA512 509fb4a0536926231cd26fe99df976f4753e46c7e5df0721fed3add45e473ccd82c6c6dc2f0a9f5e6930bd971aab52bc896cccea51985f3a26de740576a169dd
SSDEEP 24576:udewsAj2e1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:Glj2mgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5c6783236a029bbb3370148f7eed5dd6ce6721e5dff2c2fede08c62b17180769
MD5 5c387acfec897a440ac230af0803ddb6
SHA1 20528d32aa3fbed070c474d64233ae237f8f119f
SHA512 35e924476ad6ed21c6ce8fd2d9025d160e2454d4d9e0e5308114fdc2e8757df8647ea468f027829d487be7961a830050a0ab87a1bb5f2997fb881720ce4b3a14
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHEiTBKGu8C:kUEtQevvqc2W1cpV2EI32vTB5u8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4a9419fd1d6bc55d82a001533ae88dbd722f6755169f2d3fe4ef1c6e6bb26dd9
MD5 892f62cfd1d42ac64fb070070349ffa0
SHA1 cc9c940aa6a7f5646926d3922c658d650a4e4255
SHA512 4c9d4b1f80e8aa8e83b22c579a44ffeb96d4c94ca7cacd20cdfa91eaaea58c81f0c53e371d332e44f646f42cef89c2dfa8fbeeff50f65bffd749c61328fc0e5f
SSDEEP 49152:iCbRquA/m2yL5zLfFiV+XenmE3/zWmgiTd8DsMcDKGfWbYCGE:noq2VjnmJBiTLMiKGu8CP
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f2ea04939f406547fafa6f799f13cd1bc44fc0cdb1efea571c4d768957e2479b
MD5 df30f7e808de4fd439041c2a68496936
SHA1 312fc331837b19e7284064c2744fdaf83a88263f
SHA512 c4433b10bdc4538e05608710b17940c3865e24e94e5ad8abdaae1bef2fa0a797b552cc6b9bb5872ebadf85b19ca4ff41a4770cf5df722b7459043583ac032987
SSDEEP 24576:TAhGLJIFoiwtA5l7S53pe1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:TAMyFoiq5ZmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 d68b0fb7fa1732c724fc538ad23d10de28310c1bed115b1fc4a54fc704608743
MD5 cdcbf10b1ea59c6edcb52ccbdbfdc6c0
SHA1 e6ac2bc8d3ddeea30dd1b2f272d81c14d24f7d1e
SHA512 07a499e46992d5141ac7c1f042fbcab53b7b22364fa4151b2d3419b3e6eb6325fc06ff226bc781f3ed863fe25d865c36af1b67be70720c21d275db0ceb7fab32
SSDEEP 24576:zwuoOWSe1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:zwDO1mgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 6526ec79eb31c2a8b3ddc45ffe0b2976af014ec589dd45a9d2c2652df230a076
MD5 a005825db972fdc75c61f54f9b597e7d
SHA1 ba8ee6eb56856811b6b8ba012b65722852ced7e6
SHA512 f2128509e4d59f5c97842cc9d9dcef93a9db2ef58553ef8c1530947a20024ada35855f0464e29c78f25b3157409dadafd110c073739c6bf53f0fa92921b84221
SSDEEP 12288:YBZ1IyGyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1k:GZuve1g6p7HF/w/ftDsBUiScD7WGfWVh
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 dcf1b25ce37e69e829e1c1c82130ca669f1495ba428f89f8ebbe5cdda3e55be0
MD5 fdfb4d64fef884cda16c5b310ddd2bb5
SHA1 86e53aae4d1cbeef4c18cd38406983cbaa0c06f5
SHA512 7bd4b19238affdfbc3827aa66ea8e77b234a9541cc0cc36e0370ad1242830033e2e2e2918025a90bbf66f560e7f72346512f81158aef31c916ddd42cb33f1fe0
SSDEEP 98304:pwfhY7g/rLd7yYA3awr341gRBiTLMiKGu8CP:r78yhDiTBKGu8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 2e78c4397a9747e5d761ca3c64208e43d3dfbbab9b1f2f125a91970f1e21de19
MD5 8dcacafd1fe6edd598c3d16b257c6a95
SHA1 7c2b42a6ac6e73461d31a4f765d3a0712153184d
SHA512 96c0165210289fed96d5dc2cd1843e9ed1805ec952477bb47366f80ff3521822015a16cb1e2f42be9fde104b1d0714aef4c3865aa43f580ea8c3aa3ff89a6f6c
SSDEEP 98304:VwfhY7g/rLd7yYA3awr341gRBiTLMiKGu8CP:X78yhDiTBKGu8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 c6cd7d941ea559fa08d425a6fe2c29851ea68c0653c8a96cf1b195a9f268ed82
