df6ee266fe83094bfb32f0ed83006c2fae47357afb9e5a32f66193db1810b9ab

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
Size 1.2MB
Sample240613-dadjgsvgrn
SHA256 df6ee266fe83094bfb32f0ed83006c2fae47357afb9e5a32f66193db1810b9ab
MD5 586ac5a309a8901dd435ac621c6707a0
SHA1 ffbebea8907b1318741cf7469944ee6e66eb637a
SHA512 a27af4b81d84aa4067c8bbeeac8c1b4f041a07d64e307651e062f44b7289471a94b0ba2b95c8b2d1b658edea90e64d8a059df44c9cf6fcdfa85d0778d10a37a8
SSDEEP 12288:O1fAGQjPviaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:5vjiUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1460	alg.exe
3616	DiagnosticsHub.StandardCollector.Service.exe
552	fxssvc.exe
3944	elevation_service.exe
5008	elevation_service.exe
3640	maintenanceservice.exe
2736	msdtc.exe
4568	OSE.EXE
1452	PerceptionSimulationService.exe
2400	perfhost.exe
4404	locator.exe
4500	SensorDataService.exe
3760	snmptrap.exe
3220	spectrum.exe
2112	ssh-agent.exe
2604	TieringEngineService.exe
1688	AgentService.exe
2756	vds.exe
1844	vssvc.exe
2512	wbengine.exe
2748	WmiApSrv.exe
4896	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b9a86dbf4bebce60.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\msdtc.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbengine.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f33a921f3cbdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000167371213cbdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1c2ba1f3cbdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c287f1f3cbdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e94424223cbdda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047e040223cbdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cc09e213cbdda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca4243223cbdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3616	DiagnosticsHub.StandardCollector.Service.exe
3616	DiagnosticsHub.StandardCollector.Service.exe
3616	DiagnosticsHub.StandardCollector.Service.exe
3616	DiagnosticsHub.StandardCollector.Service.exe
3616	DiagnosticsHub.StandardCollector.Service.exe
3616	DiagnosticsHub.StandardCollector.Service.exe
3616	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4004	586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
Token: SeAuditPrivilege	552	fxssvc.exe
Token: SeRestorePrivilege	2604	TieringEngineService.exe
Token: SeManageVolumePrivilege	2604	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1688	AgentService.exe
Token: SeBackupPrivilege	1844	vssvc.exe
Token: SeRestorePrivilege	1844	vssvc.exe
Token: SeAuditPrivilege	1844	vssvc.exe
Token: SeBackupPrivilege	2512	wbengine.exe
Token: SeRestorePrivilege	2512	wbengine.exe
Token: SeSecurityPrivilege	2512	wbengine.exe
Token: 33	4896	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeDebugPrivilege	1460	alg.exe
Token: SeDebugPrivilege	1460	alg.exe
Token: SeDebugPrivilege	1460	alg.exe
Token: SeDebugPrivilege	3616	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4700	4896	SearchIndexer.exe	110
PID 4896 wrote to memory of 4700	4896	SearchIndexer.exe	110
PID 4896 wrote to memory of 844	4896	SearchIndexer.exe	111
PID 4896 wrote to memory of 844	4896	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1644

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5008

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3640

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2736

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1452

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2400

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4404

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4500

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3760

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3220

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5072

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2756

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4700
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 fe8ad3636d1587cd888ac49e5bf73afe36328f4d5af1fced6d05aac0809f8431
MD5 4ceb702e5d37b7f1d317cc7553fb442a
