fc500eb9be79507b4b2984177c752dbcb5d49023924a505311e584b05e1f9bc7

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
Size 603KB
Sample240613-jcb2bstbrj
SHA256 fc500eb9be79507b4b2984177c752dbcb5d49023924a505311e584b05e1f9bc7
MD5 697036903a79867ca14d917335eaa350
SHA1 f6a4659fe2ea53c2364bc5b1ef51649b496cf9fa
SHA512 134d34fec119d6393705b22e4e23f7f2c141cc19386eb31f557e7d4ca30b8d8f8be2eb5b923f779974620e8d6c56d6f2021d193fed8e604f0fc661efbeb8e547
SSDEEP 12288:XAvFpASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/R:XAvFpLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4820	alg.exe
4084	DiagnosticsHub.StandardCollector.Service.exe
1824	fxssvc.exe
5052	elevation_service.exe
1992	elevation_service.exe
4432	maintenanceservice.exe
5056	msdtc.exe
4416	OSE.EXE
2564	PerceptionSimulationService.exe
3028	perfhost.exe
2984	locator.exe
3120	SensorDataService.exe
2208	snmptrap.exe
4620	spectrum.exe
2760	ssh-agent.exe
2280	TieringEngineService.exe
3224	AgentService.exe
1696	vds.exe
3444	vssvc.exe
5072	wbengine.exe
1492	WmiApSrv.exe
2724	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\spectrum.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\770d713e1ed82f9f.bin	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\msdtc.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\locator.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AgentService.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\vssvc.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\vds.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{38ACDD0D-FF02-4A34-B36C-7A103582B8C1}\chrome_installer.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5ce77aa63bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004393d6a863bdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c456eaa63bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016a8caa863bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc5781aa63bdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5191ea963bdda01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
Token: SeAuditPrivilege	1824	fxssvc.exe
Token: SeRestorePrivilege	2280	TieringEngineService.exe
Token: SeManageVolumePrivilege	2280	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3224	AgentService.exe
Token: SeBackupPrivilege	3444	vssvc.exe
Token: SeRestorePrivilege	3444	vssvc.exe
Token: SeAuditPrivilege	3444	vssvc.exe
Token: SeBackupPrivilege	5072	wbengine.exe
Token: SeRestorePrivilege	5072	wbengine.exe
Token: SeSecurityPrivilege	5072	wbengine.exe
Token: 33	2724	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2724	SearchIndexer.exe
Token: SeDebugPrivilege	2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
Token: SeDebugPrivilege	2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
Token: SeDebugPrivilege	2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
Token: SeDebugPrivilege	2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
Token: SeDebugPrivilege	2184	697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
Token: SeDebugPrivilege	4820	alg.exe
Token: SeDebugPrivilege	4820	alg.exe
Token: SeDebugPrivilege	4820	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 5112	2724	SearchIndexer.exe	110
PID 2724 wrote to memory of 5112	2724	SearchIndexer.exe	110
PID 2724 wrote to memory of 3880	2724	SearchIndexer.exe	111
PID 2724 wrote to memory of 3880	2724	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\697036903a79867ca14d917335eaa350_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\697036903a79867ca14d917335eaa350_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:740