MD5 f7939df2b2c81986887f68f6284ef42b
SHA1 03d4290d578576ef7bfcb6239bac5501f9853430
SHA512 a351fe1b6432900e068a0947ca2ac0836344ab716c69fec16fe2cd567e2dbde37a790d72f95a3fab035fe00e205dbe08a733e80a206295eb219eff57acf0bc0c
SSDEEP 49152:muXv0Ftpn5606zOSmgiTd8DsMcDKGfWbYCGE:Fc56F9BiTLMiKGu8CP
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 e61769a542fbddbc9c557cc2bd82d4585355db6e988a9b660958b7afedcbbb95
MD5 fcba4ce592337d74baf25b5c1941aafb
SHA1 bf957986340d35d19dfb22c5a2ed1fa308684e84
SHA512 db606b8474b7db9bc16a61c080ea8821c4250bcec9a652530170231c052c2b745784c80da29a8cf996c2a6f1151e76962b6d2ff7a936d0c154b7bec04d465764
SSDEEP 49152:Gy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTx2mgiTd8DsMcDKGfWbYCGE:tmYeyxHjWjMT2BiTLMiKGu8CP
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 97dc1166cb0ae498a01e061292835a012c6f9ecef7e97f42b40a6e12e0a1e359
MD5 e8ee2a86eecc8b28f87176f376342a99
SHA1 05802a9096ff098a86685dd3a143820104caebe4
SHA512 1bf1710f24ffd802d367bc6026acebb227ea275d9149023eeceb3442d77917137219aae370168cc4b18e414931f115dfd7124dfd7692674832a1fcab796e9e4a
SSDEEP 49152:TWnDci18yNNUgbYamgiTd8DsMcDKGfWbYCGE:aIqNNoaBiTLMiKGu8CP
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 11447dd6460f02fb5ada31213f8289e4a8b7104643fff940669644d3aeab7465
MD5 9d6e87003f23f066d2c091cbde1996be
SHA1 9b77bf29a9ee4430d468e99de330b9ae72250571
SHA512 b2537915bc2105e0d367be27b70ebb2c9c3983a9e3a6ad9caa90fe92faa7cade05a46330810521d4f0a60eeccf71625029ae2811a77d21e6815f2d8609931b73
SSDEEP 49152:BizMZm0GhamSovmgiTd8DsMcDKGfWbYCGE:Bm0UWovBiTLMiKGu8CP
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 5f9d847ac7e9b6d9fa328ca3094537cc3528f1100db33d7031fd2dcd29d23459
MD5 b60c144a795618d0a3ea3e7a7b34f4bb
SHA1 90d492af2c582ce39526f3cef8a99f59368bc105
SHA512 d6c67eb2c480a2fe9a9269c48a7eb2f13dcac5b18eec43bb94d4182b70a9bb836a8e41b1c171ac02d02c9f5ae4048d9a8ae10ce795ecf1f4a4e5a846806fcafe
SSDEEP 12288:0zyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:0ze1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 bb0c8b885a1617bf537c300d435a7efac48cfb7f311cfac8cc96a8ecca30474e
MD5 8c29da6110238ed10af5fefcffe9eae1
SHA1 d235342ca537e898ffa8fcf988f85663f521dcb1
SHA512 27528a55ed89d3f4610388a2129f7f69bb41dde299357061647ae0f6ba5cd64cddff4a52cc3550a6acd56df53a38367e9f015c7961721fa7cbe799c8279399a7
SSDEEP 12288:UqyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:Uqe1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6d8bfbcbaab57da6684b90573e22332be449d9d1311b6f5b4d29a42b2d728935
MD5 1ce0d5f57c9a6eb8a225fad9dbb9aabf
SHA1 70df0f4a88080be112577d3ee7c3aa62da441dab
SHA512 20a69f58405275cb7d46f0d42b55f3f4dd519e774d9446c861c2108ab90a5a3643bbd3b75b6d14da1d40eb2a839d610bed70518eab8b2ceb738630f5dcb2b857
SSDEEP 12288:ggyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:gge1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 94259797616afacdfc7d7d3f1683bb525950013280f452780038553c33f271b5
MD5 418fa91c3f05369cbb21799e9fe7b820
SHA1 4a0831d685fb8f735bfcd9732df6a1b078851519
SHA512 b9a272a47b70cd043f46a27934a980687a72e71a5cfe8642038feb60751102f3207d1b65bffd217875cc113f30d2ecac232ad7cd8eeafe83978a07d637783df3
SSDEEP 12288:kVJyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:Ue1g6p7HF/w/ftDsBUiScD7WGfWVbvfl