SHA1 1017a18db0c018d763bd4da8a3ce86e714f77635
SHA512 009c301313fd43326e5ea91ba54456cdfe17a678235a0b65be34ed4e1827cfdb625d91fc4fa537d63e481f10d486b8f56b5142ecab77ba684f9be55299a1494a
SSDEEP 49152:DuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z58UyuFlIAFQmd8WU:DPfTqi90bgUyuFC4Qmd1
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f5e59532a1d0a3dd4eadbb2129a8997dac140b3ac67cab0a73f6f2b81a08adf0
MD5 e2d2a8c82d709709b97a2f2693845dbc
SHA1 90ab96b48830136eaf46640ef74d71f1db1ad21a
SHA512 b73348e2517f957ed17b31c4a447216533fdf0f3bbb5199dfacb772860e63b9add84e310be7db39bec48201adc92390f344b1517a3586180d920159f8b6f8eb2
SSDEEP 24576:5iynBsuE7UTWuKk0fob0gEEVFQmic8WU:nSu6UyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a478aa23d33522948b75dd5e30cf52305799a78e09cc6de453a299b38bb03f75
MD5 67b99840597acc97a102fcafd2c3307e
SHA1 87cc21e812e33c97a8672d0ef9681728837860ce
SHA512 2de601971d226f6011f0a34e564b2c55747f416ef232f1a6408fafbed2e7080b1fd3a184c0f2d1865cedae6abd43cec8ce8999bb7d7127e2ab80035f8f09769d
SSDEEP 24576:S+gkETfh4CoXUTWuKk0fob0gEEVFQmic8WU:XgkEDSNUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 03fb07221d203f8b0c0f7a13bdb922c7ba2dcf667deb8f7f42e31c6fa758c795
MD5 10b6731754bb3a4acad2ce4291a33ef4
SHA1 3b7fe18b33232e055be949f2d05634fe28a0696e
SHA512 4db5e97bb19689f3d9029f02c17390655f1e933bc26fc87b664624176a8ef7441316c299433f8ea618dce28806d54ee5bf24044a7f9119d61fd8fc4d7132639f
SSDEEP 24576:lBpDRmi78gkPXlyo0GxjrYUTWuKk0fob0gEEVFQmic8WU:PNRmi78gkPX4o0GxjcUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 78a7fc7aebc06c27bcd6492fc1913f7a6e0cdf36aa89f37de07951264d4c8ba2
MD5 1c571885ddfb10a210668acebba1e9d0
SHA1 f97bf668ccb60bd555252050def4b30aa9717a92
SHA512 539daa6765b332b1bbe7dae9eba73105f3bf8b48da52a74b675c1ebb90751f4f143026225f6f32e2c895be71d1e5606025ead5a2f100b16bb03739bd1011feb7
SSDEEP 24576:0LOS2oyPIXVXUTWuKk0fob0gEEVFQmic8WU:M/ykUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 97bc8b08070cd774f6e63def6a968a80f8f14c1894029e4007054eb69266d9a1
MD5 ff9260e63d573974d9be3f623e2c05c4
SHA1 8a8d79a0ecccb352cf5de894d670c72a13fcae83
SHA512 318757a534f8a4904ad80ec87e6c293acaa81e4f38e99e7ed188e3c1341e78316c111b7b97581b5e4aefe90f9f360a3537f66d11b4ec428a5fd614f140bcabff
SSDEEP 12288:5MtaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:5MtUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 68c316d478c1b6ecaddc045f79f977ed9587035375743e6eec5f919e43672915
MD5 1b689e4820e6ccf299908dc23b286b56
SHA1 7c282dbe8d675392d1bffa0beaf4ac687fe27eab
SHA512 425e44ffc535ea1ebf36c0e264f2e15c672834513ef69638a67878dfcf2bcb8fede06eb610a22c74cabc5f6d3917771e59ba44c8098c6e0355c7383601976c0b
SSDEEP 12288:peBNUbTVO86U+aZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:pJIU+UTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c35dd6ffec1823c0c9b4a5bad54d5b813c4b957025121d7c4cfd70ca92e7632f
MD5 1f8ac02e09b92cf09fe45926dcb84ca9
SHA1 4c3a0f4cbf024d8fb8937207dcd54c7b1ad41c8c
SHA512 e77d3684ee39c7140374e612dcebb7d4efa3772c7944b9d52f69414ef8e624dd0586158c6e981f2a3ee794e1634c9900d4c5fcee2d030d5b04403abad14e8c21
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH+:bQvGAdlCEL8c/yRNw5CDUyuFC4Qmd1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b1f2e60a131c7d5dfb0d8db2a2bb34f39efbd3b2b8b175d953bf97477d2b784c
MD5 2a864434744adb4e1cdba60d11127212
SHA1 8215966878d6003f7af173bf786848e46f7a1a91
SHA512 9c71e3505a9c1bc047af9b7fdb915d8df82d7de939019d029da11ebb53a52f483c7eff3303c596f2ecb10a3049e3086927aeb7dca17ae69908c80a3549ddbc26
SSDEEP 12288:IAwSfxL/2Dc3eDLLmt0LDQewsAjgaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CiZ:t3ewsAjgUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 014cbbfba98e976ecc44c97d303fb4e38d4375e9db528e31ed9a1bf48e44f2be
MD5 f91fe3840b4a6678a1382690189a1b91
SHA1 6a3053d710a11ebcc1c4956761405d65a3cf18e3
SHA512 3036459328bf528a013e9e652b535c42db7eb60a122f40a8954ec46b53297d1c52b6085512966a93828b914d0a585cbbf1cf4ebb63a1001c0e0571a309fe4213
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqQ/:JUEtQevvqc2W1cpV2EI32z
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 239d49cc1b3c961488f84769f1038b4ab3630d9ed556e28a8b0a0d3e50763a38