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1992

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5056

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2564

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3028

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2984

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3120

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2208

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4620

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2680

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1696

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1492

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5112
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 12da6980ec90ae64314fb02aa6af564c470aa3c7bcffeccef46f199477ddb911
MD5 06b0fb10afdb7722e8c4870dd3b4ec1f
SHA1 8f08c73e4bbf7d29b03bfa0e8ef16687090d7535
SHA512 d06ff10fef0d78cb61a85955529210b48f4f3b8793c660f4af58ee64f225dcc03068cd44b8809931c678b620030e4bad6266b6692a48e1fe265a02e53ec666b1
SSDEEP 49152:7uYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5Avu6olbnoQx1:7PfTqi90bOu6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 19ae8eb2029dc87bf2c476a913d3b83c2b47ef93b66fab68f47d7d84b32be8c7
MD5 5fdbc6240bfb4fbff3024d1b51a10d25
SHA1 4f9e36946b504bd75ead82c2701fca9d91f88d54
SHA512 a599a73291258643f30d22bdae2efbe10e567c04876c7e4376204d437034046820b8a8d9ce60c1b3698509cf4a05ba523a8ee945f371a345d8d1975310f871ba
SSDEEP 24576:9idnBsuEWLUDvpg6AtlbniXHhHwp7Dp/:ESu+vu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 48ae201e12332acd7f998192644e1a988d41ef55923bb5f0e8bcb36364fd168d
MD5 599aeaeda1ec81cd90d9b97dad342b18
SHA1 802b6ee8859a992b60216019d92116e3d73d36b6
SHA512 a06828af184debf44326ef25db52e4ad927129bc316fb1b1fcee0a113e7d95c5a0b666df47f36a46493e5502c17ae742089433d6924840e105c5a058e5326560
SSDEEP 24576:K+gkEVfh4CoiLUDvpg6AtlbniXHhHwp7Dp/:vgkExStvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 14f70b44e2f73f4f628e9e2bb04e1fdf3664ff6881e663e124795d1ec0da110f
MD5 ef2a97c7f4d28a33838c4bc886b67b5b
SHA1 c59237ddd8fd6ad744315d8488af8e9abff31533
SHA512 12dab6973b97eb4c7993d845ba91e3080b9a5f6eb8953b8f8a5e3cfb1d422d2fca98b7ef1b6b4225dce12f3ca73fc69f10a795aa431ebbae1a3105619d1562a5
SSDEEP 24576:DBpDRmi78gkPXlyo0GxjrZLUDvpg6AtlbniXHhHwp7Dp/:FNRmi78gkPX4o0Gxjgvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 84288f47f29f31757bc1418534712a0ad4e6e36054cb149fdd4224ad26f99c88
MD5 4424abc8091ed602142b4b736d012cb7
SHA1 3d465af9cf27607cdff9ba6c150c790f250dd16e
SHA512 41051c967ad47fd897e02c7f9364bac9c4ebcbc05020c3324e9cc7b019829079ae6ea5eb229ed77ca57a38ff727853ea98eb8bdc0d7cc6cb9b3dcf2015cd4823
SSDEEP 24576:ZLOS2oyPIXViLUDvpg6AtlbniXHhHwp7Dp/:j/yYvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ec5f30a6b665faaf052378fd540a0224937adb6d4f502a7c529a7d174f6bc47d
MD5 b03a33e7ce5f490e0f71f2d239c19392
SHA1 e4eaf0f9b67b531af16ba21d80e1ac267a19e999
SHA512 00ca3c08be108cc2d255d676cb4ebc3b1cf75ee629830dc747570cc021061b38870f12455f26bc83c71bf21f2f53a00e0e2ae1e8fe164bd05068268c5a89061f
SSDEEP 12288:DfMASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/T:DfMLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 d9e2348a476410a94d4233f7a13578ee62d4e36dd909dcd2a21560ca00a3d7e6
MD5 e6f011199705721362d019eab6e1fe76
SHA1 177bdbe550a24c8bd25e8179d3729396201a19ad
SHA512 a6c5f2fba0300c765f211180fc838ec59da245b14705af73e15ceba260d5bcf93b873eafa9d8f0267e034dce892a7a3d3c997a80c955d9c260d621b0663dc426
SSDEEP 12288:seBNUbTVO86U7ASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdpV:sJIU7LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 27d857970c84b5ecb02fbac3b6b214916b39053204d821126a30e2b5a3bc588d
MD5 9c67cb0d21ae7d056299657d4972b650
SHA1 42d2135ccc62151cbd2f43e4b17dca2b08586b05
SHA512 89b562169414bb8dc616bf442fc1e38a66c6221fa96d77ce7472745ac142594e36ad1ab4ffe854676fe3d5d19cfdf4d74aada9e67616b156b2c50f244977ef41
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:IQvGAdlCEL8c/yRNw5Cju6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 57b8e6ee13923e651912cd28ea6607505c97c0ae18c5b69bfb2852c2ce5a8bff
MD5 9a0d41fdb91999e79c0b78113e0059f8
SHA1 8f7613808bf7554fab811e59588942300c5955e2
SHA512 45cdbaca299993d5def5b3b5de47e904e426a3e29874d7fc619d1c5d89ebc2b418f1ead5be00745ec1512769c6462649455f67d3f8b81d7d9cf883bc89e881b7