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4370f64de97a303588913baa488abd168dceddd82841ee0d3949a9fcdb054b9d
MD5 17b44bf47da1fabdfcfc2a2899487b34
SHA1 1fec4ab0b49693535334f32a4b2969bea1419d6e
SHA512 86397ab70ffd9f530bcc6b5360feefcc41bdfab67141088731f619fe199277500f3bec39835299449122806e6ae711beee8b7dbd49c9984980c6065c0dea5fa9
SSDEEP 12288:PByndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:PBe1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 2495feab8a853dfb67216318b07bb25e61376b4ed62f3a3e1855063bb5f70379
MD5 7411f9755255260d517195e8fb635667
SHA1 2c2e055478449977395630bd30be5b32825cf7fa
SHA512 3e32d8e6b6a66bc12fd444505f9e665ab0b56de3b6254f5fcdc023b0ce24b8c8458be4ae3abb280d5ba77468185a17e0e9ee02bd993e67b8ddd8a1b3d64c1545
SSDEEP 12288:D+yndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:D+e1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 7b0914097107f37ef6fa47a8c14af78c8cc4525e504440a35335054070db41de
MD5 3c7f505421e79ed9cbbe866916461e53
SHA1 6273c57f4d3ab84171ff2fdda7b0e2f2a6dcfdc3
SHA512 3a2ed22a0fb845af1113837e783067c7d9b8f61b7ac30f3a700540b284baaf66117bd7b1525fd2520df6ded7a90b95c674fe61e52b1506528c9c08782e9558df
SSDEEP 12288:sCyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:sCe1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 7701b8e12c8743170834b32fc66f3ddbbbc1759053ea62010a5ee471291e099f
MD5 fc1082cfa4d9debbd9e57280a914c20d
SHA1 949eac0529b21c390e446f2611f644c906ce96d0
SHA512 eb3bbcfbe3ba0f5e8645950c046d5a150117568ab54c00f615473973d62d3d1f902d9569668aaeae086114bb79ffde73fc2687e8d5e119d960f88dd60a184daf
SSDEEP 24576:tZMSzFVSOKe1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:tZMSzfOmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a5d1f70952208c56b7df123f4e69167a941e8cc9908c2652b8793b71f8b65bec
MD5 35a5b62a1e7164aaf7b46b473cc55611
SHA1 d14cb322f1e833d911458103db0735ca37b56d42
SHA512 9efc256b6a128f22fa086f7a87a91e1ce4ce51f708ece3569681ccade3f1f3e38a486d5345c0bb00656ceece9afcfcb9c3528c37ddaa217c03fe334e6267f512
SSDEEP 12288:2/yndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:2/e1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 03001df0ab054919ddca38e328218da220139486717b21a20ee18bba90ab9dbd
MD5 bb7647209723ec703d0ed267d785ea43
SHA1 052c89a66a8e157ea61f97ce4553a1628734dc90
SHA512 bbf9886c3ef48b8c36eaceac3b8c7c908bcddf9c856a51e281ba5d07c25c1d5a3a9d779bb0e3ecae80bbf24ea67a4ceb19aa97adcf6533a61bbb52310d2ff38d
SSDEEP 12288:h7yndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:h7e1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ad37db0805448b024c506d97e9a213419e8145ce7a2d4b9aff1b2abefa08f145
MD5 6c16e5bc4c66695d5994c10284647947
SHA1 e63364336860ff6b50bc1fd3b0cb78e5db3d8e9d
SHA512 52757111b71be591b0d2f0a53f8d58e07ec8b995a0cfe996bf5374847ede12ad8a842e39bf36aad5f7ef81486ecfb4d4c716f860434706cad57bb096cc9f6977
SSDEEP 12288:cyPz5L8GyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3AS:FzyGe1g6p7HF/w/ftDsBUiScD7WGfWVh
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0c3e2bd948072a8095873a568b6df4124b950176bce1b97ae03648ae107b9380
MD5 a90c198d989f506be3bda10da39ce665
SHA1 babdea457d92350c6732db4a4fc2ff6e9d5dd910
SHA512 f7086c96d32c4b744d016e0ff46e430ae91a7657ae591b7d647980048eb52f706143134a955d4902f4ec63d14bc3e02a03837577cdc9c370f706d12b723ef469