MD5 fd19a1888cbd1422e6ab0e463924937e
SHA1 bae68031567b3c31343a3b58c87913a47d32be1b
SHA512 a41dad291d09921f02e399edd1d5de7df5be65df47f895f457b87c05dcb101e50e19bc21f013a20a0c3b8705ddbad906ad6470e988567805678057d4ec8dc341
SSDEEP 49152:xCbRquA/m2yL5zifFiV+XenmE3/zAUyuFlIAFQmd8WU:+oqHVjnmHUyuFC4Qmd1
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 29192d70e308147637d55b04703b0c4b9f920c18d446bc3c4397235fea2d20f8
MD5 4f0a7ed1ac57c50f727f64b9e5971fd1
SHA1 65444602ef27cbb27b7cdb112b39e43cf1beee83
SHA512 5215ac35e3d8cfee421b576a71e414ae61a99bea55029cfea6fef07f4ac22dfa538f025f2c534942941562f4975368b6cd9c404ceff66b4a5eb18b7b683f2a68
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53nUTWuKk0fob0gEEVFQmic8WU:ZAMyFoiq53UyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 3cf6a23b60050fbeeeaad846a9550f4491fac86ed6dcd2fd0ad234cdac51c895
MD5 3aa23ae085cb323cd80f4a13a656451d
SHA1 99e602f41174d2341dea446f572b86364943623d
SHA512 3dfc69e51083fb470336fbed38970ac42f9a423736519b09834d0b977b91cb72c8efab06996e0b911c1a89426f8b83d7b73353fbc803490c67080c13532523bc
SSDEEP 12288:Wmw5HEjsChNMBFgl0WDm+CzaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:PwuBOWkUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 9dd405176d50783409396d44f1f84bbb9188416a7bc20c5b4768cf51ea3f4a65
MD5 bd960bb4f057845373e49220f2371cb7
SHA1 67d3f6bb3192023b4fca840e36880493a33ea65b
SHA512 a967bc23fd8b378d9428a0d171ae052380a69f0db094c3c35e51d2dedad7a64325935f3dee413f0f49bc41dab121d8fc58c3889205e4222c7c0d32144ef91b2d
SSDEEP 12288:BoZ1IyQaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:mZuZUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 1d86773817b83802f33627edf66bee1ed1f8111fec532950e46dae1b9e02c31e
MD5 7932911721a8df17a8c90a4c25fd7847
SHA1 e76c217d9731d2d497f6359b11d528cef8c4562f
SHA512 e5b1f365d39dc228ebf9bfe95b23b7f2daff79422cb141bbdbcebbf23c8fe0637f0e6dec53caa3534248fc69452bc00fde2c7a547828261b5bd2fc4b3812972c
SSDEEP 98304:+wfhY7g/rLd7yYA3awr341g/UyuFC4Qmd1:u78yhrQ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 2cfee474be4fce525f68bb11f8078f253793e890b96f9c77ceada170bda70083
MD5 4a4476c9dd0694807fb2589357168f10
SHA1 f9637e8065aafaded3a9bda73e818baff4b5e8e9
SHA512 75afd278796218c8918a85edf949e43470f15d5c115b68878be491baedae7d50184fec9b65c7c3b7ad15fd2b0e0d4401b427dc0a65a4af61a95df35be04b7528
SSDEEP 98304:0wfhY7g/rLd7yYA3awr341g/UyuFC4Qmd1:A78yhrQ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 2fc3af41fbcb9af1231414bdbb91bafbc4e0614ea104a74c6f09b45bfbdb0517
MD5 3a3b4a87c21de6aa926b46273457c0d5
SHA1 d06b4c7d353e14a248e28a34bc61390925d64b33
SHA512 43d91b14a62be4403fa599b33419251c9a64366d264891cf09ec0f1022bb2cbd9e21a5eda464c219034eabcaa29211683366847d2e61f61911ed64e02357730c
SSDEEP 24576:EcTyYv0FteQU+5I2kjgD6iQacAkUTWuKk0fob0gEEVFQmic8WU:EuXv0Ftpn5606zOkUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 d9841e352011a0282bbcbdef931a1bd8d5ad9399231baf41c7737ce31fbcbe66
MD5 39e7e01c927c4caa4034da522dd9c5c1
SHA1 c45a057a68e21b134bfede932a35c453ed9ee409
SHA512 388236be48f2ef8474485e811d0d5a69688c26aef468b44463be77c48e70e7bda9c5e34a5f874bad13fc2c86e4f91885347ae41d25b33d38da5626dd640f0756
SSDEEP 49152:sy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxgUyuFlIAFQmd8WU:LmYeyxHjWjMTgUyuFC4Qmd1
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 b86a2398e398628cca13c4bcc60a97093a653455ad13b1f3c3a420e059f425e4
MD5 b09f42302f7bb80fad8b06c7fc0a40fa
SHA1 a648cbed2923d59ae6ab74e6f215ec6c69c619f4
SHA512 67370484f3d8b865dd1325724c72ca07c221c0793332ecd705a4ca1b896fc9adb74de8bf20eec1267408390c6f124dc860b0164a401e83b3c646b8452d679ac6
SSDEEP 24576:L6drZn1WEci182IEUeNbJeRgUebgW816BUTWuKk0fob0gEEVFQmic8WU:LWnDci18yNNUgbY8UyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 1296e560283ff08d9deb946f29c73a3c4585c96bc1abb68efaa6140e0dcf8957
MD5 d1c2d2ce73d9c2fb105d0de84cf983cc
SHA1 61c9ccd47f29bc30d73b6f7f1a9ebca649def049
SHA512 f7fc789b0df527ff3d22dcd40a61a809140a7f6238052d7fab529e092ec29bbf9e29abb6495dd3c66f03a4b9331e99474e93d953fd159ff535dce95af7eca638