SSDEEP 12288:QAwSfxL/2Dc34DLLmt0LDQewsAjBASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mc9:ldewsAjBLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f27ff55918974ac8eb5d2920365635ce5588d28e35db2d59f32de0e769550a96
MD5 c66a4baeb61b92c4a08b261c775c16fb
SHA1 06e285226af21cd77eaa7fb3ef9551dc43c06697
SHA512 de719d6a5a68b3d464e4a6ff8a422fdb0f14b87ffe3b78be5a1c8abb41f7d6afe31a7c76aac21286e060f2a4830a90656e5ac8fda6dcf54094a8496135ce4d4a
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHh6J:DUEtQevvqc2W1cpV2EI32h
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6115a29deed74459e1d5f2f13fadac2b0388a2a2bcb00a3229f1e4e0112f8bee
MD5 838b86e595acf4e0a8820f2931a998a0
SHA1 c19cb90b542a186191c0fc6ca12cf3e18a14833c
SHA512 5d905a0072ee5e8468794e3c9165f206c5d0e45f1abcbdbdb8f630740739ed43decd36845eaa31157e10bc6868fbe33a3f611b5d970c8a3bd30e6b1c746aa30a
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zsvu6olbnoQx1:koquVjnmXu6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 12833e592b6a05fb510f51f2cc2fbe0055883f7cf0082b0a8f07d72bff0e3735
MD5 9d7b532b77010db7d3f717aa925b4617
SHA1 f6143692900f571a73575bab984d1c0f784a8f74
SHA512 0075701cd874f3bb1539b2123543e438270528cc91d9ec3369a69a8ffae55ff827004b6e6c441ed4d6aff5d42ee4efd140062b9965e5cbef13d0654d488290f8
SSDEEP 24576:7AhGLJIFoiwtA5l7S53yLUDvpg6AtlbniXHhHwp7Dp/:7AMyFoiq5fvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5d83c66a4727434507709fb5a8e90b095e5211ecb45bcd6d61e89acfe0ca40cb
MD5 53d9fe0f5f6828c3b2c4edae1ea170f2
SHA1 916686892b2898f571b5349ef355bad625b7e354
SHA512 7ec00cf43638b13cf772f287f8b0a625e85e552a7dfe9514d6ab9ced4b13307d8cb232211a6d8d6b551932dc62fa1ce555ae7a055c9c6a2659dd67c966403e7e
SSDEEP 12288:amw5HEjsChNVBFgl0WDm+CuASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAx/:zwuoOW1LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c6b82ccc153dd778ea7ddd2ac27d8719870df431eb9aa44c18870bfaf9b28f9f
MD5 5035c5b99f16d6787bd3d93ce72a722b
SHA1 48527bf56371ce88a720729c00537c62d8f92335
SHA512 5c4ce30a0e02da85f109c1424b480ff2ee57f8d1bff15d5aad78a596787dd4f4d18485fd2a7e4b7516242bc029c9aa97c09741b2b5fc148d760564f4e6177075
SSDEEP 12288:IBZ1IyxASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/5:2Zu4LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 4a71027e9011a285200cb8e5593511ca928a63dd7ac19f05ef1788f7a8ad1b37
MD5 b027683e7b2f87377effae3cd1d09269
SHA1 8c11bf054176d44fa42a03ef1817fdd217bd9d8c
SHA512 c30ea81d71ee2f819fe30b7ef1c606c608a25c9dfcb5587aeb2b7ed7ef47d79e161107254cb581d679200aa39cc7dcf4f768e3b815fd6d7019688e8b64ce0e6f
SSDEEP 49152:L0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLb:XwfhY7g/rLd7yYA3awr341g/u6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 e22c1955a23fc1ea1024dd09efa7793ef3ffc6bd251fc4a5a4d8a9b84794ae51
MD5 a0380eb1a2747029b332584a400dfc37
SHA1 294b0635854f96dbd1ac41735b3cd8224ecccf4a
SHA512 29f46380efea3c5f4097e6e00c64afa9034669875ae0ef39a5047a57f65c27d22aa5452ba6cdbb1df94183c1bf4de401812bc87acfa2c3ea8e26d24dddcb9ac8
SSDEEP 49152:N0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLb:1wfhY7g/rLd7yYA3awr341g/u6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 8ca339feb796ef7f0d6f98eb916318fb200351bc3b5a7ff57ee5d08aa7ef0101
MD5 bbe2d69f1eaf6b1da48f0a8d08c08b2b
SHA1 d3d85799dca8dbd29752886ebda871e9de64bd5f
SHA512 fec15608db091cb7e171c61f9b836f79fe30976290e3a461737c902654a6d6e28cd95f5736559ad1cd1353dda769283070f00c28efac99c561193149dd258edc
SSDEEP 24576:1cTyYv0FteQU+5I2kjgD6iQacA1LUDvpg6AtlbniXHhHwp7Dp/:1uXv0Ftpn5606zOYvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 a0a951387d8218ed4ab97930293f34add95172b12140aaf24637ff974e261694
MD5 d7218944dedf454d130821cfd910d100
SHA1 b1c4c06f0d0ff63a5df5b27496e105954cb5abb7
SHA512 ce1f4a8ad2882738456f1d16a2a0f9c5004d3912c34d2cca6b278c3d544e7ab61af2a86c31bb242f1e74a1b163ddee1229d0ca44023ab23ffaf0519c72da63bc
SSDEEP 49152:oy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxMvu6olbnoQx1:XmYeyxHjWjMTOu6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 0ac0c9ab4eb6ca7a65e3304c582e8ba5dc3fb663b36f7d4da5491ccdb6bf2caa
MD5 2b6334af066de10632f14bdbcce91d84
SHA1 fe1e55aa4580b508098ef6f68075005f5c64096d
SHA512 3646bf4250ce8ab665fdfb8146f94af6c36d77d3b365c093f712894f7f107157d8148afd11df95d32caaf10de05863a3587450a09638793e77e1006992921144