SSDEEP 12288:z/yndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:z/e1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 abc02291d0291c5896672887c6f631d734b48d0867cd6200c77cba554fc74e37
MD5 f849528ada72bf69f470074dfb3f7034
SHA1 402213c15e432c2aa7af1fcf9903d13466ee2d2b
SHA512 08d88937f9d316590bbb2572c256be3187a9bedeec884fa80d85d90ebc821e490c73357c7b225abe48179bb0c8f02764d74108cabc1cae343937c9f444e5d897
SSDEEP 12288:3/yndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:3/e1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e028a1e4680f77a3d8ab27931d910b14caaccdb3e1bd905b97ad9505d9f10c08
MD5 f24ce9799fe44141fd290ab2b6aa5797
SHA1 c66a875a478d8852132a0d9ca6964fbec4a42eab
SHA512 84767d48f6d1d638c96be532c85a877cedcedf01a594593e5cb529929d14883db9aa48613dd7d6bf138f29ca46e00c32c456a31bb845a4742b11536e63fa5569
SSDEEP 12288:6yPz5L8GyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3AS:nzyGe1g6p7HF/w/ftDsBUiScD7WGfWVh
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 05a508eacab56ab12dece567b14992b310506769c048aa98d3fc198f87b6a49c
MD5 19490ed59d7cfa062e6cd0c2deaedeea
SHA1 79df558493fcf9af1b4771b6aef5f5f95ac03508
SHA512 98a60a0d99c46e0e93e35f40bc34f04c844792f68d72ce06cf60a049a5386a489d25ef23e7c2b228a1fac20efe337afd18b63d5192355802a9f22f6310247900
SSDEEP 24576:1THaLl3z0zDQe1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:1T6LljNmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 5f5903b8bde6cc8451034b3ce8fc83ad3797a826d8d9f2699a610ebceeee9296
MD5 39ab675f86b92a98d8469bed1c3b19cd
SHA1 8d68c59ca4ad070ef0d4ce5a2d8282b7c69884ea
SHA512 5586bd31c6f065934f5f8e9bde61e02bb8b65eee68b39afb0664b22341e5bda21aeee8838abcfe3da6a9a61c5af328285128a862efa6adaa7818c11dca885b12
SSDEEP 24576:o37d9CHKy7GZEe1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:y7d9CHKyaOmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 8eb73034976aa75eadd6e31228b322f882ed300941db7967557404a36c58fc27
MD5 ed7c2240d866d794387166c114580c80
SHA1 6864fee5f264014673c6abcd5fa75e5868aa7920
SHA512 7044ba8c8dab1abd3fa0d17d96a3e4362ba9624fa4e5fc038a9ab040414a1aa81d9e32747ce66414a34c2db5a5e0861910e49a2dca2981f9e0c45bad79192805
SSDEEP 12288:NAyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:NAe1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 02401290cc07fcb973d85fc263d64e3dc96549282b8e1e77f47521e86c397010
MD5 49f2d0d821196fc7f3cc7b62b410cf01
SHA1 b7f3c5b13b0613eb3905617b8382813c163a5214
SHA512 c5610c9766bb27e0b1df75e4ad591d5ea0155b5d750a01e8a10a59e34806fbbfb950483c0916c4eba8fa4f49376d03fd54f2d6339f3346c6ad4601fb97b28cab
SSDEEP 24576:McP4mcvIjkGOxhKP2l71nNKbrh/8KBXe1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CP:nP4m4IpOO67W8KdmgiTd8DsMcDKGfWbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 cc8a8890246733319efa7ddd41707da9a33c1b5f2c009724232e26533d5a3fa4
MD5 7df662351e74091a1cdcff82bc8b2f1d
SHA1 0818d10523a388cf0d93ee6fcc1869b4149f8efa
SHA512 3ddbd3296a0eb6d80bf6f6587573322a2767ffeef6085314299e4d9b9a40c32c54936e8347e140a551af2d8d837afdd616e97340a52e6f629475798f2855b386
SSDEEP 12288:oUFmDDL0yndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3AS:y0e1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 fad33ce01759ce1bf181a95d96985d0e4c54c5ae66599325481d2cc3872116a9
MD5 e175f8d0761717304b0ec9f3a14cf8e3
SHA1 cedc3e8b05e6a5d5f33d979b6e61776551a77b75