SSDEEP 24576:Wk5lHW5EzMZupO80G2reD+melRgTTv/1ny6UTWuKk0fob0gEEVFQmic8WU:wizMZm0GhamSoZUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 298e344631b0e2feabf464b663823a392a0e303c18ed0c1803e6b077d0bd8b51
MD5 21ecf30733b087f6e77c20bcbec33d71
SHA1 f9278db642d0e4969123b0a316a0065cf017fe56
SHA512 63077eacc7f8b35d9b5f2cb4df7d1f0c01606b3a4b9ffce7c6f7aa03f610faa70c7e826782fbd3c68f8535cd2b62d71e25ffb4c0d416cc73521bd8efb63a1190
SSDEEP 12288:3FaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:3FUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e8b5d82662fd657da9bf57817044b074a7a4768116be03865396b3dc022f6908
MD5 abf18de51e58710f713856de0a18327f
SHA1 1794dcfc2d0e4d9e101517c326062f4aa94023ce
SHA512 40b67bdaeb7cccdf6d225a199734839296da73d319d59e3e37571a598d1c1568a3c67860eae865814c20c8e8d7b7d5fcef8ecaf39ac0e8826b9b046e317a98fb
SSDEEP 12288:wsaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:wsUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c9bc7c1716e355ced1366ff7450e10979715ebc097c114abedf5caf6fa34c9c1
MD5 8d15c5cefbad41e0c8208c93323a73e5
SHA1 f964e0132dd0a81db3e40067f7da83dc555a3eeb
SHA512 5e8413a75947bf3cb83a345414c0778e9dcd88b836efdec0a5be61d5025412c0052abaede4d55ab4015b9d75347ac910b2fb31c5f8549cae7e91ac2bcf4e9f58
SSDEEP 12288:bWaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:bWUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d210b2b71ca7af6e46df5abbe55f5816ae1cf3f75fcf64abf25fd15130b222f7
MD5 cb6064d6cff9da0996b244cd9573a887
SHA1 48f117b2ee239e1accd7b79648d233ba84c40fc2
SHA512 1d82bb55e314268bc969ac9f14b3a8b79a2cbeee29e1d6f67c4c04f595a411f18601c75ee85e9f622ee68f45fa27747384344311282754a336b2ea7732c9a735
SSDEEP 12288:VVHaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:3UTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9c66ef830bbc5fb02d54f92f8f58e980700334e33ed2c25ef77466c20ce9a5b2
MD5 6bf2890c36a19ec5f5fefdc2f55b4a5c
SHA1 b11ada34fadecd2ff259d0b5c6117be0a3593600
SHA512 0aa9fa8661a258ec4650ac5557e33d4d7dd411cda2e72e2d0ba0fe2ae43c9a05b7871abea0caf2741449ec28b464a6aa52035ae041d6c18e9bf9f33c706e839a
SSDEEP 12288:mPaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:mPUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0e0e578f827276d27b5b33b56aff82b8016b5f8e8944a57c0f31587513673a3c
MD5 78c1cdc57284726d177be1f203237492
SHA1 c5370f40b6a95e4e9fb2aa82e79d8224c8ce29a6
SHA512 d3c4bb245d27468bd83010d1eca0a5e7c6a0d3c62b3d98444e6c1111ff6df03ed53bb1ced6950c09d6dadea39e700ace92ddbea48baa07bf7a86c945e278dc88
SSDEEP 12288:tYaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:tYUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1db390c050387268fe65055b76cbda628ca6a89a2d9e5e791f553ffb77ee3154
MD5 5c8906e0df79ee52f01f852522217ec2
SHA1 6dbb454b918366f8661c1a3ceff92e24604aca41
SHA512 b3bcdc947be13f5ef92db9a037b1392f83d59166d3f2a97669df3cc404c5303c247cf0749a3a3669a2f8d44f5e358d1d1ce58fbbdb1c1578697efd480877f5ae
SSDEEP 12288:m0aZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:m0UTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 22ac504416cd0da7628bbb32b8aad25a8e6700ad2dc82f1fad79a9cbe625f442
MD5 fce02655895c839a3531a7027bffb145
SHA1 7f07f93605e4294af012230a523083aaf1c21736
SHA512 59d3f3bf3fb3472d18a2cf1b828d31bf51330618a82bc7a45fe0fcff1069ac84ef26b26d91e9f3b8fcf215892a1c38a9acb6ddad069c14bd2be477bd79c59dc0
SSDEEP 24576:dZMozFVSOMUTWuKk0fob0gEEVFQmic8WU:dZMozfIUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ba400102f42aff40505a36695dda74ac0c10a01148752fe60da08c974bfe79cc
MD5 25708856e48a885971adbf320d423782
SHA1 2152f748b22371b1395990a7f971a0a3fd3584d2
SHA512 8ee1a3bf1ae9b71c4030eae4776ab28dabd8de8c353eff52ac28226ba8c71513e78b5e46d853976476d9c0141d6ee07cb8a0409cd5c50fcc9fa2998f1089cfef
SSDEEP 12288:OJaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:OJUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d053db6a8c10377320e10e80da21ceaf3c6ac86c20e9f2c2f954ad3eb5700e93
MD5 56ad902bd8a7ff3628cbfa60e8bb041b
SHA1 61d456a2ca44d8eacef3b4be640af0e1c8e9a107
SHA512 0d5798f17c16ce3ae86cd186da0c134f372e4fdc92fec14ef5d65d288983b53c440218037d455ef78fced46c60a3a8b69451a9e367921002279c2718dd132353