SSDEEP 24576:n6drZn1WEci182IEUeNbJeRgUebgW816ALUDvpg6AtlbniXHhHwp7Dp/:nWnDci18yNNUgbYAvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 a8a03f5779fab4c94e290b5330de1d81d709740afcba80d63192d0684d6bd63c
MD5 889cbc5b27701f8684d97f3cb0f71b24
SHA1 326e25d8dcb77075a5a8e9da8859f238b2601bee
SHA512 1956dd2544171d0caabd332424d9a0b73208ee4578c12936004ff26fcc4fc20027b5bfc2aad367f6a41eeb36ec143ef8d784d451e7412cbb21c92afbd74d9171
SSDEEP 24576:Dk5lHW5EzMZupO80G2reD+melRgTTv/1nyHLUDvpg6AtlbniXHhHwp7Dp/:zizMZm0GhamSoxvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 df047c830e37e61d837b20122abb5d1eff3be5f786be47cd3b545c3979e86152
MD5 babbd2e51a1decacea5e82f519c52a61
SHA1 16136dd30fd32944c97871a3d87b591f5934f524
SHA512 1ada4263cc9a1b0f609c0d7cc7c702b5ac200dd1d912dffda24fb43f8c698a63dd5a2a4b7c0201982b980eb1f0ba9d1cb3e581d9a478fca8c00f990fe993496a
SSDEEP 12288:ckASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/x:ckLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 46d951bad9b4732c46525651452f4d86d02acec2e45b4c5b011973a2d49ce6cc
MD5 3bef51a76553bbac0f48151a161ef0d3
SHA1 e0d6232be0a882817c00f5593f114e6ab8fa99ff
SHA512 b0a121ad9412c57cd12429a4a253efbc589e31c51cc37daea11cc424aa0bfb5a671b52b81929c2a6a96ca1b8bf044f90d3cfca9a3595cf7ee676c13fcd8290a1
SSDEEP 12288:TdASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/c:TdLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 a2435bfc7c2d348df38b73d4bf00e2a218462834bbbbf509d3cda0af027feab3
MD5 63d9dc3e117e9de018a810315d1e447e
SHA1 34e0b3b4faa71fc58f722bfc1e19769795b3351c
SHA512 b4ab371c99f2b2032006db19ec9db37efec1fd238d7621640cfc2f22fa9b65847c622803fbe15a401d85ee0241d239f4c8ca5418fa629b4c4b76338f178d47f2
SSDEEP 12288:uTASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/+:uTLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 917c4b54aa4428d988ce8ef2d8a402c8647df9750450c7e6c80725b5eb38fe18
MD5 7bda14c6439bd72214c46f4450e9130c
SHA1 d84deb71bf690de7b383f18b97182ff3a93ee873
SHA512 a458d91f38d8b05a8503fcfd0a45d5c27b4fc33e31522ad22c140bfac6f41adab60d3e46fe90ce152a2a0028bc967bc0acb7aac310beb6fc4b3fa809d252fb2a
SSDEEP 12288:RVSASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/y:uLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d293c22efc215c98e9faba72bbfd9c6f5b6b369be3e06cfa84cfd5ea6a558cd0
MD5 7b93d83113c5ae5b1305166501382ff4
SHA1 e1d838cfbdd758a5333d7e4d15f6c2884772e4c8
SHA512 1c688aaa1f20ae92170928b9d49df3a6857f9a34fb6c69cb3aa3d5eedd786f89dad3ae878a1f9a86848f3bcdffd6bd3fba711bd737e8790c8deddb3465da174a
SSDEEP 12288:v6ASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/7:v6LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 2d33aed3f6f8301289e187cd92054491e92827d9e99a027253d680e432ae3709
MD5 ba5a901aec348a9a20fcf9af83716f95
SHA1 cfb5f646fff7ad4ae7c6cf1a05cb25012bb05a23
SHA512 df9123e2f7cd50a9c2674dec7585d1341d322d98f2b2e03a6f498f72c68a54ff76a82ce18d4034733394f7e97fbb653ca29a2ec869892c758efcdd5c99730fbd
SSDEEP 12288:KZASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/7:KZLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 485c76a5463b2027845d6f2c7783f2809775385326878aea719cca37934ee510
MD5 e3d38ce5eef38bf57a2ead7ab76f3b12
SHA1 688a738c745f3955843c72cdf3d67ec7f5c2c79e
SHA512 e5829ead42441a54d5cb9b345e913ff15da7591e4c0a886b9006da6ad7852e59393e4aea80e13a397edc4433aaab632a00f0da2ab872aefbc3f3eaf960a41914
SSDEEP 12288:dFASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/4:dFLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a3f5c64bc992cd7e46b477de1f29d57a59b671ed4ab6c79898fa1d94343c9fd3
MD5 7acdb9429555167a54cdabf86ba4e4f2
SHA1 deba3cc06b45d7d52849232c0bf52894057ec535
SHA512 9c5a16f937534f07f3e7e0d4084427c410fd8c237ce6a82be4d3370a2f329c418d724f686c1d9efcb1a2951941e1c278f617163f52475c735d41465d0eb7cce8
SSDEEP 24576:fZMSzFVSO9LUDvpg6AtlbniXHhHwp7Dp/:fZMSzfEvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 611aab656cc17f29246080e2ffab26e717e331c7f95260a90f26663d98872588
MD5 35873a7c28ebbd421e5a22bf6c3da44d
SHA1 5f610b29178c57311c0b8d3cc47a67cd1ec01558
SHA512 18a379613965b9c24e4d1bda31ba1b905baef271352fc6be4db14b41ba6f5808cfdce9ef855617403855e21eac8d9a596ebfebed0126f57154bb00ea86b6f701