SHA512 9ec87468c258e1c0143b9dd137696eaab45593ba2f6c746bf1804993c0c7940da9fcc7ecb539c30215c7424d129a1cb03e50eb99306ffb5d62abfe83266cff8d
SSDEEP 12288:CPyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:CPe1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 54fd5cad67954dc2281d7093080519f9b85c254f20d3f03b75f8f4ace4cd722d
MD5 fcf9b6029e95284c7154ccfe17b16929
SHA1 871e31bf9486e85e55bfab8b5c80246e868499e9
SHA512 6472d941311cee008a9bd8ec67401b8a3860f7641142bf176f53584d65264603528e05b664a56f4651e2d33b93c0d25f9634500f5839bf68824b09ad13b91e9f
SSDEEP 49152:ja0h2GEkuAe73q3pp46zwwQBmgiTd8DsMcDKGfWbYCGE:ja0hNYG4JwuBiTLMiKGu8CP
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 78b2f9aa6c7ecc8992e9933553fc969392993e3de818b62533d74738d14e4e6f
MD5 8e9e5f60d22d48211cc665c1bca7ce2a
SHA1 d2d53212c286cdc0268bc961c82d464336dd618e
SHA512 e78aba967e4214c4097c93816e35640c563c93602817e781cdae2958f861463c3789951b317dfb7fe891beb89e637045fe38b2373725d75f9df87a0c47739eb9
SSDEEP 12288:ahbHjfXayndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3AS:ahbHjPae1g6p7HF/w/ftDsBUiScD7WGI
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 23c628309a07be8ff7717ee58cd2149ff684b554b5254c3a89bfad16cf2523ba
MD5 ef0c2546e358e644a355afcd56629e41
SHA1 fbaf6caca8b058b1609688ff2e04ea8b8f2afbc0
SHA512 31041ef18fae5ddca5f9b0002174604345103218c58b65aef83f98c11cf6e4d491a5c139f10a63261a20aef066a2d1e836642cc0da37a77b5a4e0db44591bd5d
SSDEEP 24576:B3YgnJcRTk4yti+R5dBR/Se1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:BIgnaTk46pBR/SmgiTd8DsMcDKGfWbYy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 86f3a7dba7847bb47350952c88ff12d0a5f56c5db23e3007cffbc0f7cb729e05
MD5 c38d608b379286d787c1d8ee74724dc6
SHA1 a9a6430f4716fb7e0feb5d0e9e984186b98d3638
SHA512 6cae9fe7eb2836556d2ede6ae7556d7a77f0bf7cd2489dd7e6fd96e5124f52d9af239a03b4fb0b270c1df782da44a07456cc8187709b1bd1103656a2745c22ae
SSDEEP 12288:KLyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:KLe1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 2bd059bb356ca4f25e72827f056afd00ea6963238bb941dbb91d510d2308afb4
MD5 d4b6db3536b40b645e013ce1e4c99cb4
SHA1 ed612e816fef05b3cd838f31ee7981e2cb99ee3e
SHA512 617ec7982087714a29e11da2225fc9703c6b754f6b381fcc0442a5485372aa79b841408643519cf81dec7985b090c81f27ac39197f600ac35a6e8cbaaf61f02c
SSDEEP 24576:wpL3UT8e1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:wpL3UYmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 1c9bf5b81cca49853a253ac1cceff81ff7416eecc53b3ed00aa322f7f3c89631
MD5 0a446341227fd54735347a834396975e
SHA1 78cbb8c5862c94c085a3397ce0ceb3dd615ed846
SHA512 f7e46197e67b5c704e5e89cd8396a53b7b4ca4e933beacf148a912fe8007f0413d0d0e6fc23e416aa1bdf1c2adc482c06bbd446a1cb96af22cb6bc3c47951436
SSDEEP 12288:XpFtpO4yndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1k:7O4e1g6p7HF/w/ftDsBUiScD7WGfWVbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a0a1b15e369bb27201e8234c64aa31d554f732df330f7c5ab07a0578d4160361
MD5 920ca88507c12c872d5d50e1e6c49711
SHA1 c99c94a47bb45daff2eeca2696422adac164ad1e
SHA512 b157368465057491b3c0d0694e23135a1df8a98b10bd4d41bf0fa954ec99120cfb77375b915f989ee42c7b9c5ae73432734295cda0884ae86a0d14d637ecd9a9
SSDEEP 24576:f7NM9YqZqmWMUkPjZM48Mv6bEhs/e1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:f7cBWMpPjN8DbEh6mgiTd8DsMcDKGfWh