SSDEEP 12288:0daZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:0dUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 5447faab7063c7089c31e09b5285adae135b849ae0a0c811abc0ab1f80516d22
MD5 e8425c04e985783ed0d2dc203305fcda
SHA1 e4ef049a0daf14dbec5c3c7aa474e02614498053
SHA512 3c4b884ffcd8b7a6eaacfe5ffcc0f4a84cad3cd88cc1afceab22ccaaf34d5bc3233962c5a275af4aa8a53cee6419db4bdd558b4b66d1702dedccc2a2992d00e3
SSDEEP 12288:wyPz5L8QaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:BzyQUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0295cc40b64f90754521566f199fd82311fca8160f1814869c064121650fe62e
MD5 757c2df7f53ed521a0ae33d7a0a73bf3
SHA1 9800facea0921da9ce198911b3d3b39070b76c08
SHA512 9054b6344337220a4be38235ff4a997f8fe908ea0a9ad0e8a1906ee46cb35f5483448fb7e773c4fdb02982807de2cc2e6d5160d1fc251d5d8e3a2f9691af0495
SSDEEP 12288:fJaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:fJUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2a50b08d91c02f01449ad453e1ac550f2d573d1cbf26667e93d737660cbde68e
MD5 3354127a61e71de9ba53055a6f6051f6
SHA1 a2991b0ae11d69c7c516ddc07c71932e5767b8ee
SHA512 69f4cd00b0bdd8dd2092b988ae3ede7e19adbd6c397c1c32730d27a9f9d17780123f3b75d4f9dadccd2548bcc23942f0838c7de0429848bb1f06fc25a9d8c064
SSDEEP 12288:VJaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:VJUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c8f6edc293b73048b964ff10c47344530bb0aa13a79ff93548d0a7d5944e7aef
MD5 0a02caa18cbae844a21e2687b73cbf01
SHA1 cb2ae4fa564ed972a39f132ab6305eecb80ebffe
SHA512 87661930430a86e436d3aaaf55ce612c49c215797dabc9b9afa195044a6f3d75dc8302c8a250f29d27379a9c8ed5adddace410650b9fb23615a1ddc1af7ac524
SSDEEP 12288:CyPz5L8QaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:fzyQUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8af13796344bd17a4390bd4766f89cf15e228bf428d59ff34b30cb6f2831e70f
MD5 dcd3c99c92940e15051e8e109cfaa2fd
SHA1 f330a5d2c96412e2ad29c50592891bab35867547
SHA512 27e7834462b09260747e4fff1bb437eb6bc43bd964aab9c1964dd036938205cd38da5f7f34250557fd640fc1284532acb052adfc5005dd786411451619a68d22
SSDEEP 24576:sTZaLl3z0zDmUTWuKk0fob0gEEVFQmic8WU:sTELljTUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1dc11b190bd7c7fc1c29cbc4523df95bb70df6562b1f1f0522804369de6a3269
MD5 1888de473ad09c0495b3a08a5df400c5
SHA1 1895efe154f8655324661fad2a57ddcd6c892e6a
SHA512 216651e7c975018319453441687adf34c78802a3c131a514f8374643ae75bf6b369e061ac3e5a54b8980af093f58cc4ac9350281a7c2cf02662316b66e86b38e
SSDEEP 24576:N3ud9CHKy7GZiUTWuKk0fob0gEEVFQmic8WU:tud9CHKyaIUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ffde56bd2e1457ca9243e157210d7d14a3d3c30918f90da2a6393a465cfb97c0
MD5 288b87374f4b7ff2e986423a25ba3103
SHA1 9ae31ca4316b71df21346516738fa1722896dbfa
SHA512 64528a2bd5394230dc6d6941760be6b2bd46cdea2af1519e0786e778e9caf996dd676f0f2e24d15f5c2c9fbb6b26cd46ff0287a38c090c326a1db7db8215adb8
SSDEEP 12288:k2aZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:k2UTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 2feab4e5e83f032686d9672199a55a8669dc3d0372f90bf958f8db7ac714073e
MD5 884f078ba940e5eae90e54ed70a24b92
SHA1 371fea1797b8294fa29322f4540dbe9f2cfe1379
SHA512 ce8d6d17c5c3df190855275e6ceba0bc657c96d8c276e359230e546cb1551af5ab1f71f5eb005d208df03d3d7b16b31a099dc1615c581f3987e57a89a1174733
SSDEEP 24576:CcP4mcvIjkGOxhKP2l71SNKbrh/8KBRUTWuKk0fob0gEEVFQmic8WU:tP4m4IpOO67N8KDUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1a0a59b748ab102110bf01a5ef8465c87545dd6e9b2c64fc3deffa9387efb01c
MD5 32a13b65f5b2ba9c107b1a03190aacc2
SHA1 87bde0f05f527f1aaccc56de3a8f8e604d58c561
SHA512 4ea27644a8462e85c7481bfce55c145b8eb0516b06148efcb2c2ebab03bd7c36c46c5330287bd043fbb1cdbdc0d4246f2f6b79f7e813ed30d85882798006004c
SSDEEP 12288:EUFmDDLyaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisWC:2yUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bad3c5a2bfd57b48f22df9bab849074ce8eeca0fc50168031d30cc05d84aef2d
MD5 f77f0ba8fdd1cf00ae9d102fb4a04102
SHA1 c81af4b28af601a1bb1ad1efc117a11f6e3801ab
SHA512 b2c22d15fb009f35326a068af508263bf17224d2ecfc538514628fc630559b099768f373e3da4f5b4c7769d9d28c45ac2b482c7fbdb2f1358edd577e48c300ed