SSDEEP 12288:woASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/c:woLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 84e429a386cec10b965321e0ae03550e38fd8e1cbd6ad2ce7f7fce0cce4adb71
MD5 da5f4ffb13e717767564363be8626d1b
SHA1 cffc12848be3b13447c9943670282bab720578ac
SHA512 7c9a3e9591c8571709c3f161bc86e2e8e9706117bd4a244285b6cfa98587b342b814c46a81d7da53a201a8967db1b0c2f2581ec68b0764e9b1c532e08212db71
SSDEEP 12288:98ASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/e:98LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a0ab5f8733b53fbaa053d8caf9fdd329390af6a901c0eecda33b15342abb94ec
MD5 b13d0496636c97267a36a0b97cd71fe1
SHA1 1294b09c4ac6bea61110f12a627d9b9b294fa03b
SHA512 605ace69243654463c1587a7e21d2addcc929185a98f8803eba9a342973b6f197ae9e24bb25f3c028956c4835e8bf42aea3ffe104e670cf990befdc5fb1e3ee4
SSDEEP 12288:8yPz5L8xASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/A:lzyxLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 311c3eb5666eb14213743434e6dd4538b251cdc2927a93e6cb51eb09517922bc
MD5 4dcc573402dbcd3d94c5afd473dd823a
SHA1 4a1d456ea3e1dc64f874993dfb5512dd2b2c59b3
SHA512 d656be8a39ed9ecd1ffeb93137dcb340896c274d47c747902130dc865414a2b199624f2524aa43a595986b4f276c811f46746b5fe574c71f43cc864591c6433c
SSDEEP 12288:OoASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/T:OoLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 d21ff74b12bca32a7066b8adcc125d67668a308dd034f8f56eb69caba5e251d2
MD5 eeb7c3b73d40af3491bd6788dcdddac1
SHA1 56c35b8869e8ac8bc8fb8d6c93f3503cb41bf5f5
SHA512 ea1a6f868c029592246f3565af46c9ae02931de86e22f042242276bae09686225e7a8364e7b47078794c236eab253466ee9e20de5a6254cd331ea756f47227ba
SSDEEP 12288:LoASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/s:LoLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 97c51e5a88db071fd18c3797dd6ecf8c35fdeedb8e45423a1bc2ee21f1bc83f8
MD5 ca739a8e11ae2db42df5ed6961d4a7e3
SHA1 33588026a5900eb25426ad15796cf28c5114f860
SHA512 973adefbaa1c431418b839e093aff1a0af66e18a76583b4fcba0477ee95de44c517c800d144daff6ae50c0d2aac7fb97b1070a1491fca1c4c61453fe11f9ec02
SSDEEP 12288:syPz5L8xASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/y:1zyxLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 15d675f10aeefb98e06c460e78484122fb541c909aa25409055df3fa585a69a9
MD5 0a4e821eceeef83fa63854b9ebdb26fd
SHA1 ffe83d59bff260378232e05c43fae0c4adb93558
SHA512 367f875e1e0ba5e468cfa3382fbd594be6ea4a9c3696319e8d855c6bc43ed2edad18131dc78a2af6ab0d3c3adceeec20669c98baef8df43aad1be9b9120cf337
SSDEEP 24576:DTHaLl3z0zDjLUDvpg6AtlbniXHhHwp7Dp/:DT6LljDvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 31aef97f6fb7c24b93af11ed455606ff0e76ddd359cdbce5e6801229bcab7600
MD5 46939346202e8c67cd2ff8b916ddcb3f
SHA1 77b51e4260530b96b38bde571f77f4c9b2b69f51
SHA512 116af422448231e430c05aea556bfaddfe649156d0e568368389bb8005ed76ecf4422c34fca0dd42508e681a0449b365dcf2f015928ba2b4c93454b2a7773a7c
SSDEEP 24576:437d9CHKy7GZvLUDvpg6AtlbniXHhHwp7Dp/:C7d9CHKyaEvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 decaeb45cf8913954c932245abd805df012c1038493a342a5b78ed4d50924d9f
MD5 7b06ac2e0e6c4d2406cc54e77a810671
SHA1 999b9a44ba0cfe6cabc3c5baaa2768246c912e90
SHA512 7e08b9cdbc6570086270417f7225cf260f82d00e001fe7933458ea3771a558a332fa91822c319d048221d38b655e64a75e29633fe73c19b804613542d8b9372e
SSDEEP 24576:lcP4mcvIjkGOxhKP2l71SNKbrh/8KBQLUDvpg6AtlbniXHhHwp7Dp/:qP4m4IpOO67N8KTvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 fbd6e00bf199bdb083e620266e34b83418c1fac2b226129f902fd5fc6e87f7f4
MD5 840825d4b291a6645221acc911ff3035
SHA1 742ec5812fcfa9fdd1e50d1033d7b41a16530d82
SHA512 e210c5a74d6b14f24935bf8c1194c42797009153bc862ccc3f9b5d267765d973bf92bd4810522112e741427454b95e6d42021d7733faa819bb868e9215a151af
SSDEEP 12288:fUFmDDL/ASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/f://LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a5b821bc66505d46a02365066ad2435b5650daa2dc03717614ad738109fc5232
MD5 7f064f5cabc12fc7d81ec758268328e7
SHA1 e41df08a45dda0e0d3ac6694a17ee6b458ec1fca
SHA512 008a0559659360d0b8b793f15fa173f30ddff520277cbf4badd2fd5f5bb3bec71f4382f0ec830a9f16a9a506aad51c5c17f54f5bc1b7a5eb41e0f755dfcb4c46
SSDEEP 12288:QYASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/S:QYLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 50a8b03f3cf2e56ffb951301859e1c9e572cb563cdffb89fc835234be309a7c8