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 c6aaad4ded087e49e41db7d263cc3a8dea3c98474fb72b88f6aba0fc307f7cc7
MD5 89962dfff3962cc21b5764f3bc06e806
SHA1 f88ff6a55a7d73dcfdc26e686111d86754be062d
SHA512 bfa90ab4406847724343b2d30b73866be13c620003f26f69744a38c67c7bc4d2178470f8adbedce76cd5e6891b44fc5445fbdba61c47864470708763db711c80
SSDEEP 49152:1F2YuHNETovAvNYf8kmfmgiTd8DsMcDKGfWbYCGE:Q6BCf8k4BiTLMiKGu8CP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 739eede23e3f1f491e7c91dd9a5cf6dc1f2bb8e1f94c13363d5d69f341ef4c12
MD5 638dc197af2d09a4a7a51dc05e16dcda
SHA1 238dbf4368f4fa0de930ba8861348e2a5c6c761b
SHA512 689639f9db8e52895f30965568168a94658fe981b86fdaa7d97425f77db9423707cf53d42cdee81cc85b085669322548d4c7003fd5a50e941eaf45a30585146f
SSDEEP 24576:nAFs06+Omlf3NXEbToEe1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:AFs060lVXuhmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 40876ede9c6fa766db29e4e2bb571404612620d6e45331ed82d243eecb866559
MD5 02b8950a334146c39f9b799449de34f9
SHA1 29305dc173c16a1891c8ab6c7f0b9cf959a75b4a
SHA512 bbf6a3ae4a4f3a472d8bbb78b856b93b9ca595a55363b7c2332a59c713eac99813cf6565cc9fea0a2b9f255c2c13aaf9479f1b20bab9cda68b6c253132beb606
SSDEEP 24576:hJnJ5D3WXhe1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:hJnJ5DGXhmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 361393d9cc31a984afb6d462b1405ba68da164dd600e1efd8357e364f1e48b06
MD5 5162d9df4a44c765390b6a8f37ed0341
SHA1 59fa57e9e6ed9c1b82c0b958729fb2acacc220b0
SHA512 3f5352d0fbc550f2b601d1f3c93f1fc1550eb2e5b3b83f367224f285f0b7d68e979087923756e8928f6c1421d3720870000cdae957816f822122d27990733e59
SSDEEP 49152:Zg06DIKdwc+eQnSt65aVzmgiTd8DsMcDKGfWbYCGE:ClBiTLMiKGu8CP
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 9891f00e984c1b7f2563ff619a15da0a51b23b26abd24d4cfc0c0c2285b8c534
MD5 c1d58a0a5866b949236fa3bdb986c91c
SHA1 df4cf8a7eb9318307d2bf8ec97c776f367200b67
SHA512 049bef24f13b964feb1830a27c0f46721e345d3b47f13aa34fdf8a2ea6b9e83c15ea52137268cf86fc5a389724fcdef1e3ebfe290c651329817ea36c5a1c6abe
SSDEEP 12288:XEP3RntyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1k:cnte1g6p7HF/w/ftDsBUiScD7WGfWVbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 a8e12867f7e6387ec286c7b6faa50d4033115028e32be7f73f82c0012f4b1c1d
MD5 5a91afbc2914e5b4b84157b212297150
SHA1 e1d2865303de1f9f7e3ac7344d2dfc8b0bfd1937
SHA512 66b534c37b950dc2e93e6edf97e7d5153ed67811c9b95b7987b9dc7f48d7e6b8f20991ace06408b5941810f5dd610187c1afae6235b428f24b450ad189a4dd44
SSDEEP 12288:rjkyqyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G3j:rIyqe1g6p7HF/w/ftDsBUiScD7WGfWVh
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 9757a0df3cf98434b149a61db41e57588169a1607d9fa0ff91d594d07a67e600
MD5 292dff800b49a752dbc987eb223f1aa7
SHA1 32b3729c7022e8a1a03ea6e00fd09d9ee8f4eabd
SHA512 c673d7f892f467a55d4e40e21e2833e0b5d7c36e19518a0fbbef4343b1894388c8520855ebe286cccd18dc3680805ea9e67b9e0c877315eeb6c062015a20b3a1
SSDEEP 12288:uyIyndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:XIe1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9eef882cecbc38cb7eb7d772348cc99bd35c62212400878ce760b8ac3af0959f
MD5 d301bdfcad5d6e2a912c17ccc6ddadcc
SHA1 fe337ef7afe3a3b762006d3d1ff3a6590877871c
SHA512 ec932707af2aaca6e3a136854c5d7c0d29f5ceaf6ef91cc67d65daa4f0f5e3ca1ce243fa52ca6864dad9150067d158a829abaf665fd7ac841daa77ea767dec3b