SSDEEP 12288:v5aZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:v5UTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 eee2f7441fdc2ebe7c13f7e67e6bf371e4eee33c7ae9cd2f06b722f7e67a58a6
MD5 ab2289d8501b71c5ed4e7af02e50b228
SHA1 5104decbd3c66b8f126bf39a19c4df1f7a78cfbf
SHA512 0e511a6828ca9291247e3271a4959d9e6400f1e470144f46959f73c8fb68a43e699ad52444d4769ae94912d6dd32e5adb7f5aa49d32da257e63dca9241b55d98
SSDEEP 49152:7a0h2GEkuAe73q3pp46zwwQPUyuFlIAFQmd8WU:7a0hNYG4JwoUyuFC4Qmd1
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 7cd93e728cbe321a95b3c8a931d8cf6b3debce0affe2f438f337adf935669983
MD5 26af32f7caa66a176d5a7b869f9b3255
SHA1 5d218e303e5c704123d5dac7044156ff7ba69dce
SHA512 ea990869b01985e19c073598697e375bfb8ea163fde677b6f20acfdce739ede557fb4ea1620fc2ecbd5df2060f0da90f61363163ab2a8b2a05fd591064d52352
SSDEEP 12288:nhbHjfX8aZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:nhbHjP8UTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0b18b39d36d3d398cee6b079dabc3c02d02b213b4e90a196cb7b5457750a3154
MD5 b7e5fcef4b036937765614dc146760c3
SHA1 4d8d4b1919767939b55e030a597c5b50bb136fa7
SHA512 85394b97f78f94b65a823a573585eaccb3901a2ae61576d732bc101e3a7ff24c60a15124a11f660c7de3d0d48166bb57f462fdea0a64f7d014466fe5ca6e9e28
SSDEEP 24576:z3YgnJcRTk4yti+R5dpR/kUTWuKk0fob0gEEVFQmic8WU:zIgnaTk46ppR/kUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 30cae0b3b88f88dc9b93eda4079007d635c17a887ef0b1ba1c52f848f0e7554c
MD5 368ef47bdf732c9916b22987e5975967
SHA1 cf81bff8f49c56e0b759eac7813ce00ede79559f
SHA512 7eaad57f12b78e8da1a1b0baf0298e600b34118ec3c459432f976887cd7fb19e15db544cde718c8838deec2442284ddeb4540fe5187ea1406c56023f26f65341
SSDEEP 12288:BNaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:BNUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 bc91b3ebaf3982c6a725c4bc91b5cf779ee930455c42529746b6ecf5b2398cc3
MD5 1537974852ef5b1125aba7b07045273c
SHA1 f1d7685b96e0fbb8d08d33a53ecca8d002d109fb
SHA512 93d27f2b4f15dd125d51ecb7f11ab40db103a96a782a6bfa08a3bc383d8082560778c9e88ac3fb58259f4c7723edaefe803be25218e7f262912e52a7cba8c82d
SSDEEP 12288:AObnA4LWOsvAYFTqaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:9DL3UTqUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 e74d04f12ac50f42226ae9e2849cf650e654f7450b28b61e7b55ef640892ec5a
MD5 5a940ad3cc2381102cb2d1ab7d565d13
SHA1 212dfcfa78f4f0c39d61a86229d8b3b6742144c4
SHA512 b7387ffb5b98ca6779a13d8711b6b718fa5def53267d718f578ae84995041c5ae2b5fbbdf63b938dd9e746b96f4f4021bcf56c778f8e02be2c786521f516e653
SSDEEP 12288:SpFtIOeaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:ROeUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0d50efd4cac471532df56f5dfa4e0c1c6f1baaf7ff0603a36e6e92f8f3f1da52
MD5 32ac4dfa8acd0c8987cb2523ced6a0df
SHA1 3df3e93a977c0bc67a3cbc6208c1e4eacb52985a
SHA512 38ac06b689d5b3911f03aed90618587eb64530f2cbb2bfe3421153adfc0caa4ee86926eb495b5f0670dea31f9cec211333f0d364a756c9be4b1f7536a73bd466
SSDEEP 24576:z7NM9YmZqmWMUkPjZM48Mv6bEhsJUTWuKk0fob0gEEVFQmic8WU:z7cBWMpPjN8DbEhcUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 eb72ad6d519031d7bde959b4c786044a9ada81c0878ad43c0f5f71ef30d63194
MD5 d73f0799005bfad0bc8fe8cae166d0c1
SHA1 0d81c0596bd92d782b099758b604936bf3849fec
SHA512 00a1e6c9702eed706948c2daf0302f9de0c3f0ade97d584629286dbb6b24b2b22b2ab1b3612a4f3fdab4606171c23f1ab8f817e1284eb575e775fb4d09b4ca9a
SSDEEP 49152:uF2YuHNETovcvNYf8kmpUyuFlIAFQmd8WU:f6tCf8keUyuFC4Qmd1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 625135bd9ce45797bc4956a0180889bddaa3c30e11e087f0f0983c21f4c0f0cd
MD5 85fe4acc1dbbcb0d5e7b0e00bbf87857
SHA1 ec4cb1ac63146a66ed45d4c5b6443379c5b95e08
SHA512 df171a1c5ca8960c594c6cfb549b00bc8de352276d2d1aab5e55713665fac3092e20e4337acb4034d878d850f3668e1fd3840c1adb8c00db1b42d588cd39f424
SSDEEP 24576:mAFs06+Omlf3NXEbToiUTWuKk0fob0gEEVFQmic8WU:PFs060lVXuvUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 89e588739fa8d98773b3a6013fe4f88d1e9991e6cab7af59305c26cca3c41c10
MD5 6b46fd400381a17584d6be1afd235668
SHA1 b73c29eabc36373e1edb35d7548413ad5da3c0bf