MD5 fdb7f97d8953755c972419ab86f8cfe4
SHA1 09c94e4cd19bc0c623a960bb38ee5bb296627764
SHA512 cbd187b9ad2f8e9cdc18d5406ad551d6fcbd853511ba5efd2a5ac2b8529dea6e820b4d90ecce68af0fe4aa15b4a456ee0db631a5f7836a340afb586f947f227d
SSDEEP 49152:Oa0h2GEkuAe73q3pp46zwwQnvu6olbnoQx1:Oa0hNYG4JwGu6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 a22c7b98c2407264e7bfa91de68a6117fb1b86a57bf58a2648c483d96a6e5ab3
MD5 3147a7f38032f0778a7a8317231fd925
SHA1 46f2f121c383bc49d6bb59eaf6368c973d4047da
SHA512 a58ca737c91beb296debfd4f3695b5b060e8703c3499e86899876e97dcf53e3663dc844db4fee8b3cf6f3e07ec00145040e7b8ec30e9984aef819739a07ec8f7
SSDEEP 12288:8hbHjfXtASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/6:8hbHjPtLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f61941d685b5364dabbfbbaf1d4064b74ba595903874b8f03ea4ba9cf38d7603
MD5 2d87102bd24a329ab83f7fdf73b9adaa
SHA1 e68601fdea428a0bfb75eac13bfb3221ccab6ff8
SHA512 25d49f49dd49c5f63b10beea850f19eb233242ace9fa73f4c6deadfa228732466d316af79b90400d689b68b90df060bffef8fcdf8bf60aabc787fc18f37accdf
SSDEEP 24576:g3YgnJcRTk4yti+R5dpR/1LUDvpg6AtlbniXHhHwp7Dp/:gIgnaTk46ppR/Yvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 ebcef8c656d91eccb939929150c6e325c87e0dc7dc5e990ff45146829b09f418
MD5 b2b0976eedf6ff66fce7eb7e49e90f12
SHA1 da27384c45b430ac2f0df67978dae7216233f65d
SHA512 d82a27608e5a552bebe770a7de2ebfcdfa859f5e51d6c7399277617c4ecd6eca9b502f5f71358540706cfd8370088410b9011f81bca3c3b78fa4da7d6d198e35
SSDEEP 12288:ssASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/6:ssLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 3b92ea234572bcc767ef1f75d044163286a180ff2b111424fb20c6a4c88e8bc3
MD5 7daccb9b93cdfc4f111e82322bebec84
SHA1 e8db9e03629357a46ba8d656361d1192229def8d
SHA512 a9f54253c8371de82a3c2a7e89dd4137fb5a8782c80e94237fa8fea815bb0b93a8075a58da4df6d500061f39f20dae08e28053d6b03ed4e210758e9093d81464
SSDEEP 12288:IOb9A4LWOsvAYFT3ASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEU:lpL3UT3LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 ed4559db208a6318324b08940308d22df267582dcc5db80f83ef72f2aeacd499
MD5 7b83c868cd2b3bcfcfa50714bf5f6811
SHA1 adb4da8c328b4e8d97aa4337758202d5276d8828
SHA512 5d18b12ed9c5117bda4469c7f9ba2b3227657d19bac5ec848a4013479547f36b8903c011851d657145aa3bc98402d0e4f5a5b69a7baca62f1ebcb4526e3116d5
SSDEEP 12288:spFtpObASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/B:mObLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cbc100c3c146823c8cafbb0d3a4edb470c7deacacfc52c69e35ec2a96f559c46
MD5 b534111ab0ed763737f8d1e691de434e
SHA1 9f048aef659977f286567dc740612b620e7e90ee
SHA512 0b61ccc54a3bbf8ffe756aecf64bf025f05fb9fe70050d0427b925ab786daf70d51af5908fe9ddf7a57af7c6d549c6ed08a4017869251d65c5c157d855386630
SSDEEP 24576:U7NM9YmZqmWMUkPjZM48Mv6bEhsoLUDvpg6AtlbniXHhHwp7Dp/:U7cBWMpPjN8DbEhgvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e3a91f6fdb5e5bffd72da21f6f995bc4084d57ed383a5efead4269a30d30ffc7
MD5 d55dff69cd80add3d073e07fd8205b8f
SHA1 cfcbd24f4b1e9488edb7c7c7b6fa7ae0f1dc666a
SHA512 d33b5e024e453266ac6978bae859b6166e5441a503f30317d11ea9a692351a78af6d45cf9988380511dcf8b1d62d2aa96698653bb6a48d901c49c8b8558c609a
SSDEEP 24576:YW6BApg2YuyuNDYTabvcRvNYf8km12LUDvpg6AtlbniXHhHwp7Dp/:YF2YuHNETovcvNYf8kmhvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f1e04e763ace031415ddd3c86dc74d1c61219ef3509545ead25de76e8c65c44e
MD5 f4b48bed6104cd9aa1826b7c8c6572c6
SHA1 fd4e72a8cf1761ddb69ca5fb8e93b7110d06ae71
SHA512 8a9384f7fe4041c7c87341e296985cebf8eef0643c19aca175daadec6c3a2638fb87c5b31192cca087e7d2f3bc4bf0542e297eed158a78fccf760f4632b033fd
SSDEEP 24576:lAFs06+Omlf3NXEbTovLUDvpg6AtlbniXHhHwp7Dp/:qFs060lVXuHvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 57790f370336a3ecab91ba67e750accd63a24235af5753d77c3cd981f25b6a97
MD5 50d7f8a66acbd9e390f97521030c26ac
SHA1 f3c3899085fc3ce62b8ec62f51e24d3c4d834c8a
SHA512 c334db848eb31afd71092723501ac804a7b50b858d74fb0f811bd66450daae21ae27586f5848d570c23d009309bf925c6d8770ad2f23cbf523d5e1f6dd002b9f
SSDEEP 24576:3JnJ5D3WtaLUDvpg6AtlbniXHhHwp7Dp/:3JnJ5DGtHvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 cd2ac611c0cdc9a7035eec3493c108b5f4c0799ad98c6af8d44028d0f9484527
MD5 a9c407aab2fa5d51452f5c2f93f8535d
SHA1 c5c46e3113034b8a5232797374ee5e7c43a367cf