SSDEEP 24576:pQ9MxZKdcz9dw3He1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:pVKZHmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 51819cf891eddce05d8e6fcc90a9140b2bf81167d34703e93df2bc1ae1612b87
MD5 2937035d3e929a909bc2799581f531fc
SHA1 fc60aaa6977deaa1001e5761b5ab189cf278dd92
SHA512 c97a4bf95553725f5e6c30b597372b3002dd86d0d0ba6208649c81dcf693e4fa2d8c020df9c25d63fa9ac7799162028ed4e02c65ab4ad0dce9f377f72c401172
SSDEEP 24576:1yocDAp2e1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:IocDAp2mgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0548e3ad0a3c93e3f78cdd1d9c9fa9a1d12d05079e2c87c78b585edb93c74329
MD5 abaac9270e32b062398c993ea30b3ad8
SHA1 cbdac2b67fce18ce164a93be2593a92167689638
SHA512 56b4a68530a2eb32171f00fd602819e688ad2c4cbe5476464474974adb803b80537aa35e5630a1b57cd62598e4a0f5d6e523d841651ab51bbdb809dfbeedf599
SSDEEP 49152:EWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK2mgiTd8DsMcDKGfWbYCGE:u0zuNI8BiTLMiKGu8CP
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4830fab8475cf36b08af7c888c73888ae442ad2f26b8d036f6dd9f176375541b
MD5 f9a76af5d3b2ab531ea1232291aa86a0
SHA1 418c0df1bcda46c61d2013044ee32987cccc555d
SHA512 7732facd1021c546a0f9162891e57ece71b7579e747ce5c855bd6a639c8b5c475a909b861b3b925acc7b43090dad236e30ac4218a6ac506111e300763c947765
SSDEEP 24576:61QT7EcpfxR+N5AWAz3ooiYtjMqbte1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:HTDxR+N5YzTfjMYmgiTd8DsMcDKGfWbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 0c1943a0f1dd96766491b886a006d8f5564fcc40464aebc29ffbb8be9e76005b
MD5 9020296562ee65a2253970e297c07d55
SHA1 bf87fcac05955fdd824656057ddf7c24524d8358
SHA512 0b61905cba27f8bb82185fbb48907dd0d7dc439c634530aa43da201b4df335523b60f893e104385354be8401b27ce5d59c135efd0239a26b1aac30e542ca9eca
SSDEEP 24576:PTMdOz0FFS+imSLJe1g6p7HF/w/ftDsBUiScD7WGfWVbvf4CNQE:N0K+imSLJmgiTd8DsMcDKGfWbYCGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 1ba3a17442146931aab3bb8744c22ddd81f0bd744fae7697f298684f10c38abf
MD5 1f0bc7b7eff64ab762e523840cdfdfc6
SHA1 385be832580c4fc8af56b1158e63485849133be3
SHA512 285e4954ed4eec1b559377f151fa1873e8df1ec8170c20019f927a9ed054b4c32a695e0def16c8406dfedf1bf51e546e996a0cfa70f7e254859d18dab962dc2a
SSDEEP 12288:k4K8yndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31V:i8e1g6p7HF/w/ftDsBUiScD7WGfWVbvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/784-23-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/784-16-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/784-101-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/784-24-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/784-22-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/860-131-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/860-525-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1136-331-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1136-119-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1536-14-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1536-100-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1724-529-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1724-136-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1776-173-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1776-537-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