SHA512 04d7edc26efa8d0a58a0398f62c97e540467cdd286017310488d39335a3d3630c11fa9224f22197dd6bb2d3433975db42a32a11f4268d3de3571abd2fd215e13
SSDEEP 24576:oJnJ5D3WHvUTWuKk0fob0gEEVFQmic8WU:oJnJ5DGHvUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8f4bf68bc2b56ddbe7289fd7a5649779119a5909ffff0bb74a5c48352758467d
MD5 8ff61733cb48a5c432d1581d60052771
SHA1 2aeb0f37bc3a8aeb3471acf0e93d41bacdf8e1b8
SHA512 41cd5e5a0af0ef46d12aca65ae5894cb7e7f6fa7783b61f4521f208838529ae351ce2e1ecd40553a6f0b52e8c4d229eef77229203640fa5209c3657ddc2fa30d
SSDEEP 49152:/o06DIKdwc+eQnSt65aVFUyuFlIAFQmd8WU:A7UyuFC4Qmd1
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 68ee3497000268adf8023cb416ced074fcf44f8043f4e309b6a139af418b212b
MD5 dab062af35396f8e29052e995df38ba0
SHA1 dd6d79ba0610903a82ddf1c36dcf4570b41763de
SHA512 7bde885a7b92b1c08f10ed2fd7e159d3cf223a97b8aa2882b859ec02f349bfdd1593ccb98ca3106d7f0d635e3b005f6df9be2a102ceb822e4d59c9e9ba2df9f2
SSDEEP 12288:TEP3R1zaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:Y1zUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 162bc42495c30f2d6260cd7fc770b636d6cd86abebf9c7b96070b696c6fb0e41
MD5 f3212cebe590817865152f94211f4718
SHA1 5b75d769cbf6f8dff29d25af0a4f318013a6998a
SHA512 4f952d439909838c1384f6d3a0efc17844c9eac517b81965ace71712166dfc788af9c6c2b45cb88b79535972aa269243b488e0e096218fb2c1968a073383695d
SSDEEP 12288:djkysaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:dIysUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 ac466edfdfbe0b0124a848f79624c33a38becff45fa5f35392a6d2264f780788
MD5 dccb1f17ff30a51ed7332a2d49b4d529
SHA1 405ebc6fa5f1207aff991b8a78f36947286cb8a5
SHA512 e74769a17d30d47e66579257f7ba0ce793cae140848f098e826ebc33b20f2eeba00a2c690d51f48323e812aebcb45de88139398f75a2fc7b9bb54d85d2fec689
SSDEEP 12288:NKOaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:cOUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3cd9059733bcfd56b83f3c411639ae88f6a4802dbfb7e3d04e5604f195e24de4
MD5 640104650beaeaaddc0bdabcf05dc55a
SHA1 53d6bf6d01b5d27ff99780dfc20ee42103cbcb74
SHA512 3050510e27baebccdce5c93d61b9b503155da972c928b8ca788adc98845dde2b6ecba213d6bd2cfe3ae1005d542f7ee50fa455d781f8bf14a11f95fdcbbf9976
SSDEEP 24576:MQ9MxZKdcz97w3hUTWuKk0fob0gEEVFQmic8WU:MVKXhUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 bf562fc8d1d71f196a9b982528f90740a04864bf14a27b356537722be5c1d01d
MD5 ad4945a850460e5880f50e1518987076
SHA1 6839840898a9c58f45c9775e33f4ea485db5d04b
SHA512 555e20e9304592552011c928d070daf5967152c6f437967661e3b450249d8f3d8aecc6c212b9c3f1e0434fa4cb3553f8c47964c65775791d1a9db23cd3950c07
SSDEEP 12288:ZyoKo2tRple9pgaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:ZyocvApgUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 77230e7233a04d503dd1a747809aff8277ef230b22d69a2fc1e05461bc261b59
MD5 55ef3a06dbefc8b02b2a645a218d4232
SHA1 f52f94779a6f98edc2bcc3a082b95e79d9ba5b27
SHA512 6998ddfa01882fada8bd3321e645de64fea2644be47ed1666c31c6467fb1140bcbbd49ae70ada6e4b654c424b789ad746bf23f60ad0648adeac15e987fe985d5
SSDEEP 49152:DWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKgUyuFlIAFQmd8WU:D0zuNIUUyuFC4Qmd1
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 15b8c000eff53cca19356708932910f45f95b267e3a6f840eed381fb017a43c4
MD5 6d2de628fd9aaf967248b80fb752ee11
SHA1 777aa084b3676921226f813f78c9c8e6aa807acc
SHA512 fffa68b246837dfba52f60816681b66e6e57f0a12174e41df7352b3d279d575bef06f2be9045610049f2c8ef79595e6975438c830a6a8d0b60d9c40952827d5c
SSDEEP 24576:J1QT7EcpfxR+N5AWAz3ooiYtjMqbzUTWuKk0fob0gEEVFQmic8WU:cTDxR+N5YzTfjM+UyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 bf8a5730702e8da5b8e6b204072f00ebb9363705bfe2ea42caa448f7e419401c
MD5 fcce79baa438e678340be52cc9d948a0
SHA1 ed7e5e672cd43378adcddd33416320bb35d6dd6d
SHA512 7f5698895f3dda5c596372a58a728c12f5c0dd66194dc61229ed2d927f0364d33dfe429c95ecd6a9df2b5118aab1f6237d7caf1d6b16547c84e8e192a5ed27ba
SSDEEP 24576:fTMdOz0FFS+omSLHUTWuKk0fob0gEEVFQmic8WU:90K+omSLHUyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 460d796fb67073c7b8034a02aa1b60c373700366b7947a4fd4fea7223653d06b
MD5 bf08a290f21076da226fa69b0d52fb2f
SHA1 62490770d03217b9bf3a9a121ec59358b56ee70d