SHA512 74f2c013b1efe17d2b0d1e6ca5d540873b5492c0a95cf8fb4195b82eb800bd7cb3839f1448b71795f2002380068fda56f86a1b5f06623b7deb592fdc61020567
SSDEEP 49152:qo06DIKdwc+eQnSt65aV1vu6olbnoQx1:Lru6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 9cbab182f257500564eb38bc5defb8284026e987eedc9f62f0d28e546261b662
MD5 90c78866f2620d904a20c1c70c173c6b
SHA1 fd8ba60fcc5aaf6cf37fd475f9d72b9a7f7d9b33
SHA512 0d486b3d9290ae1a4786b507c9e95ad306fd916fda93d81bdebcdf47a32a1b665051b251e71b3eb95ef46d6d2443d8a7cdfd23666e55326a64a6318401b26cb0
SSDEEP 12288:+EP3RruASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/8:druLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 2bf0b568fd05a5b3134ada01745f8ba51ab59b5bb98255531f3f4f765d991906
MD5 a07cb9834cacc97d691472b6612e839e
SHA1 94d7bfb6248a0e1a125fe045b53ff66e50328246
SHA512 1f9cc1e7596982c940a17037a73499787be41885400b54c138ff51233524da466c7f2c1a90b51469e72ac7d852f3b7310c7f9dac60303b0e9e25a50e24185250
SSDEEP 12288:vjkydASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/5:vIydLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 ea5220ab2b9062710a2cfcbb31a165771f26cb189e472f520d6cd0f7121a9a05
MD5 a5f1a4181d51cc972173331933465730
SHA1 c61abf8fd6b7e233ef852d8d636b7cf9a791f205
SHA512 f7ecd649da87f07cd3af281130da8d1dd8a8cebfd1c5c7e6f64561bc25db1ff956b61475aca3e340e7e091a55938c7926c5b6d68423548219370e9304a222a23
SSDEEP 12288:3FLASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/S:VLLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7c4af0e49cada989e07a48279c2bfbc149ee1032bc69f32e632f4ed02b7fdecd
MD5 6720d32800bab913d774db933305cf10
SHA1 15ed43425272abb05e705bb7a4f128797c7be01e
SHA512 a9b9cfe8717c1fc4edc6c78f09a3f16bf660d41c2d99279d829bb407346df5a3a6484dfde7fda2feb770cb81a388eb1d0b099fea585084f899c6d5e415357cf6
SSDEEP 24576:8Q9MxZKdcz97w3gLUDvpg6AtlbniXHhHwp7Dp/:8VKXpvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 9c1e07df2da8ee738b465ca7f300ee0a968e722d3b414bcf0eac9757ed59a270
MD5 54d9a7e1606593035e59ad76b0c82c86
SHA1 ac91be076bac03e3a869a2f43ed6496656e4c359
SHA512 2abc2d9c71b2d24dab971314d79d1c61dc4f1e35b2bafd7301d2cd7b94d795ddb6bee10a7e27bb0c5f91ce65f14f0409344035bda84feba40ad37bb6998ca834
SSDEEP 12288:RyoKo2HRple9pBASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdC:RyocxApBLUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a739113585f0e9adb413b20579f4d6c86e73e73fd3a418ae22eada8003cc855d
MD5 fb1c1c1b3d8211be1a33d4826e95ed43
SHA1 aaf5f40cd3ed30fa6b26b56fbe493e4a8e72e675
SHA512 600268fe3056a7ed1adb616638dacb5e10a19bd37830c0e49253545ec7dc42526e7c8f2ce9666b5c36ffbeffa2f9e52fbabae884dd8d1643933b0b1d50aa8f67
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKMvu6olbnoQx1:T0zuNIyu6otnoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ef4cf465bc7fc9ef59509d9d778f49d91e758b763131b9ae10956d890b1c05ed
MD5 279720a6adf5ab17eb84cc4833d3a9c7
SHA1 c9445ec1ecc5cd2ab8d95a2c715a0aa90b506ae3
SHA512 2e92cea90c969a5581ed63ebc9ef935ae95bc1a009407f81f36d68a731518d435ad3680ff7b70135e0f9c2e13897e58559d8c85dea4d84ce1e7c6ca49fb324cc
SSDEEP 24576:m1QT7EcpfxR+N5AWAz3ooiYtjMqbuLUDvpg6AtlbniXHhHwp7Dp/:rTDxR+N5YzTfjMavu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 799db2714018adaa5421b176ba78a6f1169db15111f81cd94ccc004e432eeb0c
MD5 6e412fa08ba4659447512c914e9fca4b
SHA1 1a9b2651e613effe3e11b0e2274c9314614b13eb
SHA512 eea309fd4e66345c5d3ee690d2f9bba4506a342373abca4ceca76053aea4addb99d725038125fd64920038ebefdb1216d7e93690d88efb2445a3394e9e157bed
SSDEEP 24576:nTMdOz0FFS+imSLSLUDvpg6AtlbniXHhHwp7Dp/:V0K+imSLPvu6olbnoQx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 e61017f58bc18b03bb954eb6ce7b534a3905eaf52cd0b66a0349195ad00e5167
MD5 817cb3ec5b9e682b617b8cc05e88ff32
SHA1 89e7be64fce9931794028fbaa7082216c714781a
SHA512 7a5c206b5f302ead1aaec2cf27616790779040aa0017f0d68f8512fc23140a3abf79287f1e754a26df8ce544d8fb964b56689e94dd9c390bbc11577bbcc83ad7
SSDEEP 12288:j473ASUDvpg6iuLmt42bL7ZYjk2Daa8EHCL26mcrniAxPPetUJEkdp/k:m3LUDvpg6AtlbniXHhHwp7Dp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1492-252-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1492-628-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1696-225-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1696-623-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1824-37-0x0000000000A50000-0x0000000000AB0000-memory.dmp