2316-130-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2316-41-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2316-33-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2316-39-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2476-116-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2476-172-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2476-528-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2732-160-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2732-532-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3348-74-0x0000000030000000-0x0000000030100000-memory.dmp

Download

memory/3348-1-0x0000000002150000-0x00000000021B7000-memory.dmp

Download

memory/3348-8-0x0000000002150000-0x00000000021B7000-memory.dmp

Download

memory/3348-6-0x0000000002150000-0x00000000021B7000-memory.dmp

Download

memory/3348-354-0x0000000030000000-0x0000000030100000-memory.dmp

Download

memory/3348-0-0x0000000030000000-0x0000000030100000-memory.dmp

Download

memory/3696-75-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3696-155-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3696-83-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3696-81-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4416-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4416-32-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4516-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4516-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4516-65-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4516-56-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4516-62-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4596-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4596-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4608-96-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4608-89-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4608-90-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4608-159-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4648-531-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4648-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4664-168-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4664-536-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4668-150-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4668-70-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5024-112-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5024-167-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5356-135-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/5356-52-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/5356-44-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/5356-50-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/5904-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5904-535-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5912-103-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/5912-163-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5912-108-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/5912-102-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5972-147-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/5972-530-0x0000000140000000-0x00000001400E2000-memory.dmp

Download