SHA512 cc2d8d61d378bb1e83a5c92416b7d88b2e3a460faacc2316e4f45f67d6a9cfa562161d8be73abe49f344bf6403c9115ff1a2cd194b87a61bdbb2c942ce469e0d
SSDEEP 12288:q4NqaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:nqUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-61-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/552-59-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/552-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/552-45-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/552-39-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1452-113-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/1452-243-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/1460-112-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1460-12-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1460-18-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1460-20-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1460-19-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1688-217-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1844-232-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1844-640-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2112-603-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/2112-193-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/2400-127-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/2400-255-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/2512-641-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2512-252-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2604-604-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2604-196-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2736-99-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/2736-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2748-256-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/2748-642-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/2756-605-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2756-229-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3220-602-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3220-172-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3616-34-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3616-35-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3640-98-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/3640-85-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3640-75-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3640-81-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3640-74-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/3760-598-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/3760-169-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/3944-49-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3944-171-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3944-57-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3944-55-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4004-459-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4004-6-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4004-0-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4004-457-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/4004-9-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/4404-276-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/4404-137-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/4500-601-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4500-148-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4500-449-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4568-110-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4568-231-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4896-277-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4896-643-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5008-70-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/5008-192-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/5008-71-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/5008-63-0x00000000001A0000-0x0000000000200000-memory.dmp

Download