Download

memory/1824-43-0x0000000000A50000-0x0000000000AB0000-memory.dmp

Download

memory/1824-57-0x0000000000A50000-0x0000000000AB0000-memory.dmp

Download

memory/1824-45-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1824-59-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1992-62-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1992-68-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1992-178-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1992-70-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2184-6-0x0000000002350000-0x00000000023B7000-memory.dmp

Download

memory/2184-1-0x0000000002350000-0x00000000023B7000-memory.dmp

Download

memory/2184-0-0x0000000030000000-0x000000003009B000-memory.dmp

Download

memory/2184-100-0x0000000030000000-0x000000003009B000-memory.dmp

Download

memory/2208-443-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2208-154-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2280-198-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2280-622-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2564-228-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2564-115-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2724-273-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2724-629-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2760-621-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2760-179-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2984-131-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2984-251-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3028-129-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3120-150-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3120-620-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3120-272-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3224-214-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3224-210-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3444-624-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3444-229-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4084-127-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4084-28-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4084-32-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4084-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4084-33-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4416-222-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4416-101-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4432-86-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4432-84-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4432-74-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4432-80-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4432-73-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4620-166-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4620-505-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4820-19-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4820-126-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4820-20-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4820-11-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5052-49-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5052-55-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5052-48-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/5052-165-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/5056-88-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5056-89-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5056-209-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5072-627-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5072-248-0x0000000140000000-0x0000000140216000-memory.dmp

Download